Windows 10 22h2
Monthly
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
Local information disclosure in the Windows Update Orchestrator Service allows an authenticated attacker with low-level privileges to read files they could not otherwise access by exploiting a link-following flaw (CWE-59). The attacker must create a symbolic link or junction in a location resolved by the privileged service, which then accesses the linked file with higher privileges. This vulnerability affects various unpatched Windows 10, Windows 11, and Windows Server versions; Microsoft has released patches, and no public exploit identified at time of analysis (CISA SSVC exploitation: none). CVSS 5.5 (Medium) reflects the local-only, authenticated vector with confidentiality-only impact.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.
Local privilege-based security-feature bypass in the Windows Update Orchestrator Service (UsoSvc): an attacker who already holds a foothold and at least low-level user privileges on an affected Windows host can present hard-coded credentials to defeat a protection mechanism of the service. Because the hard-coded secret is embedded in the component rather than derived per-install, any local user who can invoke the service can reuse it, with the resulting impact limited to integrity (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N) - no confidentiality loss or denial of service. All supported Windows client and server branches below their respective patched builds are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022 and Windows Server 2025; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, and Microsoft has released patched builds.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
Incorrect authorization in Windows Hello allows a locally positioned attacker who already holds high privileges on the host (CVSS PR:H) to bypass the Windows Hello security feature and read data that the feature is meant to protect, resulting in a confidentiality-only impact (C:H, I:N, A:N) and a base score of 4.4. The flaw is local-only (AV:L), low complexity (AC:L), and requires no user interaction (UI:N), so it presupposes pre-existing elevated access to the machine and that Windows Hello is actually in use as the bypassed control; unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds are affected. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Microsoft has published vendor patches that resolve the affected builds via the MSRC update guide.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Local privilege escalation in the Windows Broadcast DVR User Service on unpatched Windows 10 and Windows 11 builds allows an authenticated low-privileged attacker to gain elevated privileges by exploiting a time-of-check time-of-use race condition. The vendor CVSS 3.1 base score is 6.5 Medium (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), while the independent assessment rates the race as high complexity (AC:H) because the attacker must reliably win a narrow timing window; SSVC lists Exploitation: none and Automatable: no. No public exploit code was identified at time of analysis, and vendor patches are available for the affected Windows 10 21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1/26H2 branches.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
Local information disclosure in the Windows Update Orchestrator Service allows an authenticated attacker with low-level privileges to read files they could not otherwise access by exploiting a link-following flaw (CWE-59). The attacker must create a symbolic link or junction in a location resolved by the privileged service, which then accesses the linked file with higher privileges. This vulnerability affects various unpatched Windows 10, Windows 11, and Windows Server versions; Microsoft has released patches, and no public exploit identified at time of analysis (CISA SSVC exploitation: none). CVSS 5.5 (Medium) reflects the local-only, authenticated vector with confidentiality-only impact.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.
Local privilege-based security-feature bypass in the Windows Update Orchestrator Service (UsoSvc): an attacker who already holds a foothold and at least low-level user privileges on an affected Windows host can present hard-coded credentials to defeat a protection mechanism of the service. Because the hard-coded secret is embedded in the component rather than derived per-install, any local user who can invoke the service can reuse it, with the resulting impact limited to integrity (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N) - no confidentiality loss or denial of service. All supported Windows client and server branches below their respective patched builds are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022 and Windows Server 2025; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, and Microsoft has released patched builds.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
Incorrect authorization in Windows Hello allows a locally positioned attacker who already holds high privileges on the host (CVSS PR:H) to bypass the Windows Hello security feature and read data that the feature is meant to protect, resulting in a confidentiality-only impact (C:H, I:N, A:N) and a base score of 4.4. The flaw is local-only (AV:L), low complexity (AC:L), and requires no user interaction (UI:N), so it presupposes pre-existing elevated access to the machine and that Windows Hello is actually in use as the bypassed control; unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds are affected. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Microsoft has published vendor patches that resolve the affected builds via the MSRC update guide.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Local privilege escalation in the Windows Broadcast DVR User Service on unpatched Windows 10 and Windows 11 builds allows an authenticated low-privileged attacker to gain elevated privileges by exploiting a time-of-check time-of-use race condition. The vendor CVSS 3.1 base score is 6.5 Medium (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), while the independent assessment rates the race as high complexity (AC:H) because the attacker must reliably win a narrow timing window; SSVC lists Exploitation: none and Automatable: no. No public exploit code was identified at time of analysis, and vendor patches are available for the affected Windows 10 21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1/26H2 branches.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.