Windows 10 22h2
Monthly
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Local privilege escalation in the Windows Cross Device Service (CVE-2026-66804) allows a low-privileged authenticated user to gain SYSTEM or elevated permissions on the local machine. The flaw stems from CWE-284 (Improper Access Control), meaning the service fails to adequately enforce authorization boundaries between user privilege levels. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a straightforward target for post-compromise lateral movement or privilege escalation tooling.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.
Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Local privilege escalation in Windows User Profile Service affects all major current Windows client and server releases, allowing any authenticated local user to gain SYSTEM-level privileges by exploiting improper symlink or junction-point resolution (CWE-59). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required - a standard domain or local account is sufficient. Vendor patch is available; no public exploit is identified at time of analysis, but the low barrier to exploitation makes this a practical post-compromise escalation primitive.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.
Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.
Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.
Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.
Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote information disclosure in the Windows SMB Client affects every actively-supported Windows 10, Windows 11, and Windows Server release from 2016 through 2025, exposing potentially sensitive memory contents to unauthenticated network attackers via a CWE-125 out-of-bounds read (CVSS 7.5). The flaw resides in the SMB client stack and is triggered when a vulnerable Windows host processes a crafted response from an attacker-controlled SMB server, requiring no authentication or user interaction from the attacker's perspective. No public exploit has been identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the extraordinary breadth of affected products and the vendor-confirmed patch make this a standard patch-cycle priority.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Privilege escalation in Windows License Manager exposes a critical authenticated-but-low-privileged local attacker path to full SYSTEM-level control across a wide range of Windows client and server builds. The root cause (CWE-306) is a missing authentication gate on a privileged License Manager function - an authorized standard user can invoke it without satisfying the elevated-privilege check that should protect it. Microsoft has released patches covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.
Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.
Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem enables a locally authenticated attacker to elevate privileges to SYSTEM-level access across a broad range of Windows client and server releases. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact upon successful exploitation with low attack complexity once local access is established. Microsoft has released patches per MSRC advisory CVE-2026-62754; no public exploit code has been identified and the vulnerability has not appeared in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Windows HTTP.sys enables a locally authenticated, low-privileged attacker to escalate privileges on the affected host, likely achieving SYSTEM-level control. The flaw spans a wide range of Windows versions from Server 2012 through Windows 11 26H1, representing substantial enterprise exposure despite requiring initial local access. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines via the MSRC advisory.
Privilege escalation via heap-based buffer overflow in Windows Kerberos affects the full breadth of supported Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025. An attacker holding a valid low-privilege local account can trigger a heap corruption condition in the Kerberos implementation to achieve complete confidentiality, integrity, and availability impact on the compromised host - effectively gaining SYSTEM-level control. Vendor-released patches with exact fixed build numbers are available via Microsoft MSRC; no public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.
Windows Device Association Service contains a heap-based buffer overflow (CWE-122) that enables local privilege escalation on a broad swath of Windows client and server editions, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An attacker holding a standard low-privileged local account can exploit this flaw without any user interaction, achieving high impact across confidentiality, integrity, and availability - consistent with full SYSTEM-level compromise. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but Microsoft has released patches and the low attack complexity (AC:L) makes this a reliable privilege escalation primitive once local foothold is established.
Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Local privilege escalation in the Windows Cross Device Service (CVE-2026-66804) allows a low-privileged authenticated user to gain SYSTEM or elevated permissions on the local machine. The flaw stems from CWE-284 (Improper Access Control), meaning the service fails to adequately enforce authorization boundaries between user privilege levels. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a straightforward target for post-compromise lateral movement or privilege escalation tooling.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.
Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Local privilege escalation in Windows User Profile Service affects all major current Windows client and server releases, allowing any authenticated local user to gain SYSTEM-level privileges by exploiting improper symlink or junction-point resolution (CWE-59). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required - a standard domain or local account is sufficient. Vendor patch is available; no public exploit is identified at time of analysis, but the low barrier to exploitation makes this a practical post-compromise escalation primitive.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.
Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.
Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.
Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.
Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote information disclosure in the Windows SMB Client affects every actively-supported Windows 10, Windows 11, and Windows Server release from 2016 through 2025, exposing potentially sensitive memory contents to unauthenticated network attackers via a CWE-125 out-of-bounds read (CVSS 7.5). The flaw resides in the SMB client stack and is triggered when a vulnerable Windows host processes a crafted response from an attacker-controlled SMB server, requiring no authentication or user interaction from the attacker's perspective. No public exploit has been identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the extraordinary breadth of affected products and the vendor-confirmed patch make this a standard patch-cycle priority.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Privilege escalation in Windows License Manager exposes a critical authenticated-but-low-privileged local attacker path to full SYSTEM-level control across a wide range of Windows client and server builds. The root cause (CWE-306) is a missing authentication gate on a privileged License Manager function - an authorized standard user can invoke it without satisfying the elevated-privilege check that should protect it. Microsoft has released patches covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.
Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.
Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem enables a locally authenticated attacker to elevate privileges to SYSTEM-level access across a broad range of Windows client and server releases. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact upon successful exploitation with low attack complexity once local access is established. Microsoft has released patches per MSRC advisory CVE-2026-62754; no public exploit code has been identified and the vulnerability has not appeared in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Windows HTTP.sys enables a locally authenticated, low-privileged attacker to escalate privileges on the affected host, likely achieving SYSTEM-level control. The flaw spans a wide range of Windows versions from Server 2012 through Windows 11 26H1, representing substantial enterprise exposure despite requiring initial local access. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines via the MSRC advisory.
Privilege escalation via heap-based buffer overflow in Windows Kerberos affects the full breadth of supported Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025. An attacker holding a valid low-privilege local account can trigger a heap corruption condition in the Kerberos implementation to achieve complete confidentiality, integrity, and availability impact on the compromised host - effectively gaining SYSTEM-level control. Vendor-released patches with exact fixed build numbers are available via Microsoft MSRC; no public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.
Windows Device Association Service contains a heap-based buffer overflow (CWE-122) that enables local privilege escalation on a broad swath of Windows client and server editions, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An attacker holding a standard low-privileged local account can exploit this flaw without any user interaction, achieving high impact across confidentiality, integrity, and availability - consistent with full SYSTEM-level compromise. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but Microsoft has released patches and the low attack complexity (AC:L) makes this a reliable privilege escalation primitive once local foothold is established.
Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.