Windows 10 Version 1607
Monthly
Local code execution in the Microsoft Windows NTFS file-system driver lets an attacker run arbitrary code by inducing a victim to interact with a specially crafted NTFS artifact (e.g., a malicious volume, VHD, or file). The flaw stems from an integer underflow (CWE-191) and spans a broad range of Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free condition (CWE-416) in kernel memory. The flaw affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local code execution in the Windows NTFS driver (CVE-2026-49797) allows an attacker with local access to run arbitrary code by tricking a user into interacting with a maliciously crafted NTFS artifact, exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released a patch; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Windows GDI+ (the Graphics Device Interface Plus rendering component) affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An attacker who convinces a user to open or preview a specially crafted image or document triggers a heap-based buffer overflow (CWE-122) during graphics parsing, yielding arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but GDI+ image-parsing flaws are historically attractive to attackers.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
Local privilege escalation via arbitrary code execution in Microsoft Windows Resilient File System (ReFS) affects a broad range of Windows 10, Windows 11, and Windows Server (2016-2025) builds. An authorized (low-privileged) attacker who can trigger the vulnerable heap allocation path can corrupt heap memory (CWE-122) to run code in the security context of the ReFS driver, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Local code execution in Microsoft's Resilient File System (ReFS) driver allows an authorized (low-privileged) attacker to run arbitrary code with elevated context via a numeric truncation flaw. The bug affects the ReFS component shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the CVE's own tags label it 'Information Disclosure' while the description and CVSS impact (C:H/I:H/A:H) describe full code execution - the code-execution reading should be treated as authoritative.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) lets an already-authenticated low-privileged user (PR:L) abuse a symbolic-link/junction resolution flaw (CWE-59) to redirect a privileged file operation and gain SYSTEM-level control on affected Windows 10, Windows 11, and Windows Server 2012-2025 hosts. Microsoft has released patches; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV, with a low EPSS of 0.28% (20th percentile). SSVC rates technical impact as total but marks exploitation as none and not automatable, consistent with a hands-on local escalation rather than a mass-exploitable remote bug.
Local privilege escalation in the Microsoft Windows Universal Disk Format File System driver (udfs.sys) lets an authenticated low-privileged user gain SYSTEM-level control by triggering an integer underflow (CWE-191) while parsing a malicious UDF-formatted volume. It affects a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Currently there is no public exploit identified at time of analysis, EPSS is low (0.31%), and CISA SSVC rates exploitation as none, though the technical impact is total.
Local privilege escalation in the Microsoft Windows NTFS driver lets an already-authenticated attacker overflow a stack buffer (CWE-121) to run code with full system-level privileges. It affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and CISA's SSVC framework currently rates exploitation as none; EPSS is low at 0.34% (26th percentile), so this is a patch-on-schedule elevation-of-privilege bug rather than an emergency.
Denial of service in the Windows HTTP/2 network stack allows a remote, unauthenticated attacker to exhaust server resources and render affected services unavailable across a broad range of Windows client and server releases (Windows 10/11 and Windows Server 2016 through 2025). Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.5 CVSS reflects high availability impact with no confidentiality or integrity loss.
Denial of service in Microsoft Windows HTTP.sys allows remote unauthenticated attackers to exhaust system resources and make affected hosts unresponsive over the network. The flaw stems from missing resource limits/throttling (CWE-770) in the kernel-mode HTTP protocol stack, affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available via MSRC.
Security feature bypass in Windows Secure Boot (CWE-358) allows a locally authenticated attacker on affected Windows 10, Windows 11, and Windows Server (2016 through 2025) systems to defeat the boot-integrity trust chain due to an improperly implemented standard security check. Because Secure Boot is the gate that blocks unsigned/tampered bootloaders and rootkits, a successful bypass can enable pre-OS persistence and undermine downstream protections such as BitLocker and Measured Boot. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; Microsoft has published a patch via its update guide.
Local privilege escalation in the Windows NTFS filesystem driver (CWE-122 heap-based buffer overflow) lets a locally authenticated attacker corrupt kernel heap memory and execute arbitrary code, per Microsoft's CVSS 3.1 vector (AV:L/PR:L). Affected builds span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as 'none', with a low EPSS score of 0.29% (21st percentile), though the technical impact is rated 'total'.
Privilege escalation in the Microsoft Windows DHCP Client service, driven by an integer underflow (CWE-191) triggered when processing DHCP traffic, lets an unauthorized network attacker gain elevated privileges with full confidentiality, integrity, and availability impact. It affects a broad Windows fleet spanning Windows 10 (1607/1809) and Windows Server 2012 through 2025, including Server Core installations. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is modest at 0.76% (51st percentile), but the vendor rates it critical (CVSS 9.8) and CISA SSVC flags it as Automatable.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an authenticated network attacker to run arbitrary code on domain controllers by triggering a heap-based buffer overflow (CWE-122). Affected platforms span Windows Server 2012 through 2025 (including Server Core) and Windows 10/11 clients acting in AD roles, with Microsoft-issued patches available. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CVSS 8.8 rating and the sensitivity of the domain-controller attack surface make this a high-priority patch.
Remote code execution in the Microsoft Windows DHCP Server role allows an authenticated network attacker (PR:L) to trigger a heap-based buffer overflow and run arbitrary code on the server. The flaw affects DHCP Server across Windows Server 2012 through Server 2025 (including Server Core installations) and carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated attacker to crash the service and disrupt authentication across all supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The flaw stems from an excessive-size memory allocation (CWE-789) triggerable over the network with no privileges or user interaction, and while a vendor patch is available, there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (A:H) with no confidentiality or integrity loss, but LSASS failure can force system instability or reboots, affecting domain authentication and logon.
Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Local privilege escalation via a heap-based buffer overflow in the Windows NTFS driver allows an authenticated attacker with low privileges to execute arbitrary code and gain full SYSTEM-level control. It affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and SSVC records no observed exploitation; EPSS is low at 0.29% (21st percentile).
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Local code execution in Microsoft Windows Media Foundation lets an attacker run arbitrary code in the context of the victim after luring them to open a maliciously crafted media file. The flaw (CVE-2026-58610, CWE-122 heap-based buffer overflow) affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R) with full confidentiality, integrity, and availability impact; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local code execution in the Microsoft Graphics Component affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). An attacker who convinces a user to open a specially crafted file or content triggers an out-of-bounds read (CWE-125) that Microsoft rates as enabling code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation requires local access plus user interaction, making it a standard patch-cycle priority rather than an emergency.
Remote code execution in the Windows Print Spooler components stems from an improperly synchronized race condition (CWE-362) that an authenticated, network-adjacent attacker can win to run code with full system impact. Microsoft (the reporter) has shipped fixes across the entire supported Windows and Windows Server line, but exploitation requires low privileges and a hard-to-hit timing window, so this is a real-but-non-trivial priority rather than a drop-everything emergency. There is no public exploit identified at time of analysis, EPSS is low at 0.53% (41st percentile), and CISA SSVC scores exploitation as none.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged user corrupt kernel heap memory and gain SYSTEM-level control. The flaw (CWE-122 heap-based buffer overflow, CVSS 7.8) affects a broad range of Windows 10, Windows 11, and Windows Server builds and was reported by Microsoft. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Remote code execution in Microsoft Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, and per its CVSS 9.8 vector requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is modest (0.61%), so despite the critical score exploitation is not yet observed.
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-privileged user on the host gain higher privileges due to insufficient granularity of access control (CWE-1220). Affected deployments span AD FS on Windows Server 2012 through Windows Server 2025, and the flaw carries a CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority-driven rather than exploitation-driven risk.
Local code execution in Microsoft Windows GDI+ (the graphics rendering component) via a heap-based buffer overflow (CWE-122), affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Server 2012 through Server 2025. Per the supplied CVSS vector (PR:N), an unauthorized attacker who gets the vulnerable component to process crafted graphics data can achieve high-impact code execution (C:H/I:H/A:H) on the local system. Microsoft has published a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated network attacker trigger a use-after-free (CWE-416) and run arbitrary code on a broad range of Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rated CVSS 8.1, the flaw carries high impact to confidentiality, integrity, and availability but requires winning a race condition (AC:H), and no public exploit identified at time of analysis. Reported by Microsoft with a vendor patch available.
Windows Remote Desktop Protocol (RDP) client leaks sensitive memory contents due to use of an uninitialized resource (CWE-908), allowing a network-accessible attacker to disclose potentially high-value information from a victim's system. Exploitation requires user interaction - a victim must connect to an attacker-controlled RDP endpoint - making this a client-side information disclosure attack affecting Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2012 through 2025. No public exploit code has been identified and no active exploitation is confirmed; however, the CVSS confidentiality impact is rated High, meaning exposed memory could include credentials or session tokens.
Remote code execution in the Microsoft Windows TCP/IP networking stack allows an unauthenticated attacker on the same physical or logical network segment to win a race condition and run arbitrary code on the target. The flaw spans a broad range of desktop and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, but Microsoft has confirmed the issue and shipped a patch, and the high CVSS (8.8) plus network-facing kernel component make it a priority to remediate.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Denial of service in Windows Active Directory (spanning Windows 10, Windows 11, and Windows Server 2012 through 2025) lets a remote, unauthenticated attacker send crafted network traffic that drives an AD service into an infinite loop, exhausting CPU and rendering domain services unavailable. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high availability impact and no confidentiality or integrity loss, this is a pure availability threat against domain controllers. Microsoft has released a patch; there is no public exploit identified at time of analysis and no CISA KEV listing.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated attacker on the same network segment run arbitrary code by triggering an integer underflow (CWE-191) during multicast message processing. All supported Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1 are affected. There is no public exploit identified at time of analysis, but the CVSS 8.8 adjacent-network unauthenticated profile and Microsoft's own reporting make this a high-priority patch.
Local privilege escalation to code execution in the Windows Resilient File System (ReFS) driver affects a broad range of Windows 10/11 and Windows Server 2016 through 2025 releases, where an integer overflow (CWE-190) in filesystem processing lets an already-authenticated local user run arbitrary code in an elevated context. The CVSS 3.1 vector (AV:L/PR:L) confirms low-privileged local access is required rather than remote exploitation, and there is no public exploit identified at time of analysis. Microsoft has released a patch via MSRC.
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component lets an authenticated local attacker corrupt heap memory and execute arbitrary code, gaining total control (SYSTEM-level) of the affected host. It impacts a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. Microsoft has released patches; publicly available exploit code exists, though SSVC lists exploitation status as none and EPSS probability is low (0.39%).
Local privilege escalation in the Microsoft Printer Drivers component across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 lets an already-authenticated attacker corrupt kernel-adjacent memory to gain higher privileges. The flaw is a double free (CWE-415) triggered locally by a low-privileged user, yielding high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in the Windows Active Directory certificate-validation path lets an already-authenticated attacker on Windows 10 (1607/1809) and Windows Server 2016 through 2025 (including Server Core) improperly validate a certificate to gain higher privileges. Microsoft reported and patched the flaw (CWE-295), but there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS 7.8 vector (AV:L/PR:L) confirms an authenticated local attacker with full confidentiality, integrity, and availability impact upon success.
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) lets an already-authenticated low-privilege user corrupt kernel heap memory via a heap-based buffer overflow (CWE-122) to gain SYSTEM-level control. The flaw affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated low-privileged user to win a race condition and elevate to SYSTEM across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a patch available, it carries CVSS 7.0 but a high attack complexity (AC:H) reflecting the timing-sensitive nature of the flaw. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with CISA SSVC rating exploitation as 'none.'
Heap-based buffer overflow in the Windows Kernel (CWE-122) enables an unauthenticated attacker with physical access to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server editions. The physical attack vector (AV:P) constrains the threat surface significantly, and SSVC rates exploitation as none with no public exploit identified at time of analysis. Despite total technical impact potential confirmed by both CVSS C:H/I:H/A:H metrics and SSVC technical impact rating, real-world risk is concentrated in physically accessible deployment scenarios such as kiosks, field laptops, or shared terminals.
Local privilege escalation in the Windows Common Log File System (CLFS) Driver allows an already-authenticated, low-privileged user to elevate to SYSTEM on a wide range of Windows client and server releases. Microsoft classifies the root cause as exposure of sensitive information (CWE-200), but the CVSS impact profile (C:H/I:H/A:H) reflects that the leaked kernel data enables full local privilege escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CLFS has historically been a heavily exploited elevation-of-privilege target in Windows.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated low-privileged user to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). The flaw spans a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Quality Windows Audio/Video Experience (QWAVE) service across virtually all supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) allows an authenticated local attacker to gain SYSTEM-level control by triggering a use-after-free condition. Microsoft rates the impact as total (full confidentiality, integrity, and availability loss) with CVSS 7.8. There is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet.
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker crash the service by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw affects AD FS as shipped across a broad range of Windows client and server builds (Windows 10/11 and Windows Server 2012 through 2025). Microsoft - the reporting party - has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows App Store component (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025) allows an authorized low-privileged attacker to win a race condition on an improperly synchronized shared resource and gain higher privileges. Exploitation is local-only and high-complexity because it depends on reliably hitting a narrow timing window, and no public exploit has been identified at time of analysis. A vendor patch is available via Microsoft's MSRC update guide.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122). The flaw affects the FTP service across a broad range of Windows 10, Windows 11, and Windows Server (2019/2022/2025) builds and carries a critical CVSS 9.8 rating with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature of the bug makes it a high-priority patch target.
Local privilege escalation in Microsoft Windows WalletService allows an authenticated low-privileged attacker to gain SYSTEM-level rights on the host, per CVSS:3.1 AV:L/AC:L/PR:L (7.8, High). The flaw stems from improper privilege management (CWE-269) in the WalletService component and affects a broad range of Windows client and server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch from Microsoft is available.
Local privilege escalation in the Windows Speech component affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). A use-after-free flaw (CWE-416) lets an authenticated local attacker corrupt memory to gain SYSTEM-level privileges; CVSS is 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, and EPSS is low at 0.26%, but a vendor patch is available via Microsoft's MSRC update guide.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Local information disclosure in the Microsoft Windows App Store (Store/AppX component) affects a broad range of Windows 10, Windows 11, and Windows Server releases (1607 through 26H1, Server 2016/2019/2022/2025). An authorized local attacker can leverage a use of uninitialized resource (CWE-908) to read memory contents that should not be exposed, with CVSS 7.1 reflecting high confidentiality impact but requiring low-privileged authenticated local access. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and Microsoft has released a patch via the MSRC update guide.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated network attacker to corrupt heap memory and run arbitrary code on affected domain controllers. The flaw (CVE-2026-49164, CVSS 8.1) spans a broad range of Windows client and server builds from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, with full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis, and the high attack complexity (AC:H) tempers the practical exploitation likelihood.
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) stems from a heap-based buffer overflow that lets an attacker run arbitrary code over the network. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 and marks it unauthenticated, though as a database driver flaw the realistic trigger is a client connecting to a malicious or compromised SQL Server endpoint. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet actively-exploited issue.
Remote code execution in the Microsoft Windows Bluetooth Port Driver (bthport) allows an adjacent, unauthenticated attacker to run arbitrary code by triggering a heap-based buffer overflow over Bluetooth radio range. The flaw spans a wide range of Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is modest at 0.38% (30th percentile), and CISA SSVC currently marks exploitation as 'none', but the CVSS 8.8 rating and 'total' technical impact make this a high-priority patch.
Privilege elevation in the Windows App Store component affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025), where a race condition (CWE-362) lets an unauthorized attacker win a timing window to gain elevated privileges over a network. The CVSS 3.1 score is 8.1 with a network vector and no authentication (PR:N), but high attack complexity (AC:H) reflects the difficulty of reliably winning the race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate to higher privileges on affected Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 systems. The flaw stems from improper consistency validation of input crossing the trust boundary into the isolated secure kernel (CWE-1288), yielding full confidentiality, integrity, and availability impact on the local host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).
Local code execution in the Microsoft Windows NTFS file-system driver lets an attacker run arbitrary code by inducing a victim to interact with a specially crafted NTFS artifact (e.g., a malicious volume, VHD, or file). The flaw stems from an integer underflow (CWE-191) and spans a broad range of Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free condition (CWE-416) in kernel memory. The flaw affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local code execution in the Windows NTFS driver (CVE-2026-49797) allows an attacker with local access to run arbitrary code by tricking a user into interacting with a maliciously crafted NTFS artifact, exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released a patch; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Windows GDI+ (the Graphics Device Interface Plus rendering component) affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An attacker who convinces a user to open or preview a specially crafted image or document triggers a heap-based buffer overflow (CWE-122) during graphics parsing, yielding arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but GDI+ image-parsing flaws are historically attractive to attackers.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
Local privilege escalation via arbitrary code execution in Microsoft Windows Resilient File System (ReFS) affects a broad range of Windows 10, Windows 11, and Windows Server (2016-2025) builds. An authorized (low-privileged) attacker who can trigger the vulnerable heap allocation path can corrupt heap memory (CWE-122) to run code in the security context of the ReFS driver, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Local code execution in Microsoft's Resilient File System (ReFS) driver allows an authorized (low-privileged) attacker to run arbitrary code with elevated context via a numeric truncation flaw. The bug affects the ReFS component shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the CVE's own tags label it 'Information Disclosure' while the description and CVSS impact (C:H/I:H/A:H) describe full code execution - the code-execution reading should be treated as authoritative.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) lets an already-authenticated low-privileged user (PR:L) abuse a symbolic-link/junction resolution flaw (CWE-59) to redirect a privileged file operation and gain SYSTEM-level control on affected Windows 10, Windows 11, and Windows Server 2012-2025 hosts. Microsoft has released patches; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV, with a low EPSS of 0.28% (20th percentile). SSVC rates technical impact as total but marks exploitation as none and not automatable, consistent with a hands-on local escalation rather than a mass-exploitable remote bug.
Local privilege escalation in the Microsoft Windows Universal Disk Format File System driver (udfs.sys) lets an authenticated low-privileged user gain SYSTEM-level control by triggering an integer underflow (CWE-191) while parsing a malicious UDF-formatted volume. It affects a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Currently there is no public exploit identified at time of analysis, EPSS is low (0.31%), and CISA SSVC rates exploitation as none, though the technical impact is total.
Local privilege escalation in the Microsoft Windows NTFS driver lets an already-authenticated attacker overflow a stack buffer (CWE-121) to run code with full system-level privileges. It affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and CISA's SSVC framework currently rates exploitation as none; EPSS is low at 0.34% (26th percentile), so this is a patch-on-schedule elevation-of-privilege bug rather than an emergency.
Denial of service in the Windows HTTP/2 network stack allows a remote, unauthenticated attacker to exhaust server resources and render affected services unavailable across a broad range of Windows client and server releases (Windows 10/11 and Windows Server 2016 through 2025). Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.5 CVSS reflects high availability impact with no confidentiality or integrity loss.
Denial of service in Microsoft Windows HTTP.sys allows remote unauthenticated attackers to exhaust system resources and make affected hosts unresponsive over the network. The flaw stems from missing resource limits/throttling (CWE-770) in the kernel-mode HTTP protocol stack, affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available via MSRC.
Security feature bypass in Windows Secure Boot (CWE-358) allows a locally authenticated attacker on affected Windows 10, Windows 11, and Windows Server (2016 through 2025) systems to defeat the boot-integrity trust chain due to an improperly implemented standard security check. Because Secure Boot is the gate that blocks unsigned/tampered bootloaders and rootkits, a successful bypass can enable pre-OS persistence and undermine downstream protections such as BitLocker and Measured Boot. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; Microsoft has published a patch via its update guide.
Local privilege escalation in the Windows NTFS filesystem driver (CWE-122 heap-based buffer overflow) lets a locally authenticated attacker corrupt kernel heap memory and execute arbitrary code, per Microsoft's CVSS 3.1 vector (AV:L/PR:L). Affected builds span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as 'none', with a low EPSS score of 0.29% (21st percentile), though the technical impact is rated 'total'.
Privilege escalation in the Microsoft Windows DHCP Client service, driven by an integer underflow (CWE-191) triggered when processing DHCP traffic, lets an unauthorized network attacker gain elevated privileges with full confidentiality, integrity, and availability impact. It affects a broad Windows fleet spanning Windows 10 (1607/1809) and Windows Server 2012 through 2025, including Server Core installations. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is modest at 0.76% (51st percentile), but the vendor rates it critical (CVSS 9.8) and CISA SSVC flags it as Automatable.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an authenticated network attacker to run arbitrary code on domain controllers by triggering a heap-based buffer overflow (CWE-122). Affected platforms span Windows Server 2012 through 2025 (including Server Core) and Windows 10/11 clients acting in AD roles, with Microsoft-issued patches available. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CVSS 8.8 rating and the sensitivity of the domain-controller attack surface make this a high-priority patch.
Remote code execution in the Microsoft Windows DHCP Server role allows an authenticated network attacker (PR:L) to trigger a heap-based buffer overflow and run arbitrary code on the server. The flaw affects DHCP Server across Windows Server 2012 through Server 2025 (including Server Core installations) and carries a CVSS 8.8 with full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated attacker to crash the service and disrupt authentication across all supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The flaw stems from an excessive-size memory allocation (CWE-789) triggerable over the network with no privileges or user interaction, and while a vendor patch is available, there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (A:H) with no confidentiality or integrity loss, but LSASS failure can force system instability or reboots, affecting domain authentication and logon.
Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Local privilege escalation via a heap-based buffer overflow in the Windows NTFS driver allows an authenticated attacker with low privileges to execute arbitrary code and gain full SYSTEM-level control. It affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and SSVC records no observed exploitation; EPSS is low at 0.29% (21st percentile).
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Local code execution in Microsoft Windows Media Foundation lets an attacker run arbitrary code in the context of the victim after luring them to open a maliciously crafted media file. The flaw (CVE-2026-58610, CWE-122 heap-based buffer overflow) affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R) with full confidentiality, integrity, and availability impact; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local code execution in the Microsoft Graphics Component affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). An attacker who convinces a user to open a specially crafted file or content triggers an out-of-bounds read (CWE-125) that Microsoft rates as enabling code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation requires local access plus user interaction, making it a standard patch-cycle priority rather than an emergency.
Remote code execution in the Windows Print Spooler components stems from an improperly synchronized race condition (CWE-362) that an authenticated, network-adjacent attacker can win to run code with full system impact. Microsoft (the reporter) has shipped fixes across the entire supported Windows and Windows Server line, but exploitation requires low privileges and a hard-to-hit timing window, so this is a real-but-non-trivial priority rather than a drop-everything emergency. There is no public exploit identified at time of analysis, EPSS is low at 0.53% (41st percentile), and CISA SSVC scores exploitation as none.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged user corrupt kernel heap memory and gain SYSTEM-level control. The flaw (CWE-122 heap-based buffer overflow, CVSS 7.8) affects a broad range of Windows 10, Windows 11, and Windows Server builds and was reported by Microsoft. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Remote code execution in Microsoft Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, and per its CVSS 9.8 vector requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is modest (0.61%), so despite the critical score exploitation is not yet observed.
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-privileged user on the host gain higher privileges due to insufficient granularity of access control (CWE-1220). Affected deployments span AD FS on Windows Server 2012 through Windows Server 2025, and the flaw carries a CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority-driven rather than exploitation-driven risk.
Local code execution in Microsoft Windows GDI+ (the graphics rendering component) via a heap-based buffer overflow (CWE-122), affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Server 2012 through Server 2025. Per the supplied CVSS vector (PR:N), an unauthorized attacker who gets the vulnerable component to process crafted graphics data can achieve high-impact code execution (C:H/I:H/A:H) on the local system. Microsoft has published a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated network attacker trigger a use-after-free (CWE-416) and run arbitrary code on a broad range of Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rated CVSS 8.1, the flaw carries high impact to confidentiality, integrity, and availability but requires winning a race condition (AC:H), and no public exploit identified at time of analysis. Reported by Microsoft with a vendor patch available.
Windows Remote Desktop Protocol (RDP) client leaks sensitive memory contents due to use of an uninitialized resource (CWE-908), allowing a network-accessible attacker to disclose potentially high-value information from a victim's system. Exploitation requires user interaction - a victim must connect to an attacker-controlled RDP endpoint - making this a client-side information disclosure attack affecting Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2012 through 2025. No public exploit code has been identified and no active exploitation is confirmed; however, the CVSS confidentiality impact is rated High, meaning exposed memory could include credentials or session tokens.
Remote code execution in the Microsoft Windows TCP/IP networking stack allows an unauthenticated attacker on the same physical or logical network segment to win a race condition and run arbitrary code on the target. The flaw spans a broad range of desktop and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, but Microsoft has confirmed the issue and shipped a patch, and the high CVSS (8.8) plus network-facing kernel component make it a priority to remediate.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Denial of service in Windows Active Directory (spanning Windows 10, Windows 11, and Windows Server 2012 through 2025) lets a remote, unauthenticated attacker send crafted network traffic that drives an AD service into an infinite loop, exhausting CPU and rendering domain services unavailable. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high availability impact and no confidentiality or integrity loss, this is a pure availability threat against domain controllers. Microsoft has released a patch; there is no public exploit identified at time of analysis and no CISA KEV listing.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated attacker on the same network segment run arbitrary code by triggering an integer underflow (CWE-191) during multicast message processing. All supported Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1 are affected. There is no public exploit identified at time of analysis, but the CVSS 8.8 adjacent-network unauthenticated profile and Microsoft's own reporting make this a high-priority patch.
Local privilege escalation to code execution in the Windows Resilient File System (ReFS) driver affects a broad range of Windows 10/11 and Windows Server 2016 through 2025 releases, where an integer overflow (CWE-190) in filesystem processing lets an already-authenticated local user run arbitrary code in an elevated context. The CVSS 3.1 vector (AV:L/PR:L) confirms low-privileged local access is required rather than remote exploitation, and there is no public exploit identified at time of analysis. Microsoft has released a patch via MSRC.
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component lets an authenticated local attacker corrupt heap memory and execute arbitrary code, gaining total control (SYSTEM-level) of the affected host. It impacts a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. Microsoft has released patches; publicly available exploit code exists, though SSVC lists exploitation status as none and EPSS probability is low (0.39%).
Local privilege escalation in the Microsoft Printer Drivers component across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 lets an already-authenticated attacker corrupt kernel-adjacent memory to gain higher privileges. The flaw is a double free (CWE-415) triggered locally by a low-privileged user, yielding high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in the Windows Active Directory certificate-validation path lets an already-authenticated attacker on Windows 10 (1607/1809) and Windows Server 2016 through 2025 (including Server Core) improperly validate a certificate to gain higher privileges. Microsoft reported and patched the flaw (CWE-295), but there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS 7.8 vector (AV:L/PR:L) confirms an authenticated local attacker with full confidentiality, integrity, and availability impact upon success.
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) lets an already-authenticated low-privilege user corrupt kernel heap memory via a heap-based buffer overflow (CWE-122) to gain SYSTEM-level control. The flaw affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated low-privileged user to win a race condition and elevate to SYSTEM across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a patch available, it carries CVSS 7.0 but a high attack complexity (AC:H) reflecting the timing-sensitive nature of the flaw. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with CISA SSVC rating exploitation as 'none.'
Heap-based buffer overflow in the Windows Kernel (CWE-122) enables an unauthenticated attacker with physical access to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server editions. The physical attack vector (AV:P) constrains the threat surface significantly, and SSVC rates exploitation as none with no public exploit identified at time of analysis. Despite total technical impact potential confirmed by both CVSS C:H/I:H/A:H metrics and SSVC technical impact rating, real-world risk is concentrated in physically accessible deployment scenarios such as kiosks, field laptops, or shared terminals.
Local privilege escalation in the Windows Common Log File System (CLFS) Driver allows an already-authenticated, low-privileged user to elevate to SYSTEM on a wide range of Windows client and server releases. Microsoft classifies the root cause as exposure of sensitive information (CWE-200), but the CVSS impact profile (C:H/I:H/A:H) reflects that the leaked kernel data enables full local privilege escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CLFS has historically been a heavily exploited elevation-of-privilege target in Windows.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated low-privileged user to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). The flaw spans a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Quality Windows Audio/Video Experience (QWAVE) service across virtually all supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) allows an authenticated local attacker to gain SYSTEM-level control by triggering a use-after-free condition. Microsoft rates the impact as total (full confidentiality, integrity, and availability loss) with CVSS 7.8. There is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet.
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker crash the service by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw affects AD FS as shipped across a broad range of Windows client and server builds (Windows 10/11 and Windows Server 2012 through 2025). Microsoft - the reporting party - has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows App Store component (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025) allows an authorized low-privileged attacker to win a race condition on an improperly synchronized shared resource and gain higher privileges. Exploitation is local-only and high-complexity because it depends on reliably hitting a narrow timing window, and no public exploit has been identified at time of analysis. A vendor patch is available via Microsoft's MSRC update guide.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122). The flaw affects the FTP service across a broad range of Windows 10, Windows 11, and Windows Server (2019/2022/2025) builds and carries a critical CVSS 9.8 rating with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature of the bug makes it a high-priority patch target.
Local privilege escalation in Microsoft Windows WalletService allows an authenticated low-privileged attacker to gain SYSTEM-level rights on the host, per CVSS:3.1 AV:L/AC:L/PR:L (7.8, High). The flaw stems from improper privilege management (CWE-269) in the WalletService component and affects a broad range of Windows client and server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch from Microsoft is available.
Local privilege escalation in the Windows Speech component affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). A use-after-free flaw (CWE-416) lets an authenticated local attacker corrupt memory to gain SYSTEM-level privileges; CVSS is 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, and EPSS is low at 0.26%, but a vendor patch is available via Microsoft's MSRC update guide.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Local information disclosure in the Microsoft Windows App Store (Store/AppX component) affects a broad range of Windows 10, Windows 11, and Windows Server releases (1607 through 26H1, Server 2016/2019/2022/2025). An authorized local attacker can leverage a use of uninitialized resource (CWE-908) to read memory contents that should not be exposed, with CVSS 7.1 reflecting high confidentiality impact but requiring low-privileged authenticated local access. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and Microsoft has released a patch via the MSRC update guide.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated network attacker to corrupt heap memory and run arbitrary code on affected domain controllers. The flaw (CVE-2026-49164, CVSS 8.1) spans a broad range of Windows client and server builds from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, with full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis, and the high attack complexity (AC:H) tempers the practical exploitation likelihood.
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) stems from a heap-based buffer overflow that lets an attacker run arbitrary code over the network. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 and marks it unauthenticated, though as a database driver flaw the realistic trigger is a client connecting to a malicious or compromised SQL Server endpoint. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet actively-exploited issue.
Remote code execution in the Microsoft Windows Bluetooth Port Driver (bthport) allows an adjacent, unauthenticated attacker to run arbitrary code by triggering a heap-based buffer overflow over Bluetooth radio range. The flaw spans a wide range of Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is modest at 0.38% (30th percentile), and CISA SSVC currently marks exploitation as 'none', but the CVSS 8.8 rating and 'total' technical impact make this a high-priority patch.
Privilege elevation in the Windows App Store component affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025), where a race condition (CWE-362) lets an unauthorized attacker win a timing window to gain elevated privileges over a network. The CVSS 3.1 score is 8.1 with a network vector and no authentication (PR:N), but high attack complexity (AC:H) reflects the difficulty of reliably winning the race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate to higher privileges on affected Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 systems. The flaw stems from improper consistency validation of input crossing the trust boundary into the isolated secure kernel (CWE-1288), yielding full confidentiality, integrity, and availability impact on the local host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).