Windows 10 22h2
Monthly
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.
Memory corruption in Microsoft XML (MSXML) allows an unauthenticated remote attacker to execute arbitrary code in the context of whatever process parses attacker-supplied XML, with high impact to confidentiality, integrity, and availability (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are supported Windows client and server editions - including Server Core installs - running builds older than the fixed levels catalogued in EUVD-2026-99433 and the MSRC advisory, from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025. Microsoft has shipped vendor fixes, and there is no public exploit identified at time of analysis: CISA's SSVC entry records exploitation as 'none' and marks the flaw as not automatable, though the HIGH attack complexity reflects that a reliable use-after-free requires precise heap grooming and, in practice, an XML-rendering or XML-consuming path must be reached.
Local privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged, authenticated session on a vulnerable host gain full SYSTEM-level control by triggering a use-after-free (CWE-416) in kernel memory handling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unpatched population covers Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 and Windows Server 2022/2025, with fixes recorded in EUVD-2026-100051 that raise builds such as Windows 11 24H2 to 10.0.26100.9711, Server 2025 to 10.0.26100.33650 and Windows 10 to 10.0.19044.7807. Patch available per vendor advisory; no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with automatability as no, although technical impact is rated total.
Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.
Local privilege escalation in the Windows RPC Runtime lets an attacker who already holds a low-privileged local account on a Windows host free an invalid pointer or reference (CWE-763) inside the RPC code path and turn that memory-management error into SYSTEM-level code execution on the same machine (CVSS 7.0, AV:L/PR:L/UI:N/S:U). Exploitation is gated by high attack complexity (AC:H), which is consistent with a race/timing-dependent condition rather than a reliable one-shot primitive, and it cannot be reached remotely or by an unauthenticated user. No public exploit code or confirmed active exploitation has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes through its monthly update channel, so this is a genuine but non-urgent patching priority concentrated on multi-user, RDP and jump hosts where untrusted standard users can log on locally.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Windows CD-ROM Driver (cdrom.sys) contains a buffer over-read (CWE-126) that can disclose kernel memory and, per the vendor's threat model, be exploited by an unauthenticated remote attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds. Our independent assessment keeps AV:N/PR:N/UI:N but raises attack complexity to High and reduces integrity/availability impact to Low, because exploitation requires reaching the driver's input-handling path and the over-read primitive mainly yields disclosure rather than guaranteed code execution; CISA SSVC records no observed exploitation, no public exploit identified at time of analysis, and EPSS is low at 0.89% (58th percentile). Microsoft has released fixed builds, so affected systems should be patched per the MSRC advisory.
Local privilege escalation in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds code execution as any logged-on user to raise privileges to kernel/SYSTEM level. The defect is a use-after-free (CWE-416) in a subsystem present in default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025, requiring no user interaction once a local foothold exists, though it cannot be triggered remotely and grants no initial access on its own. Microsoft has released vendor patches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.
Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.
Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.
Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).
Local privilege escalation in Microsoft Windows is possible because the COM+ Event System Service dereferences an untrusted pointer (CWE-822), allowing an authenticated attacker who already holds a low-privileged foothold on the host to elevate to SYSTEM. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds listed below the fixed build numbers (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), with a CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and total technical impact per the CISA SSVC assessment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the practical risk is bounded by the requirement for pre-existing interactive local access rather than any remote vector.
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
An out-of-bounds read in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to cause a denial of service on affected hosts, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting availability-only impact. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 are affected, but exploitation is only reachable on hosts that actually expose an IKE/IPsec listener on UDP 500/4500 to the attacker's network - typically VPN gateways, IKEv2 remote-access servers, or hosts under domain IPsec policy. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and Microsoft has released vendor patches listed in the MSRC update guide.
Privilege escalation in the Windows TCP/IP stack allows a locally authenticated, low-privileged user to trigger a kernel double free and, by winning the subsequent memory-reclamation race, gain code execution at higher (SYSTEM-level) integrity on unpatched Windows 10, Windows 11 and Windows Server builds. Exploitation demands an existing local foothold with at least low privileges and precise timing to line up kernel pool state, which is reflected in the high attack complexity component of the CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector; it cannot be triggered remotely or anonymously. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches. With a CVSS base score of 7.0 and a CISA SSVC assessment of total technical impact but no exploitation and no automatable path, this is a genuine but moderate-priority elevation-of-privilege flaw rather than an emergency, and matters most where low-privileged local access is common (RDP hosts, VDI, multi-user terminal servers).
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege escalation in the Windows Error Reporting (WER) component of supported Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-level authenticated local access to elevate to a more privileged context on the same host. The flaw is a weak-authentication defect (CWE-1390) in WER that is locally exploitable with low complexity, no user interaction, and no special preconditions beyond an existing foothold, which is what drives the 7.8 base score. Microsoft has published a fix through its regular update channel (MSRC update guide), and at time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, so this is a patch-now hardening item rather than an urgent emergency-mitigation case.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authenticated attacker who already holds low-privileged code execution on the host to elevate to a higher-integrity context, with total impact to confidentiality, integrity and availability. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms the flaw is only reachable from a local session by a low-privileged principal, requires no user interaction, and needs no non-default feature to be enabled, so every unpatched build of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2 and Windows Server 2012 through 2025 is exposed once an attacker has a foothold; there is no remote or network-reachable path. CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis; Microsoft has published a fix, making this a credible but not emergency-tier patching priority whose practical abuse case is post-access escalation on already-breached or multi-user hosts.
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authorized attacker with a low-privileged local account to reach SYSTEM-level code execution by winning a time-of-check/time-of-use race (CWE-367) that triggers a use-after-free in kernel mode. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 running builds below the patched revisions; the assessed CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor patches are available from Microsoft, and no public exploit identified at time of analysis (CISA SSVC reports Exploitation: none, and the CVE is not linked to KEV), so risk is concentrated in post-compromise escalation on shared or multi-user hosts rather than remote mass exploitation.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) lets an attacker who already holds low-privileged, authenticated code execution on a host read out-of-bounds kernel memory and chain that primitive into full SYSTEM-level control. All supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below their respective fixed build numbers are affected; the driver ships by default, so no optional feature must be enabled. There is no public exploit identified at time of analysis (CISA SSVC records Exploitation as 'none' and Automatable as 'no'), and this is not a KEV-listed, actively exploited issue - but the reported CVSS of 7.8 with high confidentiality, integrity and availability impact makes it a credible, moderate-priority escalation target once an attacker has a local foothold. A vendor-released patch is available.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows unauthenticated remote attackers to execute code on affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems, provided they can trick a user into opening, mounting, or processing malicious partition or disk data (UI:R). Vendor patches are available, and no public exploit or confirmed active exploitation has been identified at time of analysis; this is a high-priority patching item but not an emergency.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.
Local privilege escalation in the Windows Update Orchestrator Service allows an authenticated, low-privileged user on an unpatched Windows host to follow a crafted symbolic link or NTFS junction into a privileged file operation and gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable: it requires an existing local foothold and credentials (PR:L, AV:L) plus winning a timing window against the service (AC:H), and it needs no user interaction (UI:N). No public exploit has been identified at time of analysis - CISA SSVC records exploitation as 'none' and automatable as 'no' - and Microsoft has shipped fixed builds across the affected Windows 10, Windows 11, and Windows Server branches, so remediation is a straightforward update rather than an emergency containment exercise.
Local privilege escalation in the Windows Device Install Service lets an authenticated attacker holding only low-level privileges on a host raise their rights to a higher integrity level (CVSS 3.1 base 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an incorrect authorization check (CWE-863) in a service that normally runs with high privileges, so any standard user who can already execute code - or plug in or trigger a device installation - on an unpatched Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system is a potential victim; default configurations are affected and no user interaction is needed. Microsoft has published a fix, and there is no public exploit identified at time of analysis and no CISA KEV listing or SSVC exploitation signal, though the SSVC technical impact rating is "total" because successful exploitation yields high confidentiality, integrity, and availability impact within the same security scope.
Local privilege escalation in the Windows Virtual Input component allows an authenticated, low-privileged attacker to gain elevated rights on affected Windows 10, Windows 11 and Windows Server hosts. Exploitation requires an attacker to already hold a local interactive foothold on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and to trigger an improper authorization check in the component (CWE-283, Unverified Ownership); no victim interaction is required and attack complexity is low, so escalation is straightforward once local access exists. A vendor patch is available from Microsoft, no public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with the flaw judged not automatable, indicating it is not suitable for mass, scalable attacks.
Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Local privilege escalation in OpenSSH for Windows stems from a use-after-free (CWE-416) in the SSH component shipped with supported Windows builds, allowing an authenticated low-privileged user who already holds a foothold on the host to corrupt memory inside the OpenSSH process and elevate to the privileges of that process, with high impact across confidentiality, integrity and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: there is no remote or network vector, no user interaction is required, and exploitation presupposes a valid low-privilege account plus the vulnerable OpenSSH for Windows component being installed and in use on an unpatched build. No public exploit code has been identified at the time of analysis, CISA's SSVC decision framework records exploitation as none and the flaw as not automatable, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Local privilege escalation in Windows Win32K allows an attacker who already holds low-privileged, authenticated local access to trigger a use-after-free in the kernel-mode window manager driver and obtain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. The defect is a second-stage primitive rather than an initial-access flaw: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing foothold on the host plus the ability to execute code issuing Win32K syscalls, and it cannot be reached by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis, CISA's SSVC data records exploitation as "none" and automatable as "no", and Microsoft has released a vendor patch covering all listed Windows client and server builds.
Local privilege escalation in the Windows Win32 Kernel Subsystem (Win32k) allows an attacker who already holds a low-privileged, authenticated local foothold to corrupt kernel memory and elevate to higher integrity, potentially SYSTEM. The flaw is a use-after-free (CWE-416) reachable through the user-mode-to-kernel windowing/GDI path; per the assessed vector AV:L/AC:L/PR:L/UI:N, exploitation requires prior local code execution and no user interaction, so it is a post-compromise escalation primitive rather than an initial-access or remote vector. Microsoft has released vendor patches and CISA's SSVC decision data records no known exploitation and no automatable exploitation path; no public exploit code has been identified at time of analysis. Rated 7.8 (High) with total technical impact, this is a credible but not emergency-tier priority - patch on a normal cadence, prioritizing multi-user and high-value Windows 10, Windows 11, and Windows Server hosts.
Code injection in the Windows Encrypting File System (EFS) allows an authenticated attacker holding only low-level privileges (PR:L) to execute arbitrary code over the network against unpatched Windows hosts, with high impact across confidentiality, integrity, and availability (CVSS 8.8). Every supported Windows branch is in scope, including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022, and 2025 (Server Core included), and exploitation requires network reachability to the EFS component rather than any user interaction. Microsoft has published patched builds for each affected branch, and at time of analysis there is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment records exploitation as 'none' with automatable set to 'no'.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.
Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.
A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in Windows Win32K allows an authenticated attacker with low-privileged access to elevate to higher integrity levels by exploiting a use-after-free (CWE-416) condition. Affected systems include a broad range of Windows 10, Windows 11, and Windows Server versions (2016 through 2025); a vendor patch is available. No public exploit code or active exploitation has been identified, and the risk is assessed as credible but not emergency-level.
Improper input validation in Microsoft Windows Hyper-V allows an authenticated but low-privileged local user to spoof trusted resources on a virtualization host, tampering with data that should be integrity-protected (CISA SSVC 'Technical Impact: total'; CVSS 8.8 HIGH). Exploitation is strictly local (AV:L) and requires a valid low-privileged account (PR:L) plus the Hyper-V role or hypervisor platform to be present, with no user interaction; CISA's SSVC records no observed exploitation and rates the flaw non-automatable, so no public exploit code has been identified at the time of analysis. Microsoft has shipped fixed builds across all affected Windows 10, Windows 11 and Windows Server 2012-through-2025 SKUs, including Server Core installations.
Local privilege escalation in Windows Overlay Filter (WOF) allows an authenticated low-privileged attacker with the ability to run code on a vulnerable Windows host to trigger a buffer over-read (CWE-126) and gain elevated privileges, potentially including SYSTEM-level access. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD/MSRC advisory, and the flaw cannot be reached remotely. This is a genuine but second-tier priority: no public exploit code has been identified, SSVC rates exploitation as none and non-automatable, and the attacker must already hold a local authenticated session, so it is primarily a post-compromise escalation risk rather than an initial-access vector.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker holding standard user rights on a host to corrupt the DWM process through a use-after-free and execute code with the elevated privileges that process enjoys. Exploitation requires prior local access at low privilege (CVSS AV:L/PR:L), needs no user interaction and no non-default configuration, because DWM is a default-enabled composition subsystem on every supported Windows 10, Windows 11, and Windows Server build listed by EUVD. Microsoft has published fixed builds and no public exploit has been identified at time of analysis, so this functions as a post-foothold escalation step rather than a remote entry point; severity is high (7.8) but it is not a remotely exploitable crisis.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.
Memory corruption in Microsoft XML (MSXML) allows an unauthenticated remote attacker to execute arbitrary code in the context of whatever process parses attacker-supplied XML, with high impact to confidentiality, integrity, and availability (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are supported Windows client and server editions - including Server Core installs - running builds older than the fixed levels catalogued in EUVD-2026-99433 and the MSRC advisory, from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025. Microsoft has shipped vendor fixes, and there is no public exploit identified at time of analysis: CISA's SSVC entry records exploitation as 'none' and marks the flaw as not automatable, though the HIGH attack complexity reflects that a reliable use-after-free requires precise heap grooming and, in practice, an XML-rendering or XML-consuming path must be reached.
Local privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged, authenticated session on a vulnerable host gain full SYSTEM-level control by triggering a use-after-free (CWE-416) in kernel memory handling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unpatched population covers Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 and Windows Server 2022/2025, with fixes recorded in EUVD-2026-100051 that raise builds such as Windows 11 24H2 to 10.0.26100.9711, Server 2025 to 10.0.26100.33650 and Windows 10 to 10.0.19044.7807. Patch available per vendor advisory; no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with automatability as no, although technical impact is rated total.
Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.
Local privilege escalation in the Windows RPC Runtime lets an attacker who already holds a low-privileged local account on a Windows host free an invalid pointer or reference (CWE-763) inside the RPC code path and turn that memory-management error into SYSTEM-level code execution on the same machine (CVSS 7.0, AV:L/PR:L/UI:N/S:U). Exploitation is gated by high attack complexity (AC:H), which is consistent with a race/timing-dependent condition rather than a reliable one-shot primitive, and it cannot be reached remotely or by an unauthenticated user. No public exploit code or confirmed active exploitation has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes through its monthly update channel, so this is a genuine but non-urgent patching priority concentrated on multi-user, RDP and jump hosts where untrusted standard users can log on locally.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Windows CD-ROM Driver (cdrom.sys) contains a buffer over-read (CWE-126) that can disclose kernel memory and, per the vendor's threat model, be exploited by an unauthenticated remote attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds. Our independent assessment keeps AV:N/PR:N/UI:N but raises attack complexity to High and reduces integrity/availability impact to Low, because exploitation requires reaching the driver's input-handling path and the over-read primitive mainly yields disclosure rather than guaranteed code execution; CISA SSVC records no observed exploitation, no public exploit identified at time of analysis, and EPSS is low at 0.89% (58th percentile). Microsoft has released fixed builds, so affected systems should be patched per the MSRC advisory.
Local privilege escalation in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds code execution as any logged-on user to raise privileges to kernel/SYSTEM level. The defect is a use-after-free (CWE-416) in a subsystem present in default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025, requiring no user interaction once a local foothold exists, though it cannot be triggered remotely and grants no initial access on its own. Microsoft has released vendor patches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.
Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.
Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.
Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).
Local privilege escalation in Microsoft Windows is possible because the COM+ Event System Service dereferences an untrusted pointer (CWE-822), allowing an authenticated attacker who already holds a low-privileged foothold on the host to elevate to SYSTEM. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds listed below the fixed build numbers (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), with a CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and total technical impact per the CISA SSVC assessment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the practical risk is bounded by the requirement for pre-existing interactive local access rather than any remote vector.
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
An out-of-bounds read in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to cause a denial of service on affected hosts, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting availability-only impact. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 are affected, but exploitation is only reachable on hosts that actually expose an IKE/IPsec listener on UDP 500/4500 to the attacker's network - typically VPN gateways, IKEv2 remote-access servers, or hosts under domain IPsec policy. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and Microsoft has released vendor patches listed in the MSRC update guide.
Privilege escalation in the Windows TCP/IP stack allows a locally authenticated, low-privileged user to trigger a kernel double free and, by winning the subsequent memory-reclamation race, gain code execution at higher (SYSTEM-level) integrity on unpatched Windows 10, Windows 11 and Windows Server builds. Exploitation demands an existing local foothold with at least low privileges and precise timing to line up kernel pool state, which is reflected in the high attack complexity component of the CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector; it cannot be triggered remotely or anonymously. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches. With a CVSS base score of 7.0 and a CISA SSVC assessment of total technical impact but no exploitation and no automatable path, this is a genuine but moderate-priority elevation-of-privilege flaw rather than an emergency, and matters most where low-privileged local access is common (RDP hosts, VDI, multi-user terminal servers).
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege escalation in the Windows Error Reporting (WER) component of supported Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-level authenticated local access to elevate to a more privileged context on the same host. The flaw is a weak-authentication defect (CWE-1390) in WER that is locally exploitable with low complexity, no user interaction, and no special preconditions beyond an existing foothold, which is what drives the 7.8 base score. Microsoft has published a fix through its regular update channel (MSRC update guide), and at time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, so this is a patch-now hardening item rather than an urgent emergency-mitigation case.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authenticated attacker who already holds low-privileged code execution on the host to elevate to a higher-integrity context, with total impact to confidentiality, integrity and availability. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms the flaw is only reachable from a local session by a low-privileged principal, requires no user interaction, and needs no non-default feature to be enabled, so every unpatched build of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2 and Windows Server 2012 through 2025 is exposed once an attacker has a foothold; there is no remote or network-reachable path. CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis; Microsoft has published a fix, making this a credible but not emergency-tier patching priority whose practical abuse case is post-access escalation on already-breached or multi-user hosts.
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authorized attacker with a low-privileged local account to reach SYSTEM-level code execution by winning a time-of-check/time-of-use race (CWE-367) that triggers a use-after-free in kernel mode. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 running builds below the patched revisions; the assessed CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor patches are available from Microsoft, and no public exploit identified at time of analysis (CISA SSVC reports Exploitation: none, and the CVE is not linked to KEV), so risk is concentrated in post-compromise escalation on shared or multi-user hosts rather than remote mass exploitation.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) lets an attacker who already holds low-privileged, authenticated code execution on a host read out-of-bounds kernel memory and chain that primitive into full SYSTEM-level control. All supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below their respective fixed build numbers are affected; the driver ships by default, so no optional feature must be enabled. There is no public exploit identified at time of analysis (CISA SSVC records Exploitation as 'none' and Automatable as 'no'), and this is not a KEV-listed, actively exploited issue - but the reported CVSS of 7.8 with high confidentiality, integrity and availability impact makes it a credible, moderate-priority escalation target once an attacker has a local foothold. A vendor-released patch is available.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows unauthenticated remote attackers to execute code on affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems, provided they can trick a user into opening, mounting, or processing malicious partition or disk data (UI:R). Vendor patches are available, and no public exploit or confirmed active exploitation has been identified at time of analysis; this is a high-priority patching item but not an emergency.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.
Local privilege escalation in the Windows Update Orchestrator Service allows an authenticated, low-privileged user on an unpatched Windows host to follow a crafted symbolic link or NTFS junction into a privileged file operation and gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable: it requires an existing local foothold and credentials (PR:L, AV:L) plus winning a timing window against the service (AC:H), and it needs no user interaction (UI:N). No public exploit has been identified at time of analysis - CISA SSVC records exploitation as 'none' and automatable as 'no' - and Microsoft has shipped fixed builds across the affected Windows 10, Windows 11, and Windows Server branches, so remediation is a straightforward update rather than an emergency containment exercise.
Local privilege escalation in the Windows Device Install Service lets an authenticated attacker holding only low-level privileges on a host raise their rights to a higher integrity level (CVSS 3.1 base 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an incorrect authorization check (CWE-863) in a service that normally runs with high privileges, so any standard user who can already execute code - or plug in or trigger a device installation - on an unpatched Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system is a potential victim; default configurations are affected and no user interaction is needed. Microsoft has published a fix, and there is no public exploit identified at time of analysis and no CISA KEV listing or SSVC exploitation signal, though the SSVC technical impact rating is "total" because successful exploitation yields high confidentiality, integrity, and availability impact within the same security scope.
Local privilege escalation in the Windows Virtual Input component allows an authenticated, low-privileged attacker to gain elevated rights on affected Windows 10, Windows 11 and Windows Server hosts. Exploitation requires an attacker to already hold a local interactive foothold on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and to trigger an improper authorization check in the component (CWE-283, Unverified Ownership); no victim interaction is required and attack complexity is low, so escalation is straightforward once local access exists. A vendor patch is available from Microsoft, no public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with the flaw judged not automatable, indicating it is not suitable for mass, scalable attacks.
Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Local privilege escalation in OpenSSH for Windows stems from a use-after-free (CWE-416) in the SSH component shipped with supported Windows builds, allowing an authenticated low-privileged user who already holds a foothold on the host to corrupt memory inside the OpenSSH process and elevate to the privileges of that process, with high impact across confidentiality, integrity and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: there is no remote or network vector, no user interaction is required, and exploitation presupposes a valid low-privilege account plus the vulnerable OpenSSH for Windows component being installed and in use on an unpatched build. No public exploit code has been identified at the time of analysis, CISA's SSVC decision framework records exploitation as none and the flaw as not automatable, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Local privilege escalation in Windows Win32K allows an attacker who already holds low-privileged, authenticated local access to trigger a use-after-free in the kernel-mode window manager driver and obtain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. The defect is a second-stage primitive rather than an initial-access flaw: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing foothold on the host plus the ability to execute code issuing Win32K syscalls, and it cannot be reached by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis, CISA's SSVC data records exploitation as "none" and automatable as "no", and Microsoft has released a vendor patch covering all listed Windows client and server builds.
Local privilege escalation in the Windows Win32 Kernel Subsystem (Win32k) allows an attacker who already holds a low-privileged, authenticated local foothold to corrupt kernel memory and elevate to higher integrity, potentially SYSTEM. The flaw is a use-after-free (CWE-416) reachable through the user-mode-to-kernel windowing/GDI path; per the assessed vector AV:L/AC:L/PR:L/UI:N, exploitation requires prior local code execution and no user interaction, so it is a post-compromise escalation primitive rather than an initial-access or remote vector. Microsoft has released vendor patches and CISA's SSVC decision data records no known exploitation and no automatable exploitation path; no public exploit code has been identified at time of analysis. Rated 7.8 (High) with total technical impact, this is a credible but not emergency-tier priority - patch on a normal cadence, prioritizing multi-user and high-value Windows 10, Windows 11, and Windows Server hosts.
Code injection in the Windows Encrypting File System (EFS) allows an authenticated attacker holding only low-level privileges (PR:L) to execute arbitrary code over the network against unpatched Windows hosts, with high impact across confidentiality, integrity, and availability (CVSS 8.8). Every supported Windows branch is in scope, including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022, and 2025 (Server Core included), and exploitation requires network reachability to the EFS component rather than any user interaction. Microsoft has published patched builds for each affected branch, and at time of analysis there is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment records exploitation as 'none' with automatable set to 'no'.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.
Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.
A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in Windows Win32K allows an authenticated attacker with low-privileged access to elevate to higher integrity levels by exploiting a use-after-free (CWE-416) condition. Affected systems include a broad range of Windows 10, Windows 11, and Windows Server versions (2016 through 2025); a vendor patch is available. No public exploit code or active exploitation has been identified, and the risk is assessed as credible but not emergency-level.
Improper input validation in Microsoft Windows Hyper-V allows an authenticated but low-privileged local user to spoof trusted resources on a virtualization host, tampering with data that should be integrity-protected (CISA SSVC 'Technical Impact: total'; CVSS 8.8 HIGH). Exploitation is strictly local (AV:L) and requires a valid low-privileged account (PR:L) plus the Hyper-V role or hypervisor platform to be present, with no user interaction; CISA's SSVC records no observed exploitation and rates the flaw non-automatable, so no public exploit code has been identified at the time of analysis. Microsoft has shipped fixed builds across all affected Windows 10, Windows 11 and Windows Server 2012-through-2025 SKUs, including Server Core installations.
Local privilege escalation in Windows Overlay Filter (WOF) allows an authenticated low-privileged attacker with the ability to run code on a vulnerable Windows host to trigger a buffer over-read (CWE-126) and gain elevated privileges, potentially including SYSTEM-level access. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD/MSRC advisory, and the flaw cannot be reached remotely. This is a genuine but second-tier priority: no public exploit code has been identified, SSVC rates exploitation as none and non-automatable, and the attacker must already hold a local authenticated session, so it is primarily a post-compromise escalation risk rather than an initial-access vector.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker holding standard user rights on a host to corrupt the DWM process through a use-after-free and execute code with the elevated privileges that process enjoys. Exploitation requires prior local access at low privilege (CVSS AV:L/PR:L), needs no user interaction and no non-default configuration, because DWM is a default-enabled composition subsystem on every supported Windows 10, Windows 11, and Windows Server build listed by EUVD. Microsoft has published fixed builds and no public exploit has been identified at time of analysis, so this functions as a post-foothold escalation step rather than a remote entry point; severity is high (7.8) but it is not a remotely exploitable crisis.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.