Windows 11 23h2
Monthly
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
A heap-based buffer overflow in the Windows PCI Bus Driver lets an authenticated local attacker with only low privileges escalate to kernel-level code execution on affected Windows hosts, giving total loss of confidentiality, integrity, and availability (CVSS 8.8, scope-changed). Exploitation requires an existing low-privilege local session (AV:L/PR:L, UI:N) and the ability to invoke the driver with malformed input - there is no remote or network path, and CISA's SSVC assessment rates the issue as not automatable with exploitation: none. No public exploit code has been identified at time of analysis and there are no reports of active exploitation, but the driver is a default, always-present kernel component on every supported Windows client and server build, so the vulnerable surface is ubiquitous and the payload is high-impact once a foothold exists - making this a credible but non-urgent prioritization.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows USB Print Driver lets an authenticated attacker who already holds a foothold on a vulnerable Windows host corrupt kernel memory and obtain SYSTEM-level code execution. The flaw is a use-after-free (CWE-416) reachable only through the USB printing driver path; the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, base 7.0) requires valid local credentials and a successful race on freed kernel memory, so exploitation is timing-dependent, non-deterministic, and rated non-automatable by CISA SSVC. Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.
Local privilege escalation in the Windows Push Notifications service allows an authenticated attacker with low-level user privileges to achieve high-integrity code execution by exploiting a missing authentication check (CWE-306) in a critical internal function. Scored CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access, no user interaction, and winning a non-deterministic condition due to high attack complexity; there is no public exploit identified at time of analysis. Affected builds of Windows 10, Windows 11, and Windows Server (2019 through 2025) below the fixed versions can be remediated with the Microsoft update.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an attacker who already holds low-privileged code execution on a WSL-enabled host to trigger a use-after-free and obtain full control over confidentiality, integrity, and availability (CVSS 7.8, CWE-416). Exploitation is strictly local (AV:L) and requires an existing account or foothold with low privileges (PR:L), but needs no user interaction and has low attack complexity, so a reliable trigger is plausible once the prerequisites are met; hosts where the optional WSL feature is not installed are not exposed. No public exploit code and no confirmed active exploitation have been identified, and Microsoft has released fixed builds for every affected Windows 10, Windows 11, and Windows Server version, so patching is the decisive risk-reduction step.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.
A use-after-free in the Windows USB Print Driver (CWE-416) allows an attacker who already holds low-privileged local access to a Windows host to escalate privileges and obtain full control over confidentiality, integrity, and availability of the affected system. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025 (including Server Core installations), per the EUVD version ranges. Exploitation requires winning a timing-dependent race in the driver (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), which CISA's SSVC rates as not automatable, and no public exploit has been identified at time of analysis - this is a post-compromise privilege-escalation primitive rather than an opportunistic remote threat, and Microsoft has shipped a vendor update addressing it.
Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.
Local privilege escalation in the Windows USB Print Driver (usbprint.sys) lets an authenticated, low-privileged user on the target host raise their privileges to SYSTEM by winning a use-after-free race in the driver's request-handling path. CVSS 3.1 scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker must already have a foothold on the machine, no user interaction is needed, and the high attack complexity reflects the probabilistic nature of reclaiming the freed object. The affected builds are Windows 10 21H2/22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2022 and Windows Server 2025 (including Server Core); no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and Microsoft has published fixes, so this is a moderate-priority local escalation rather than an emergency remote threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in Windows Assigned Access (kiosk mode) allows an authenticated, low-privileged local user to inject and execute code in a higher-integrity context, yielding full loss of confidentiality, integrity, and availability on the affected host (CVSS 3.1 base 7.8). Exploitation is constrained: the attacker must already hold authorized local logon (PR:L), the host must be one where an administrator has explicitly configured Assigned Access, and there is no network vector and no victim interaction (AV:L/UI:N). No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and Microsoft has shipped fixed builds, so this is a credible but not emergency-level priority.
Remote code execution in Microsoft Windows Local Security Authority Subsystem Service (LSASS) affects multiple Windows 10, Windows 11, and Windows Server builds, allowing an unauthenticated network attacker to trigger an out-of-bounds write that can lead to code execution with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and exploitation requires only network reachability to an exposed LSASS interface on an unpatched host. No public exploit was identified at time of analysis and CISA SSVC records Exploitation: none and Automatable: no, but the unauthenticated remote vector makes this a top-priority vulnerability to patch; Microsoft has released a vendor patch.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated, low-privileged attacker who already holds a foothold on the host win a use-after-free and gain SYSTEM-level code execution. Exploitation requires winning a timing-dependent race against the service (AC:H), with no user interaction needed, and affects Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019 including Server Core builds below the patched levels. There is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis; a vendor patch is available and the issue is assessed as a genuine but non-urgent High-severity local elevation-of-privilege flaw (CVSS 7.0, EPSS-level urgency not elevated).
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
A heap-based buffer overflow in the Windows PCI Bus Driver lets an authenticated local attacker with only low privileges escalate to kernel-level code execution on affected Windows hosts, giving total loss of confidentiality, integrity, and availability (CVSS 8.8, scope-changed). Exploitation requires an existing low-privilege local session (AV:L/PR:L, UI:N) and the ability to invoke the driver with malformed input - there is no remote or network path, and CISA's SSVC assessment rates the issue as not automatable with exploitation: none. No public exploit code has been identified at time of analysis and there are no reports of active exploitation, but the driver is a default, always-present kernel component on every supported Windows client and server build, so the vulnerable surface is ubiquitous and the payload is high-impact once a foothold exists - making this a credible but non-urgent prioritization.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows USB Print Driver lets an authenticated attacker who already holds a foothold on a vulnerable Windows host corrupt kernel memory and obtain SYSTEM-level code execution. The flaw is a use-after-free (CWE-416) reachable only through the USB printing driver path; the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, base 7.0) requires valid local credentials and a successful race on freed kernel memory, so exploitation is timing-dependent, non-deterministic, and rated non-automatable by CISA SSVC. Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.
Local privilege escalation in the Windows Push Notifications service allows an authenticated attacker with low-level user privileges to achieve high-integrity code execution by exploiting a missing authentication check (CWE-306) in a critical internal function. Scored CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access, no user interaction, and winning a non-deterministic condition due to high attack complexity; there is no public exploit identified at time of analysis. Affected builds of Windows 10, Windows 11, and Windows Server (2019 through 2025) below the fixed versions can be remediated with the Microsoft update.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an attacker who already holds low-privileged code execution on a WSL-enabled host to trigger a use-after-free and obtain full control over confidentiality, integrity, and availability (CVSS 7.8, CWE-416). Exploitation is strictly local (AV:L) and requires an existing account or foothold with low privileges (PR:L), but needs no user interaction and has low attack complexity, so a reliable trigger is plausible once the prerequisites are met; hosts where the optional WSL feature is not installed are not exposed. No public exploit code and no confirmed active exploitation have been identified, and Microsoft has released fixed builds for every affected Windows 10, Windows 11, and Windows Server version, so patching is the decisive risk-reduction step.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.
A use-after-free in the Windows USB Print Driver (CWE-416) allows an attacker who already holds low-privileged local access to a Windows host to escalate privileges and obtain full control over confidentiality, integrity, and availability of the affected system. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025 (including Server Core installations), per the EUVD version ranges. Exploitation requires winning a timing-dependent race in the driver (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), which CISA's SSVC rates as not automatable, and no public exploit has been identified at time of analysis - this is a post-compromise privilege-escalation primitive rather than an opportunistic remote threat, and Microsoft has shipped a vendor update addressing it.
Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.
Local privilege escalation in the Windows USB Print Driver (usbprint.sys) lets an authenticated, low-privileged user on the target host raise their privileges to SYSTEM by winning a use-after-free race in the driver's request-handling path. CVSS 3.1 scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker must already have a foothold on the machine, no user interaction is needed, and the high attack complexity reflects the probabilistic nature of reclaiming the freed object. The affected builds are Windows 10 21H2/22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2022 and Windows Server 2025 (including Server Core); no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and Microsoft has published fixes, so this is a moderate-priority local escalation rather than an emergency remote threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in Windows Assigned Access (kiosk mode) allows an authenticated, low-privileged local user to inject and execute code in a higher-integrity context, yielding full loss of confidentiality, integrity, and availability on the affected host (CVSS 3.1 base 7.8). Exploitation is constrained: the attacker must already hold authorized local logon (PR:L), the host must be one where an administrator has explicitly configured Assigned Access, and there is no network vector and no victim interaction (AV:L/UI:N). No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and Microsoft has shipped fixed builds, so this is a credible but not emergency-level priority.
Remote code execution in Microsoft Windows Local Security Authority Subsystem Service (LSASS) affects multiple Windows 10, Windows 11, and Windows Server builds, allowing an unauthenticated network attacker to trigger an out-of-bounds write that can lead to code execution with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and exploitation requires only network reachability to an exposed LSASS interface on an unpatched host. No public exploit was identified at time of analysis and CISA SSVC records Exploitation: none and Automatable: no, but the unauthenticated remote vector makes this a top-priority vulnerability to patch; Microsoft has released a vendor patch.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated, low-privileged attacker who already holds a foothold on the host win a use-after-free and gain SYSTEM-level code execution. Exploitation requires winning a timing-dependent race against the service (AC:H), with no user interaction needed, and affects Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019 including Server Core builds below the patched levels. There is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis; a vendor patch is available and the issue is assessed as a genuine but non-urgent High-severity local elevation-of-privilege flaw (CVSS 7.0, EPSS-level urgency not elevated).
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.