Windows 10 Version 22H2
Monthly
Local code execution in the Windows NTFS driver (CVE-2026-49797) allows an attacker with local access to run arbitrary code by tricking a user into interacting with a maliciously crafted NTFS artifact, exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released a patch; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-after-free (CWE-416) and gain full control of the host. The CVSS 3.1 vector (AV:L/PR:L, scope-changed with C:H/I:H/A:H) reflects a low-privileged local user escalating to SYSTEM-level compromise across a broad range of Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local code execution in Windows GDI+ (the Graphics Device Interface Plus rendering component) affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An attacker who convinces a user to open or preview a specially crafted image or document triggers a heap-based buffer overflow (CWE-122) during graphics parsing, yielding arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but GDI+ image-parsing flaws are historically attractive to attackers.
Local privilege escalation via arbitrary code execution in Microsoft Windows Resilient File System (ReFS) affects a broad range of Windows 10, Windows 11, and Windows Server (2016-2025) builds. An authorized (low-privileged) attacker who can trigger the vulnerable heap allocation path can corrupt heap memory (CWE-122) to run code in the security context of the ReFS driver, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Local code execution in Microsoft's Resilient File System (ReFS) driver allows an authorized (low-privileged) attacker to run arbitrary code with elevated context via a numeric truncation flaw. The bug affects the ReFS component shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the CVE's own tags label it 'Information Disclosure' while the description and CVSS impact (C:H/I:H/A:H) describe full code execution - the code-execution reading should be treated as authoritative.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) lets an already-authenticated low-privileged user (PR:L) abuse a symbolic-link/junction resolution flaw (CWE-59) to redirect a privileged file operation and gain SYSTEM-level control on affected Windows 10, Windows 11, and Windows Server 2012-2025 hosts. Microsoft has released patches; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV, with a low EPSS of 0.28% (20th percentile). SSVC rates technical impact as total but marks exploitation as none and not automatable, consistent with a hands-on local escalation rather than a mass-exploitable remote bug.
Local privilege escalation in the Microsoft Windows Universal Disk Format File System driver (udfs.sys) lets an authenticated low-privileged user gain SYSTEM-level control by triggering an integer underflow (CWE-191) while parsing a malicious UDF-formatted volume. It affects a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Currently there is no public exploit identified at time of analysis, EPSS is low (0.31%), and CISA SSVC rates exploitation as none, though the technical impact is total.
Local privilege escalation in the Microsoft Windows NTFS driver lets an already-authenticated attacker overflow a stack buffer (CWE-121) to run code with full system-level privileges. It affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and CISA's SSVC framework currently rates exploitation as none; EPSS is low at 0.34% (26th percentile), so this is a patch-on-schedule elevation-of-privilege bug rather than an emergency.
Denial of service in the Windows HTTP/2 network stack allows a remote, unauthenticated attacker to exhaust server resources and render affected services unavailable across a broad range of Windows client and server releases (Windows 10/11 and Windows Server 2016 through 2025). Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.5 CVSS reflects high availability impact with no confidentiality or integrity loss.
Denial of service in Microsoft Windows HTTP.sys allows remote unauthenticated attackers to exhaust system resources and make affected hosts unresponsive over the network. The flaw stems from missing resource limits/throttling (CWE-770) in the kernel-mode HTTP protocol stack, affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available via MSRC.
Security feature bypass in Windows Secure Boot (CWE-358) allows a locally authenticated attacker on affected Windows 10, Windows 11, and Windows Server (2016 through 2025) systems to defeat the boot-integrity trust chain due to an improperly implemented standard security check. Because Secure Boot is the gate that blocks unsigned/tampered bootloaders and rootkits, a successful bypass can enable pre-OS persistence and undermine downstream protections such as BitLocker and Measured Boot. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; Microsoft has published a patch via its update guide.
Local privilege escalation in the Windows Clipboard Server (Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025) allows an already-authenticated low-privileged user to win a race condition and gain higher privileges on the host. Microsoft credits its own researchers and has shipped a fix; there is no public exploit identified at time of analysis and the CVSS base score is 7.0 (High). The high attack complexity reflects the timing precision needed to exploit the race, which meaningfully limits reliable weaponization.
Local privilege escalation in the Windows NTFS filesystem driver (CWE-122 heap-based buffer overflow) lets a locally authenticated attacker corrupt kernel heap memory and execute arbitrary code, per Microsoft's CVSS 3.1 vector (AV:L/PR:L). Affected builds span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as 'none', with a low EPSS score of 0.29% (21st percentile), though the technical impact is rated 'total'.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an authenticated network attacker to run arbitrary code on domain controllers by triggering a heap-based buffer overflow (CWE-122). Affected platforms span Windows Server 2012 through 2025 (including Server Core) and Windows 10/11 clients acting in AD roles, with Microsoft-issued patches available. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CVSS 8.8 rating and the sensitivity of the domain-controller attack surface make this a high-priority patch.
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated attacker to crash the service and disrupt authentication across all supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The flaw stems from an excessive-size memory allocation (CWE-789) triggerable over the network with no privileges or user interaction, and while a vendor patch is available, there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (A:H) with no confidentiality or integrity loss, but LSASS failure can force system instability or reboots, affecting domain authentication and logon.
Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Local privilege escalation via a heap-based buffer overflow in the Windows NTFS driver allows an authenticated attacker with low privileges to execute arbitrary code and gain full SYSTEM-level control. It affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and SSVC records no observed exploitation; EPSS is low at 0.29% (21st percentile).
Local privilege escalation in Microsoft Windows Narrator (the built-in screen reader) arises from improper neutralization of special elements in its Braille support component, allowing an already-authenticated local attacker (PR:L) to inject and execute OS commands that run with elevated privileges. All supported Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025 are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so exploitation is not confirmed as active.
Local code execution in Microsoft Windows Media Foundation lets an attacker run arbitrary code in the context of the victim after luring them to open a maliciously crafted media file. The flaw (CVE-2026-58610, CWE-122 heap-based buffer overflow) affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R) with full confidentiality, integrity, and availability impact; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local code execution in the Microsoft Graphics Component affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). An attacker who convinces a user to open a specially crafted file or content triggers an out-of-bounds read (CWE-125) that Microsoft rates as enabling code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation requires local access plus user interaction, making it a standard patch-cycle priority rather than an emergency.
Remote code execution in the Windows Print Spooler components stems from an improperly synchronized race condition (CWE-362) that an authenticated, network-adjacent attacker can win to run code with full system impact. Microsoft (the reporter) has shipped fixes across the entire supported Windows and Windows Server line, but exploitation requires low privileges and a hard-to-hit timing window, so this is a real-but-non-trivial priority rather than a drop-everything emergency. There is no public exploit identified at time of analysis, EPSS is low at 0.53% (41st percentile), and CISA SSVC scores exploitation as none.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged user corrupt kernel heap memory and gain SYSTEM-level control. The flaw (CWE-122 heap-based buffer overflow, CVSS 7.8) affects a broad range of Windows 10, Windows 11, and Windows Server builds and was reported by Microsoft. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Storage component affects a broad range of Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). By exploiting a use-after-free memory-corruption flaw (CWE-416), an already-authenticated local attacker can elevate to SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.15%), and CISA SSVC records exploitation status as none.
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Remote code execution in Microsoft Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, and per its CVSS 9.8 vector requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is modest (0.61%), so despite the critical score exploitation is not yet observed.
Local code execution in Microsoft Windows GDI+ (the graphics rendering component) via a heap-based buffer overflow (CWE-122), affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Server 2012 through Server 2025. Per the supplied CVSS vector (PR:N), an unauthorized attacker who gets the vulnerable component to process crafted graphics data can achieve high-impact code execution (C:H/I:H/A:H) on the local system. Microsoft has published a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated network attacker trigger a use-after-free (CWE-416) and run arbitrary code on a broad range of Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rated CVSS 8.1, the flaw carries high impact to confidentiality, integrity, and availability but requires winning a race condition (AC:H), and no public exploit identified at time of analysis. Reported by Microsoft with a vendor patch available.
Remote code execution in the Microsoft Windows TCP/IP networking stack allows an unauthenticated attacker on the same physical or logical network segment to win a race condition and run arbitrary code on the target. The flaw spans a broad range of desktop and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, but Microsoft has confirmed the issue and shipped a patch, and the high CVSS (8.8) plus network-facing kernel component make it a priority to remediate.
Denial of service in Windows Active Directory (spanning Windows 10, Windows 11, and Windows Server 2012 through 2025) lets a remote, unauthenticated attacker send crafted network traffic that drives an AD service into an infinite loop, exhausting CPU and rendering domain services unavailable. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high availability impact and no confidentiality or integrity loss, this is a pure availability threat against domain controllers. Microsoft has released a patch; there is no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) allows an authenticated local user to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of supported builds spanning Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, including Server Core installations. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated attacker on the same network segment run arbitrary code by triggering an integer underflow (CWE-191) during multicast message processing. All supported Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1 are affected. There is no public exploit identified at time of analysis, but the CVSS 8.8 adjacent-network unauthenticated profile and Microsoft's own reporting make this a high-priority patch.
Local privilege escalation to code execution in the Windows Resilient File System (ReFS) driver affects a broad range of Windows 10/11 and Windows Server 2016 through 2025 releases, where an integer overflow (CWE-190) in filesystem processing lets an already-authenticated local user run arbitrary code in an elevated context. The CVSS 3.1 vector (AV:L/PR:L) confirms low-privileged local access is required rather than remote exploitation, and there is no public exploit identified at time of analysis. Microsoft has released a patch via MSRC.
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component lets an authenticated local attacker corrupt heap memory and execute arbitrary code, gaining total control (SYSTEM-level) of the affected host. It impacts a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. Microsoft has released patches; publicly available exploit code exists, though SSVC lists exploitation status as none and EPSS probability is low (0.39%).
Local privilege escalation in the Microsoft Printer Drivers component across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 lets an already-authenticated attacker corrupt kernel-adjacent memory to gain higher privileges. The flaw is a double free (CWE-415) triggered locally by a low-privileged user, yielding high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an already-authenticated attacker to win a race condition (CWE-362) and elevate to SYSTEM-level privileges across supported Windows 10, Windows 11, and Windows Server 2019-2025 builds. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile). CVSS 7.0 reflects high attack complexity (AC:H) driven by the timing-window nature of the flaw and the requirement for existing low-privilege access (PR:L).
Local code execution in Microsoft Windows Media Foundation lets an unauthorized attacker run arbitrary code by luring a user into opening a specially crafted media file. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through Windows 11 26H1 and Server 2025), and Microsoft has released patches. No public exploit identified at time of analysis, but the low attack complexity and full C/I/A impact make it a standard Patch-Tuesday priority.
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) lets an already-authenticated low-privilege user corrupt kernel heap memory via a heap-based buffer overflow (CWE-122) to gain SYSTEM-level control. The flaw affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated low-privileged user to win a race condition and elevate to SYSTEM across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a patch available, it carries CVSS 7.0 but a high attack complexity (AC:H) reflecting the timing-sensitive nature of the flaw. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with CISA SSVC rating exploitation as 'none.'
Local privilege escalation in the Windows Common Log File System (CLFS) Driver allows an already-authenticated, low-privileged user to elevate to SYSTEM on a wide range of Windows client and server releases. Microsoft classifies the root cause as exposure of sensitive information (CWE-200), but the CVSS impact profile (C:H/I:H/A:H) reflects that the leaked kernel data enables full local privilege escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CLFS has historically been a heavily exploited elevation-of-privilege target in Windows.
Network denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to crash affected systems by triggering a heap-based buffer overflow. All impact is to availability only (CVSS 7.5, A:H, no confidentiality or integrity loss), making this a reliability/uptime threat against IPsec/VPN-facing Windows 10, Windows 11, and Windows Server hosts rather than a code-execution vulnerability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a meaningful patching priority for internet-exposed IPsec endpoints.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated low-privileged user to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). The flaw spans a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Quality Windows Audio/Video Experience (QWAVE) service across virtually all supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) allows an authenticated local attacker to gain SYSTEM-level control by triggering a use-after-free condition. Microsoft rates the impact as total (full confidentiality, integrity, and availability loss) with CVSS 7.8. There is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet.
Local privilege escalation in Microsoft Windows Hyper-V (affecting Windows 10, Windows 11, and Windows Server 2019 through 2025) allows an authenticated local attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition in the hypervisor stack. Microsoft reported the issue and has shipped fixes; there is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet. The total technical impact (full C/I/A compromise) makes it a meaningful patch priority on any Hyper-V-enabled host despite the local attack vector.
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker crash the service by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw affects AD FS as shipped across a broad range of Windows client and server builds (Windows 10/11 and Windows Server 2012 through 2025). Microsoft - the reporting party - has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows App Store component (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025) allows an authorized low-privileged attacker to win a race condition on an improperly synchronized shared resource and gain higher privileges. Exploitation is local-only and high-complexity because it depends on reliably hitting a narrow timing window, and no public exploit has been identified at time of analysis. A vendor patch is available via Microsoft's MSRC update guide.
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122). The flaw affects the FTP service across a broad range of Windows 10, Windows 11, and Windows Server (2019/2022/2025) builds and carries a critical CVSS 9.8 rating with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature of the bug makes it a high-priority patch target.
Local privilege escalation in Microsoft Windows DNS lets an already-authenticated, low-privileged attacker corrupt heap memory to gain higher (likely SYSTEM) privileges on affected Windows 10, Windows 11, and Windows Server 2022/2025 systems. The flaw is a heap-based buffer overflow (CWE-122) reported by Microsoft itself, with a vendor patch available via MSRC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so it currently represents a patch-priority rather than an emergency.
Local privilege escalation in Microsoft Windows WalletService allows an authenticated low-privileged attacker to gain SYSTEM-level rights on the host, per CVSS:3.1 AV:L/AC:L/PR:L (7.8, High). The flaw stems from improper privilege management (CWE-269) in the WalletService component and affects a broad range of Windows client and server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch from Microsoft is available.
Local privilege escalation in the Windows Speech component affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). A use-after-free flaw (CWE-416) lets an authenticated local attacker corrupt memory to gain SYSTEM-level privileges; CVSS is 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, and EPSS is low at 0.26%, but a vendor patch is available via Microsoft's MSRC update guide.
Local privilege escalation in the Windows StateRepository API lets an already-authenticated low-privileged user gain higher (typically SYSTEM-level) privileges due to insufficiently granular access control (CWE-1220). It affects a broad range of currently supported Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025). The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis (not listed in CISA KEV).
Local privilege escalation in the Windows Kernel affects a broad range of currently supported Windows client and server builds (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025). A use-after-free (CWE-416) in kernel memory lets an already-authenticated local attacker corrupt kernel objects to gain SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.25%), and SSVC records exploitation status as none.
Local information disclosure in the Microsoft Windows App Store (Store/AppX component) affects a broad range of Windows 10, Windows 11, and Windows Server releases (1607 through 26H1, Server 2016/2019/2022/2025). An authorized local attacker can leverage a use of uninitialized resource (CWE-908) to read memory contents that should not be exposed, with CVSS 7.1 reflecting high confidentiality impact but requiring low-privileged authenticated local access. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and Microsoft has released a patch via the MSRC update guide.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated network attacker to corrupt heap memory and run arbitrary code on affected domain controllers. The flaw (CVE-2026-49164, CVSS 8.1) spans a broad range of Windows client and server builds from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, with full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis, and the high attack complexity (AC:H) tempers the practical exploitation likelihood.
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) stems from a heap-based buffer overflow that lets an attacker run arbitrary code over the network. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 and marks it unauthenticated, though as a database driver flaw the realistic trigger is a client connecting to a malicious or compromised SQL Server endpoint. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet actively-exploited issue.
Remote code execution in the Microsoft Windows Bluetooth Port Driver (bthport) allows an adjacent, unauthenticated attacker to run arbitrary code by triggering a heap-based buffer overflow over Bluetooth radio range. The flaw spans a wide range of Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is modest at 0.38% (30th percentile), and CISA SSVC currently marks exploitation as 'none', but the CVSS 8.8 rating and 'total' technical impact make this a high-priority patch.
Privilege elevation in the Windows App Store component affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025), where a race condition (CWE-362) lets an unauthorized attacker win a timing window to gain elevated privileges over a network. The CVSS 3.1 score is 8.1 with a network vector and no authentication (PR:N), but high attack complexity (AC:H) reflects the difficulty of reliably winning the race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate to higher privileges on affected Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 systems. The flaw stems from improper consistency validation of input crossing the trust boundary into the isolated secure kernel (CWE-1288), yielding full confidentiality, integrity, and availability impact on the local host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.
Local privilege escalation in the Windows Projected File System (ProjFS) affects the full supported Windows line — Windows 10 (1809/21H2/22H2), Windows 11 (22H3 through 26H1), and Windows Server 2019/2022/2025 — where a use-after-free (CWE-416) lets an authenticated local user corrupt kernel/service memory and elevate to higher privileges. Microsoft-reported and patched, the flaw carries total technical impact per CISA SSVC but has no public exploit identified at time of analysis and a very low EPSS (0.04%). The high attack complexity (AV:L/AC:H) reflects a race-condition-style UAF that is non-trivial to win reliably.
Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixes, but SSVC reports no observed exploitation and EPSS is very low (0.04%), so this is a patch-on-schedule kernel EoP rather than an emergency; no public exploit identified at time of analysis. Because Cloud Files underpins OneDrive/cloud sync placeholders, the driver is present on effectively every modern Windows install.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory-corruption condition. The flaw was reported by Microsoft and affects a broad range of Windows 10, Windows 11, and Windows Server builds; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.06%).
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.
Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw carries CVSS 8.1 but requires winning a memory-corruption race (AC:H), and there is no public exploit identified at time of analysis; EPSS is very low at 0.09% and CISA SSVC lists exploitation as none. A vendor patch is available from Microsoft.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).
Information disclosure in the Windows TCP/IP networking stack allows a remote, unauthenticated attacker to read sensitive memory contents over the network by triggering a use-after-free condition. All supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) are affected. Microsoft-reported with no public exploit identified at time of analysis; EPSS is low (0.06%, 19th percentile) and CISA SSVC records exploitation status as none.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.
Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
Local code execution in the Windows Graphics Device Interface (GDI) component affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. An attacker who convinces a user to open a maliciously crafted file or content triggers a heap-based buffer overflow (CWE-122) in GDI, running arbitrary code in the victim's context with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records no known exploitation, so this is a patch-on-cycle item rather than an emergency.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across supported Windows 10, Windows 11 (through 26H1) and Windows Server 2019-2025 builds. Microsoft has released fixes; there is no public exploit identified at time of analysis, EPSS risk is very low (0.04%), and it is not listed in CISA KEV. Despite 'Denial Of Service' tagging, the CVSS vector rates full confidentiality, integrity and availability impact, consistent with a kernel EoP.
Local privilege escalation in the Windows Win32K kernel-mode subsystem (ICOMP component) lets an already-authenticated low-privileged attacker gain SYSTEM-level control across a broad range of supported Windows client and server builds. The flaw is a type-confusion (CWE-843) memory-corruption issue reported by Microsoft; there is no public exploit identified at time of analysis and the EPSS probability is low (0.11%), but SSVC rates the technical impact as total. This is a standard Patch-Tuesday-class kernel EoP whose value is as the second stage of an intrusion after an attacker already has a foothold.
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Server 2022 allows authenticated local attackers to gain SYSTEM-level privileges through heap corruption. Microsoft has released patches addressing this CWE-122 heap-based buffer overflow. EPSS data not available for risk quantification, and no CISA KEV listing indicates exploitation has not been publicly confirmed, though the vulnerability's low attack complexity (AC:L) and minimal prerequisites (PR:L) make it attractive for post-compromise privilege escalation in targeted attacks.
Local code execution in the Windows NTFS driver (CVE-2026-49797) allows an attacker with local access to run arbitrary code by tricking a user into interacting with a maliciously crafted NTFS artifact, exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released a patch; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-after-free (CWE-416) and gain full control of the host. The CVSS 3.1 vector (AV:L/PR:L, scope-changed with C:H/I:H/A:H) reflects a low-privileged local user escalating to SYSTEM-level compromise across a broad range of Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local code execution in Windows GDI+ (the Graphics Device Interface Plus rendering component) affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An attacker who convinces a user to open or preview a specially crafted image or document triggers a heap-based buffer overflow (CWE-122) during graphics parsing, yielding arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but GDI+ image-parsing flaws are historically attractive to attackers.
Local privilege escalation via arbitrary code execution in Microsoft Windows Resilient File System (ReFS) affects a broad range of Windows 10, Windows 11, and Windows Server (2016-2025) builds. An authorized (low-privileged) attacker who can trigger the vulnerable heap allocation path can corrupt heap memory (CWE-122) to run code in the security context of the ReFS driver, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Local code execution in Microsoft's Resilient File System (ReFS) driver allows an authorized (low-privileged) attacker to run arbitrary code with elevated context via a numeric truncation flaw. The bug affects the ReFS component shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the CVE's own tags label it 'Information Disclosure' while the description and CVSS impact (C:H/I:H/A:H) describe full code execution - the code-execution reading should be treated as authoritative.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) lets an already-authenticated low-privileged user (PR:L) abuse a symbolic-link/junction resolution flaw (CWE-59) to redirect a privileged file operation and gain SYSTEM-level control on affected Windows 10, Windows 11, and Windows Server 2012-2025 hosts. Microsoft has released patches; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV, with a low EPSS of 0.28% (20th percentile). SSVC rates technical impact as total but marks exploitation as none and not automatable, consistent with a hands-on local escalation rather than a mass-exploitable remote bug.
Local privilege escalation in the Microsoft Windows Universal Disk Format File System driver (udfs.sys) lets an authenticated low-privileged user gain SYSTEM-level control by triggering an integer underflow (CWE-191) while parsing a malicious UDF-formatted volume. It affects a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Currently there is no public exploit identified at time of analysis, EPSS is low (0.31%), and CISA SSVC rates exploitation as none, though the technical impact is total.
Local privilege escalation in the Microsoft Windows NTFS driver lets an already-authenticated attacker overflow a stack buffer (CWE-121) to run code with full system-level privileges. It affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and CISA's SSVC framework currently rates exploitation as none; EPSS is low at 0.34% (26th percentile), so this is a patch-on-schedule elevation-of-privilege bug rather than an emergency.
Denial of service in the Windows HTTP/2 network stack allows a remote, unauthenticated attacker to exhaust server resources and render affected services unavailable across a broad range of Windows client and server releases (Windows 10/11 and Windows Server 2016 through 2025). Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.5 CVSS reflects high availability impact with no confidentiality or integrity loss.
Denial of service in Microsoft Windows HTTP.sys allows remote unauthenticated attackers to exhaust system resources and make affected hosts unresponsive over the network. The flaw stems from missing resource limits/throttling (CWE-770) in the kernel-mode HTTP protocol stack, affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available via MSRC.
Security feature bypass in Windows Secure Boot (CWE-358) allows a locally authenticated attacker on affected Windows 10, Windows 11, and Windows Server (2016 through 2025) systems to defeat the boot-integrity trust chain due to an improperly implemented standard security check. Because Secure Boot is the gate that blocks unsigned/tampered bootloaders and rootkits, a successful bypass can enable pre-OS persistence and undermine downstream protections such as BitLocker and Measured Boot. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; Microsoft has published a patch via its update guide.
Local privilege escalation in the Windows Clipboard Server (Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025) allows an already-authenticated low-privileged user to win a race condition and gain higher privileges on the host. Microsoft credits its own researchers and has shipped a fix; there is no public exploit identified at time of analysis and the CVSS base score is 7.0 (High). The high attack complexity reflects the timing precision needed to exploit the race, which meaningfully limits reliable weaponization.
Local privilege escalation in the Windows NTFS filesystem driver (CWE-122 heap-based buffer overflow) lets a locally authenticated attacker corrupt kernel heap memory and execute arbitrary code, per Microsoft's CVSS 3.1 vector (AV:L/PR:L). Affected builds span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as 'none', with a low EPSS score of 0.29% (21st percentile), though the technical impact is rated 'total'.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an authenticated network attacker to run arbitrary code on domain controllers by triggering a heap-based buffer overflow (CWE-122). Affected platforms span Windows Server 2012 through 2025 (including Server Core) and Windows 10/11 clients acting in AD roles, with Microsoft-issued patches available. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CVSS 8.8 rating and the sensitivity of the domain-controller attack surface make this a high-priority patch.
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated attacker to crash the service and disrupt authentication across all supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The flaw stems from an excessive-size memory allocation (CWE-789) triggerable over the network with no privileges or user interaction, and while a vendor patch is available, there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (A:H) with no confidentiality or integrity loss, but LSASS failure can force system instability or reboots, affecting domain authentication and logon.
Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Local privilege escalation via a heap-based buffer overflow in the Windows NTFS driver allows an authenticated attacker with low privileges to execute arbitrary code and gain full SYSTEM-level control. It affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and SSVC records no observed exploitation; EPSS is low at 0.29% (21st percentile).
Local privilege escalation in Microsoft Windows Narrator (the built-in screen reader) arises from improper neutralization of special elements in its Braille support component, allowing an already-authenticated local attacker (PR:L) to inject and execute OS commands that run with elevated privileges. All supported Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025 are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so exploitation is not confirmed as active.
Local code execution in Microsoft Windows Media Foundation lets an attacker run arbitrary code in the context of the victim after luring them to open a maliciously crafted media file. The flaw (CVE-2026-58610, CWE-122 heap-based buffer overflow) affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R) with full confidentiality, integrity, and availability impact; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local code execution in the Microsoft Graphics Component affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). An attacker who convinces a user to open a specially crafted file or content triggers an out-of-bounds read (CWE-125) that Microsoft rates as enabling code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation requires local access plus user interaction, making it a standard patch-cycle priority rather than an emergency.
Remote code execution in the Windows Print Spooler components stems from an improperly synchronized race condition (CWE-362) that an authenticated, network-adjacent attacker can win to run code with full system impact. Microsoft (the reporter) has shipped fixes across the entire supported Windows and Windows Server line, but exploitation requires low privileges and a hard-to-hit timing window, so this is a real-but-non-trivial priority rather than a drop-everything emergency. There is no public exploit identified at time of analysis, EPSS is low at 0.53% (41st percentile), and CISA SSVC scores exploitation as none.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged user corrupt kernel heap memory and gain SYSTEM-level control. The flaw (CWE-122 heap-based buffer overflow, CVSS 7.8) affects a broad range of Windows 10, Windows 11, and Windows Server builds and was reported by Microsoft. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Storage component affects a broad range of Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). By exploiting a use-after-free memory-corruption flaw (CWE-416), an already-authenticated local attacker can elevate to SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.15%), and CISA SSVC records exploitation status as none.
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Remote code execution in Microsoft Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, and per its CVSS 9.8 vector requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is modest (0.61%), so despite the critical score exploitation is not yet observed.
Local code execution in Microsoft Windows GDI+ (the graphics rendering component) via a heap-based buffer overflow (CWE-122), affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Server 2012 through Server 2025. Per the supplied CVSS vector (PR:N), an unauthorized attacker who gets the vulnerable component to process crafted graphics data can achieve high-impact code execution (C:H/I:H/A:H) on the local system. Microsoft has published a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated network attacker trigger a use-after-free (CWE-416) and run arbitrary code on a broad range of Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rated CVSS 8.1, the flaw carries high impact to confidentiality, integrity, and availability but requires winning a race condition (AC:H), and no public exploit identified at time of analysis. Reported by Microsoft with a vendor patch available.
Remote code execution in the Microsoft Windows TCP/IP networking stack allows an unauthenticated attacker on the same physical or logical network segment to win a race condition and run arbitrary code on the target. The flaw spans a broad range of desktop and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, but Microsoft has confirmed the issue and shipped a patch, and the high CVSS (8.8) plus network-facing kernel component make it a priority to remediate.
Denial of service in Windows Active Directory (spanning Windows 10, Windows 11, and Windows Server 2012 through 2025) lets a remote, unauthenticated attacker send crafted network traffic that drives an AD service into an infinite loop, exhausting CPU and rendering domain services unavailable. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high availability impact and no confidentiality or integrity loss, this is a pure availability threat against domain controllers. Microsoft has released a patch; there is no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) allows an authenticated local user to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of supported builds spanning Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, including Server Core installations. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated attacker on the same network segment run arbitrary code by triggering an integer underflow (CWE-191) during multicast message processing. All supported Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1 are affected. There is no public exploit identified at time of analysis, but the CVSS 8.8 adjacent-network unauthenticated profile and Microsoft's own reporting make this a high-priority patch.
Local privilege escalation to code execution in the Windows Resilient File System (ReFS) driver affects a broad range of Windows 10/11 and Windows Server 2016 through 2025 releases, where an integer overflow (CWE-190) in filesystem processing lets an already-authenticated local user run arbitrary code in an elevated context. The CVSS 3.1 vector (AV:L/PR:L) confirms low-privileged local access is required rather than remote exploitation, and there is no public exploit identified at time of analysis. Microsoft has released a patch via MSRC.
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component lets an authenticated local attacker corrupt heap memory and execute arbitrary code, gaining total control (SYSTEM-level) of the affected host. It impacts a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. Microsoft has released patches; publicly available exploit code exists, though SSVC lists exploitation status as none and EPSS probability is low (0.39%).
Local privilege escalation in the Microsoft Printer Drivers component across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 lets an already-authenticated attacker corrupt kernel-adjacent memory to gain higher privileges. The flaw is a double free (CWE-415) triggered locally by a low-privileged user, yielding high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an already-authenticated attacker to win a race condition (CWE-362) and elevate to SYSTEM-level privileges across supported Windows 10, Windows 11, and Windows Server 2019-2025 builds. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile). CVSS 7.0 reflects high attack complexity (AC:H) driven by the timing-window nature of the flaw and the requirement for existing low-privilege access (PR:L).
Local code execution in Microsoft Windows Media Foundation lets an unauthorized attacker run arbitrary code by luring a user into opening a specially crafted media file. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through Windows 11 26H1 and Server 2025), and Microsoft has released patches. No public exploit identified at time of analysis, but the low attack complexity and full C/I/A impact make it a standard Patch-Tuesday priority.
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) lets an already-authenticated low-privilege user corrupt kernel heap memory via a heap-based buffer overflow (CWE-122) to gain SYSTEM-level control. The flaw affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated low-privileged user to win a race condition and elevate to SYSTEM across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a patch available, it carries CVSS 7.0 but a high attack complexity (AC:H) reflecting the timing-sensitive nature of the flaw. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with CISA SSVC rating exploitation as 'none.'
Local privilege escalation in the Windows Common Log File System (CLFS) Driver allows an already-authenticated, low-privileged user to elevate to SYSTEM on a wide range of Windows client and server releases. Microsoft classifies the root cause as exposure of sensitive information (CWE-200), but the CVSS impact profile (C:H/I:H/A:H) reflects that the leaked kernel data enables full local privilege escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CLFS has historically been a heavily exploited elevation-of-privilege target in Windows.
Network denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to crash affected systems by triggering a heap-based buffer overflow. All impact is to availability only (CVSS 7.5, A:H, no confidentiality or integrity loss), making this a reliability/uptime threat against IPsec/VPN-facing Windows 10, Windows 11, and Windows Server hosts rather than a code-execution vulnerability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a meaningful patching priority for internet-exposed IPsec endpoints.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated low-privileged user to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). The flaw spans a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Quality Windows Audio/Video Experience (QWAVE) service across virtually all supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) allows an authenticated local attacker to gain SYSTEM-level control by triggering a use-after-free condition. Microsoft rates the impact as total (full confidentiality, integrity, and availability loss) with CVSS 7.8. There is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet.
Local privilege escalation in Microsoft Windows Hyper-V (affecting Windows 10, Windows 11, and Windows Server 2019 through 2025) allows an authenticated local attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition in the hypervisor stack. Microsoft reported the issue and has shipped fixes; there is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet. The total technical impact (full C/I/A compromise) makes it a meaningful patch priority on any Hyper-V-enabled host despite the local attack vector.
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker crash the service by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw affects AD FS as shipped across a broad range of Windows client and server builds (Windows 10/11 and Windows Server 2012 through 2025). Microsoft - the reporting party - has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows App Store component (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025) allows an authorized low-privileged attacker to win a race condition on an improperly synchronized shared resource and gain higher privileges. Exploitation is local-only and high-complexity because it depends on reliably hitting a narrow timing window, and no public exploit has been identified at time of analysis. A vendor patch is available via Microsoft's MSRC update guide.
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122). The flaw affects the FTP service across a broad range of Windows 10, Windows 11, and Windows Server (2019/2022/2025) builds and carries a critical CVSS 9.8 rating with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature of the bug makes it a high-priority patch target.
Local privilege escalation in Microsoft Windows DNS lets an already-authenticated, low-privileged attacker corrupt heap memory to gain higher (likely SYSTEM) privileges on affected Windows 10, Windows 11, and Windows Server 2022/2025 systems. The flaw is a heap-based buffer overflow (CWE-122) reported by Microsoft itself, with a vendor patch available via MSRC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so it currently represents a patch-priority rather than an emergency.
Local privilege escalation in Microsoft Windows WalletService allows an authenticated low-privileged attacker to gain SYSTEM-level rights on the host, per CVSS:3.1 AV:L/AC:L/PR:L (7.8, High). The flaw stems from improper privilege management (CWE-269) in the WalletService component and affects a broad range of Windows client and server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch from Microsoft is available.
Local privilege escalation in the Windows Speech component affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). A use-after-free flaw (CWE-416) lets an authenticated local attacker corrupt memory to gain SYSTEM-level privileges; CVSS is 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, and EPSS is low at 0.26%, but a vendor patch is available via Microsoft's MSRC update guide.
Local privilege escalation in the Windows StateRepository API lets an already-authenticated low-privileged user gain higher (typically SYSTEM-level) privileges due to insufficiently granular access control (CWE-1220). It affects a broad range of currently supported Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025). The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis (not listed in CISA KEV).
Local privilege escalation in the Windows Kernel affects a broad range of currently supported Windows client and server builds (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025). A use-after-free (CWE-416) in kernel memory lets an already-authenticated local attacker corrupt kernel objects to gain SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.25%), and SSVC records exploitation status as none.
Local information disclosure in the Microsoft Windows App Store (Store/AppX component) affects a broad range of Windows 10, Windows 11, and Windows Server releases (1607 through 26H1, Server 2016/2019/2022/2025). An authorized local attacker can leverage a use of uninitialized resource (CWE-908) to read memory contents that should not be exposed, with CVSS 7.1 reflecting high confidentiality impact but requiring low-privileged authenticated local access. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and Microsoft has released a patch via the MSRC update guide.
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated network attacker to corrupt heap memory and run arbitrary code on affected domain controllers. The flaw (CVE-2026-49164, CVSS 8.1) spans a broad range of Windows client and server builds from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, with full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis, and the high attack complexity (AC:H) tempers the practical exploitation likelihood.
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) stems from a heap-based buffer overflow that lets an attacker run arbitrary code over the network. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 and marks it unauthenticated, though as a database driver flaw the realistic trigger is a client connecting to a malicious or compromised SQL Server endpoint. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet actively-exploited issue.
Remote code execution in the Microsoft Windows Bluetooth Port Driver (bthport) allows an adjacent, unauthenticated attacker to run arbitrary code by triggering a heap-based buffer overflow over Bluetooth radio range. The flaw spans a wide range of Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is modest at 0.38% (30th percentile), and CISA SSVC currently marks exploitation as 'none', but the CVSS 8.8 rating and 'total' technical impact make this a high-priority patch.
Privilege elevation in the Windows App Store component affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025), where a race condition (CWE-362) lets an unauthorized attacker win a timing window to gain elevated privileges over a network. The CVSS 3.1 score is 8.1 with a network vector and no authentication (PR:N), but high attack complexity (AC:H) reflects the difficulty of reliably winning the race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate to higher privileges on affected Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 systems. The flaw stems from improper consistency validation of input crossing the trust boundary into the isolated secure kernel (CWE-1288), yielding full confidentiality, integrity, and availability impact on the local host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.
Local privilege escalation in the Windows Projected File System (ProjFS) affects the full supported Windows line — Windows 10 (1809/21H2/22H2), Windows 11 (22H3 through 26H1), and Windows Server 2019/2022/2025 — where a use-after-free (CWE-416) lets an authenticated local user corrupt kernel/service memory and elevate to higher privileges. Microsoft-reported and patched, the flaw carries total technical impact per CISA SSVC but has no public exploit identified at time of analysis and a very low EPSS (0.04%). The high attack complexity (AV:L/AC:H) reflects a race-condition-style UAF that is non-trivial to win reliably.
Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixes, but SSVC reports no observed exploitation and EPSS is very low (0.04%), so this is a patch-on-schedule kernel EoP rather than an emergency; no public exploit identified at time of analysis. Because Cloud Files underpins OneDrive/cloud sync placeholders, the driver is present on effectively every modern Windows install.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory-corruption condition. The flaw was reported by Microsoft and affects a broad range of Windows 10, Windows 11, and Windows Server builds; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.06%).
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.
Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw carries CVSS 8.1 but requires winning a memory-corruption race (AC:H), and there is no public exploit identified at time of analysis; EPSS is very low at 0.09% and CISA SSVC lists exploitation as none. A vendor patch is available from Microsoft.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).
Information disclosure in the Windows TCP/IP networking stack allows a remote, unauthenticated attacker to read sensitive memory contents over the network by triggering a use-after-free condition. All supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) are affected. Microsoft-reported with no public exploit identified at time of analysis; EPSS is low (0.06%, 19th percentile) and CISA SSVC records exploitation status as none.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.
Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
Local code execution in the Windows Graphics Device Interface (GDI) component affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. An attacker who convinces a user to open a maliciously crafted file or content triggers a heap-based buffer overflow (CWE-122) in GDI, running arbitrary code in the victim's context with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records no known exploitation, so this is a patch-on-cycle item rather than an emergency.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across supported Windows 10, Windows 11 (through 26H1) and Windows Server 2019-2025 builds. Microsoft has released fixes; there is no public exploit identified at time of analysis, EPSS risk is very low (0.04%), and it is not listed in CISA KEV. Despite 'Denial Of Service' tagging, the CVSS vector rates full confidentiality, integrity and availability impact, consistent with a kernel EoP.
Local privilege escalation in the Windows Win32K kernel-mode subsystem (ICOMP component) lets an already-authenticated low-privileged attacker gain SYSTEM-level control across a broad range of supported Windows client and server builds. The flaw is a type-confusion (CWE-843) memory-corruption issue reported by Microsoft; there is no public exploit identified at time of analysis and the EPSS probability is low (0.11%), but SSVC rates the technical impact as total. This is a standard Patch-Tuesday-class kernel EoP whose value is as the second stage of an intrusion after an attacker already has a foothold.
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Server 2022 allows authenticated local attackers to gain SYSTEM-level privileges through heap corruption. Microsoft has released patches addressing this CWE-122 heap-based buffer overflow. EPSS data not available for risk quantification, and no CISA KEV listing indicates exploitation has not been publicly confirmed, though the vulnerability's low attack complexity (AC:L) and minimal prerequisites (PR:L) make it attractive for post-compromise privilege escalation in targeted attacks.