Windows 11 23h2

Privilege escalation via heap-based buffer overflow in Windows Telephony Service (TAPI) affects virtually all supported Windows client and server builds, from legacy Server 2012 through current Windows 11 25H2 and Server 2025. An authorized local user with standard low-privilege credentials can trigger the heap overflow in tapisrv to achieve SYSTEM-level access. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patches are available across all 19 affected product SKUs per MSRC.

Windows Wired AutoConfig Service (dot3svc) exposes a buffer over-read (CWE-126) that allows a locally authenticated, low-privileged attacker to read beyond allocated memory boundaries and disclose potentially sensitive information from adjacent memory. Affected scope spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface broad despite the local-only attack vector. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, placing this squarely in the routine patching tier rather than emergency response.

Privilege escalation in Windows Telephony Service affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized local attacker exploits an improper synchronization flaw (CWE-362) in shared resource access within the telephony subsystem to elevate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability impact. Microsoft has released patched builds; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.

Privilege escalation via a time-of-check time-of-use (TOCTOU) race condition in the Windows Common Log File System (CLFS) Driver affects a broad range of Windows client and server versions from Server 2012 through Windows 11 25H2/26H1. A low-privileged local attacker can exploit the race window to gain SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available from Microsoft via the MSRC update guide.

Privilege escalation in Windows Telephony Service (TAPI) via a use-after-free memory corruption flaw enables a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected hosts. The vulnerability spans a broad range of Microsoft Windows versions from Server 2012 through Windows 11 26H1 and multiple Windows Server 2022/2025 builds, confirmed by Microsoft MSRC and catalogued under EUVD-2026-56640. No public exploit code or active exploitation has been identified at time of analysis, though the pervasive Windows deployment footprint makes patch deployment a meaningful operational priority.

Local privilege escalation via use-after-free (CWE-416) in the Windows Telephony Service (TAPI) affects every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized low-privileged local attacker can trigger improper memory lifecycle management in the privileged tapisrv process, achieving full confidentiality, integrity, and availability impact on the compromised system. No public exploit code has been identified at time of analysis and high attack complexity constrains opportunistic mass exploitation, but vendor-released patches are available and should be prioritized given the ubiquitous deployment footprint.

Privilege escalation via use-after-free memory corruption in the Windows Telephony Service (TAPI) affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An authorized local attacker with low-privilege credentials can exploit a race condition to corrupt freed memory within the telephony service process, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed by CISA KEV, and no public exploit has been identified at time of analysis; Microsoft has released patched builds for all affected platforms.

Local privilege escalation in the Windows Telephony Service (TAPI) allows an already-authenticated, low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans a wide range of Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the availability of a vendor patch make patching urgent in environments where Telephony Service is active.

Local privilege escalation in Windows User-Mode Power Service (UMPS) affects a broad swath of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authenticated low-privileged local user can exploit insufficient access control granularity (CWE-1220) in UMPS to elevate privileges, achieving full confidentiality, integrity, and availability impact consistent with SYSTEM-level access. No public exploit identified at time of analysis, but Microsoft has released patches across all affected build lines, making this a high-priority patching item for organizations running any of the 19 affected Windows configurations identified in EUVD-2026-56638.

Privilege escalation via heap-based buffer overflow in Windows Message Queuing (MSMQ) allows a locally authenticated attacker with low privileges to gain SYSTEM-level access across a wide range of Microsoft Windows desktop and server editions. The flaw, classified as CWE-122, spans from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature update channels, making it broadly relevant in enterprise environments where MSMQ is deployed. Patch is available from Microsoft via the MSRC update guide; no public exploit or CISA KEV listing has been identified at the time of analysis.

Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to achieve full system compromise via a heap-based buffer overflow. Confirmed affected across a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 all versions. No public exploit identified at time of analysis and no CISA KEV listing; however, the low attack complexity combined with universal Windows platform coverage makes this a meaningful post-exploitation or insider-threat vector.

Privilege escalation via heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged local attacker to gain full SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans virtually all supported Windows versions, from Windows 10 1809 and Server 2019 through Windows 11 26H1 and Server 2025. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and broad platform coverage make this a credible post-exploitation privilege escalation primitive for threat actors who have already obtained a local foothold.

Privilege escalation in Windows Win32K via a heap-based buffer overflow enables a locally authenticated attacker to gain SYSTEM-level access across a broad range of Microsoft operating systems from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-122) requires only standard user privileges and no user interaction, making post-compromise escalation straightforward for any attacker who has already obtained local access. No public exploit has been identified at time of analysis, but the Microsoft Security Response Center has issued a patch and the wide affected product surface warrants urgent remediation.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects a broad spectrum of Windows client and server releases, from Windows Server 2012 through Windows 11 25H2. An authenticated local attacker can exploit this flaw with low complexity and no user interaction to achieve full SYSTEM-level privileges (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, but the low-complexity local exploitation profile - combined with the near-universal deployment footprint of Windows - makes this a high-priority patch for both endpoint and server environments.

Heap-based buffer overflow in the Windows Device Association Service allows a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server releases. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025, making this a high-coverage local privilege escalation. No public exploit identified at time of analysis, but vendor patches are available and should be applied immediately given the low attack complexity.

Windows GDI+ (Graphics Device Interface Plus) exposes uninitialized memory contents to local low-privileged attackers across a broad range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1. The root cause is CWE-908 (use of uninitialized resource), where a graphics operation returns memory that has not been zeroed or populated, potentially leaking sensitive in-memory data. No active exploitation is confirmed and CISA SSVC rates exploitation as none; however, the wide affected surface and high confidentiality impact make this a priority patch in shared-access environments such as RDP or VDI deployments.

Privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged local attacker to gain SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The root cause is CWE-416 (Use After Free), a memory-safety flaw in the MDM component where a freed memory object is dereferenced, enabling controlled memory corruption that can redirect execution to attacker-supplied code. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV entry is identified at time of analysis.

Out-of-bounds memory read in Windows Desktop Window Manager (DWM) Core Library exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. Exploitation requires an authenticated local session with at least low-privilege access (PR:L per CVSS), making this an insider-threat or post-compromise escalation primitive rather than an initial-access vector. No public exploit code has been identified and CISA KEV does not list this vulnerability; Microsoft has released patches via the July 2026 Patch Tuesday cycle.

Remote denial-of-service in the Windows Graphics Kernel allows unauthenticated network attackers to crash affected systems by triggering a null pointer dereference in kernel mode, impacting availability across Windows 10, Windows 11, and Windows Server 2022/2025. The CVSS Scope:Changed flag indicates the resulting crash propagates beyond the Graphics Kernel subsystem itself, consistent with a full system halt (BSOD). No public exploit has been identified at time of analysis, and Microsoft has released patches establishing fixed build numbers for all confirmed affected versions.

Privilege escalation via use-after-free in the Windows Telephony Service (TAPI) allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access across a broad range of Windows desktop and server releases. The vulnerability affects Windows 10, Windows 11 (all current feature releases), and Windows Server 2012 through 2025, representing near-universal coverage of supported and legacy Microsoft platforms. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft Update.

Privilege escalation via heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) affects virtually the entire Microsoft Windows product portfolio, from legacy Server 2012 through Windows 11 25H2 and Server 2025. A locally authenticated, low-privileged attacker can trigger memory corruption in ring-0 kernel space, resulting in full SYSTEM-level privilege acquisition on the target host. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected product lines via the MSRC update guide.

Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) enables kernel-level code execution through physical insertion of maliciously crafted UDF media, affecting every supported Windows client and server release from Server 2012 through Windows 11 26H1. The physical attack vector (AV:P) is the dominant risk constraint - a vendor patch is available from Microsoft and the vulnerability is not listed in CISA KEV. No public exploit has been identified at time of analysis, though the breadth of affected builds and the kernel execution context make this high priority in environments where physical access is not strictly controlled.

Privilege escalation via numeric truncation in Microsoft's Digest Authentication subsystem affects a broad range of Windows releases, from Server 2012 through Windows 11 version 26H1 and Windows Server 2025. An attacker holding a low-privilege local account can exploit a CWE-197 integer type-conversion flaw to achieve full system compromise - the CVSS vector assigns high impact across confidentiality, integrity, and availability with no user interaction required. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; however, Microsoft has released patches for all affected build ranges.

Privilege escalation in the Windows Program Compatibility Assistant (PCA) Service, affecting a broad range of Windows 10, Windows 11, and Windows Server releases, stems from an integer underflow (CWE-191) that an authenticated local attacker can trigger to gain elevated - likely SYSTEM-level - privileges. The vulnerability requires only low-privileged local access with no user interaction, producing total confidentiality, integrity, and availability impact per the CVSS vector. SSVC assessment confirms no exploitation activity at time of analysis and no public exploit code has been identified.

Windows Storage in multiple Windows 11 and Windows Server releases contains a heap-based buffer overflow that allows any locally authenticated low-privilege user to escalate to SYSTEM-level access with no user interaction required. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a straightforward, low-complexity privilege escalation once an attacker has a local foothold - covering Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025. Microsoft has released patches across all affected product lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Privilege escalation in Windows Remote Desktop Services stems from a heap-based buffer overflow (CWE-122) that an authorized local attacker can exploit to gain full SYSTEM-level control of the affected host. The vulnerability spans an exceptionally wide range of Microsoft Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the aggregate patch surface very large across enterprise fleets. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.

Local privilege escalation in Windows Push Notifications exposes a broad range of Microsoft Windows desktop and server editions to full SYSTEM-level compromise by an authenticated low-privileged local attacker. The flaw is a race condition (CWE-362) in which concurrent threads access a shared resource without adequate synchronization, creating a timing window that can be manipulated to corrupt execution state and redirect control to a privileged context. Microsoft has confirmed the issue and released patches across all affected Windows build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.

Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.

Windows Defender Firewall Service across Windows 10, Windows 11, and Windows Server 2019 through 2025 contains a missing authorization flaw (CWE-862) that enables a locally authenticated low-privileged attacker to bypass firewall security controls and manipulate firewall rules without the required authorization. The vulnerability carries a CVSS score of 5.5 with High integrity impact, reflecting the attacker's ability to fully undermine the local firewall enforcement boundary from a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-exploitation value as a lateral movement enabler is notable given the breadth of affected Windows versions.

Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.

Privilege escalation via heap-based buffer overflow in the Windows Kernel (CWE-122) affects a broad span of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authenticated local attacker exploiting this flaw can gain SYSTEM-level privileges, achieving full control over confidentiality, integrity, and availability of the target system. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch is available.

Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.

Cleartext storage of sensitive credentials in Windows Hello exposes authentication material to local tampering by authorized but low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw, rooted in CWE-312, means that sensitive data used by the Windows Hello subsystem is persisted without adequate encryption, enabling an attacker with local access to modify it and undermine the integrity of the authentication mechanism. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable attack paths.

Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.

Local privilege escalation in Windows Installer (msiexec) affects virtually the entire modern Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - via an incorrect authorization flaw (CWE-863). An attacker with low-privilege authenticated local access can exploit the broken authorization check within the Installer service to elevate to SYSTEM-level privileges, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis, though Microsoft has released patches across the full affected version matrix per MSRC advisory.

Out-of-bounds read in the Windows Remote Desktop Client component (CWE-125) exposes high-sensitivity memory contents to remote network attackers, enabling information disclosure across all supported Windows 10, Windows 11, and Windows Server 2012 through 2025 releases. The vulnerability carries a CVSS 7.5 base score with a network attack vector and no privilege requirement per the official vector, though SSVC classifies exploitation as not automatable and technical impact as partial, suggesting real-world exploitation is constrained by the need for a user to initiate an RDP connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, EPSS places active exploitation probability at 0.85% (55th percentile), and a vendor-released patch is available via Microsoft MSRC.

Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.

Information disclosure in Windows Remote Desktop Client across nearly all supported Windows versions exposes client-side memory contents to a network-based attacker who controls a malicious RDP server. The flaw is an out-of-bounds read (CWE-125) triggered when the client parses crafted server-sent protocol data, resulting in high confidentiality impact with no integrity or availability consequence. No public exploit code exists and CISA has not added this to KEV; however, the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 - makes patch prioritization important for organizations permitting outbound RDP connections to untrusted hosts.

Remote code memory disclosure in the Windows Remote Desktop Client (CWE-125) exposes sensitive process memory to an attacker operating a malicious or compromised RDP server. All major Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 are affected, representing essentially the entire active Windows install base running an RDP client. Microsoft has released patches via the MSRC advisory; no public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation status as none.

Windows Hyper-V across a broad range of Windows 10, Windows 11, and Windows Server releases contains a heap-based buffer overflow (CWE-122) that enables a locally authenticated low-privileged attacker to disclose confidential memory contents. The CVSS vector (AV:L/PR:L/UI:R/S:U/C:H/I:N/A:N) constrains the attack to local access with required user interaction and produces no integrity or availability impact. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at the time of analysis.

Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows Server and client platforms, allowing a locally authenticated low-privilege user to elevate to SYSTEM-level access by invoking a critical RDS function that lacks proper authentication enforcement (CWE-306). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected versions.

Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.

Privilege escalation in Windows Remote Desktop Services (RDS) via a missing authentication check (CWE-306) allows a locally authenticated, low-privileged user to gain SYSTEM or administrator-level access on the target machine. The vulnerability affects an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - multiplying the organizational exposure. No active exploitation is confirmed by CISA KEV and no public exploit code is identified at time of analysis, though the low attack complexity (AC:L) and absence of required user interaction make the technique straightforward once a local foothold is achieved.

Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, allowing a locally authenticated low-privilege attacker to elevate to full SYSTEM-level control. The root cause is CWE-306 - a critical RDS function entirely lacking an authentication gate - meaning any low-privilege account holder can invoke it without proper authorization. Microsoft has released patches across all affected product lines, though no public exploit code or CISA KEV listing was present in the available intelligence.

Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.

Information disclosure in Windows Graphics Device Interface (GDI) via an untrusted pointer dereference exposes sensitive memory contents to a local low-privileged attacker across virtually all supported Windows client and server releases. The vulnerability (CWE-822) allows an authorized local user to trigger a controlled pointer dereference within GDI's rendering subsystem, resulting in high-impact confidentiality loss with no integrity or availability effect. No public exploit identified at time of analysis, though the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025 - makes this a broad-footprint patching concern.

Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.

Local privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) affects a broad range of Windows 10, Windows 11, and Windows Server releases through a symlink-following flaw (CWE-59). An authenticated local attacker can manipulate file system links to redirect ATBroker.exe file access operations, enabling elevation from a standard user account to SYSTEM-level privileges across default Windows installations. No public exploit has been identified at time of analysis; however, Microsoft has released a patch and the breadth of affected builds makes timely remediation critical.

Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.

Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.

Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.

Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.

Buffer over-read in the Windows NTFS kernel driver enables a physically present attacker to disclose sensitive memory contents without authentication across a broad range of Windows client and server versions from Server 2012 through Windows 11 26H1 and Windows Server 2025. The attack vector is strictly physical (confirmed by CVSS AV:P), confining the threat to scenarios where an adversary has direct hands-on access to the target hardware. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; Microsoft has released patches via the MSRC update guide.

Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to elevate to SYSTEM-level access by exploiting a use-after-free memory corruption condition in the kernel-mode driver. The flaw spans a wide swath of Microsoft's supported and legacy Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, making the patching surface unusually broad. No public exploit code or active exploitation has been confirmed at time of analysis; however, the combination of kernel-level impact, full C/I/A compromise upon success, and low privilege prerequisite makes this a meaningful post-compromise escalation risk.

Information disclosure in the Windows Event Logging Service exposes high-confidentiality data to any locally authenticated attacker via a CWE-126 buffer over-read, with no code execution possible. The vulnerability spans an exceptionally broad surface: every supported Windows client and server release from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 is affected. Microsoft has released patched builds via its monthly update cycle; no public exploit or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the wide footprint.

Local privilege escalation in the Windows Graphics Kernel exposes a broad range of Windows 10, Windows 11, and Windows Server editions to a use-after-free memory corruption flaw (CWE-416). An attacker holding a low-privileged local account who can satisfy a race condition in the kernel graphics subsystem can gain SYSTEM-level control of the affected host. Microsoft has released patches across all identified product lines; no public exploit has been identified at time of analysis.

Remote Registry Service denial of service in Microsoft Windows allows network-authenticated attackers to crash the service via a crafted RPC request triggering a null pointer dereference. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that any domain or local account with network access to the service is sufficient for exploitation - no elevated privileges required. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Null pointer dereference in the Windows Remote Registry Service enables an authenticated network attacker to crash the service, resulting in denial of availability for remote registry operations across a broad range of Microsoft platforms. Affected builds span Windows 10/11 consumer releases and Windows Server 2012 through Server 2025, representing the near-entirety of Microsoft's currently supported Windows footprint. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, positioning this as a standard patch-cycle priority rather than an out-of-band emergency.

Windows Event Logging Service on multiple Windows desktop and server versions exposes uninitialized memory contents to locally authenticated attackers via CWE-908, enabling information disclosure without elevated privileges or user interaction. The CVSS vector (AV:L/PR:L/C:H) confirms that an authorized local user can trigger the flaw to read stale memory that may contain sensitive data from other processes or OS operations. No public exploit exists and CISA SSVC rates current exploitation as none, but the breadth of affected Windows versions - spanning Server 2012 through Windows 11 26H1 - makes patch prioritization worthwhile for any environment with untrusted local users.

Uninitialized resource use in Microsoft COM for Windows enables a locally authenticated attacker to read sensitive memory contents, constituting a high-confidence information disclosure. Affected systems span virtually the entire supported Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit exists at time of analysis and SSVC assessment rates exploitation as none, though the breadth of affected platforms elevates patching urgency.

Information disclosure in the Microsoft Windows Search Component allows a locally authenticated low-privileged attacker to bypass weak authentication controls and access sensitive indexed content outside their authorized scope. Affected systems span Windows Server 2012 through Server 2025 and Windows 10/11 across all current supported versions, representing an exceptionally broad exposure surface. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the ubiquitous deployment footprint of Windows makes timely patching a priority for all organizations.

Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.

Null pointer dereference in the Windows TCP/IP kernel driver exposes virtually every supported Windows Server and desktop release to remote denial-of-service attacks without any authentication or user interaction. The flaw, rooted in CWE-476, causes a kernel panic (Blue Screen of Death) when a specially crafted network packet triggers a NULL pointer dereference in tcpip.sys, crashing the affected host. Nineteen distinct product/version combinations from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2 are confirmed affected; no public exploit has been identified at time of analysis, and Microsoft has released corrective patches.

Information disclosure in AMD Zen processor microarchitecture, surfaced through Windows system software, enables a local low-privileged attacker to read high-sensitivity data across security boundaries. The CVSS Scope Changed metric (S:C) combined with C:H and the AMD Zen tag strongly suggests a microarchitectural side-channel capable of leaking data from outside the attacker's security context - a pattern consistent with speculative execution or cache-based cross-boundary leakage. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none; however, the breadth of affected Windows versions (Server 2012 R2 through Server 2025 and Windows 10/11 across all supported channels) gives this a wide potential exposure surface on AMD Zen-equipped systems.

Information disclosure in AMD Zen processors on Windows allows a locally authenticated low-privileged attacker to read sensitive memory contents across security boundaries via a high-complexity microarchitectural technique. Affecting Windows versions from Windows 10 1607 to Windows 11 26H1 and Server 2012 R2 through Server 2025, this vulnerability was reported by Microsoft's security team (secure@microsoft.com) and carries a CVSS 5.6 medium score with Scope:Changed (S:C) indicating the attacker can cross a privilege boundary to reach data outside their own security context. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog, though vendor-released patches are confirmed available via MSRC.

Out-of-bounds read in the Windows Encrypting File System (EFS) driver exposes sensitive memory contents to any locally authenticated attacker holding standard user privileges. Affected systems span the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the patch surface extremely broad. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the combination of a low-complexity local attack and high confidentiality impact warrants prompt patching on systems where EFS is actively used.

Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.

Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.

Privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver affects Windows 10, 11, and Server 2016 through 2025, enabling a low-privileged local attacker to achieve full kernel-level control via a use-after-free memory corruption in a kernel-mode driver. The CVSS AC:H rating indicates the exploit path likely requires precise timing - consistent with a race condition in driver memory management - which reduces but does not eliminate real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch from Microsoft is available.

Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Privilege escalation via untrusted search path (CWE-426) in Windows Narrator Braille affects multiple Windows 10, Windows 11, and Windows Server builds, allowing a locally authenticated attacker to elevate from standard user to higher privileges. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity once local access is established, with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor-released patch is available and should be applied promptly.

Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated network-based denial of service in the Windows Kernel results from unconstrained resource allocation (CWE-770), where the kernel fails to impose limits or throttling on network-triggered resource consumption. Affecting Windows 10, Windows 11, and Windows Server editions spanning 2012 through 2025, a remote attacker with no credentials or user interaction can exhaust system resources and render the host unavailable. No public exploit code or active exploitation has been identified at the time of analysis, though the low-complexity, unauthenticated attack surface warrants prompt patching across all affected enterprise environments.

Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.

Command injection in Windows Active Directory enables network-based remote code execution against a broad range of Windows client and server versions, from legacy Server 2012 through Windows 11 26H1 and Server 2025. With a CVSS 8.8 and a vector of AV:N/AC:L/PR:N/UI:R, an unauthenticated remote attacker can execute arbitrary commands on affected systems when a local user performs a triggering action - such as processing a crafted request or interacting with attacker-controlled content that reaches the vulnerable AD component. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.

BitLocker's protection mechanism on Windows fails to enforce a critical authentication or verification step, permitting a physically present attacker to bypass full-disk encryption without credentials, a recovery key, or elevated privileges. Despite a CVSS score of 6.8 (Medium) - moderated by the physical access requirement - the impact ratings are High across confidentiality, integrity, and availability, meaning successful exploitation grants complete access to encrypted data and the underlying system. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.

Remote denial-of-service in Microsoft's HTTP/2 implementation allows unauthenticated network attackers to exhaust server resources and disrupt service availability. The flaw (CWE-400, uncontrolled resource consumption) was reported by Microsoft's MSRC and carries a CVSS 7.5 score driven entirely by availability impact, with no public exploit identified at time of analysis.

Local privilege escalation in Microsoft Windows Kernel allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free condition (CWE-416). The flaw carries a CVSS 7.8 score with local attack vector and low privileges required, and no public exploit has been identified at time of analysis. Microsoft Security Response Center (MSRC) is the sole referenced authoritative source, indicating this is a vendor-discovered and vendor-tracked issue.

Security feature bypass in Windows Secure Boot enables a local high-privileged attacker to defeat the platform's boot-time integrity protections, achieving high confidentiality and integrity impact across a changed security scope. The flaw stems from a protection mechanism failure (CWE-284, Improper Access Control) that undermines the trust boundary Secure Boot is designed to enforce. At the time of analysis, no public exploit has been identified and the issue is not listed in CISA KEV, but the scope-changed CVSS of 7.9 reflects the severity of subverting a root-of-trust security control.

Security feature bypass in Windows Secure Boot allows a high-privileged local attacker to circumvent the boot integrity protection mechanism, undermining trust in the Windows boot chain. The flaw (CWE-1329, reliance on a component that is not updateable) carries a CVSS 7.9 rating due to scope change and high impact on confidentiality and integrity, and no public exploit has been identified at time of analysis. Successful exploitation could enable pre-OS persistence such as bootkits, defeating a foundational Windows security control.

Secure Boot bypass in Windows allows a local attacker with high privileges to defeat the platform's boot-time integrity protection mechanism, breaking the chain of trust that prevents unauthorized bootloaders and pre-OS code from executing. The flaw (CWE-693, Protection Mechanism Failure) carries a CVSS 7.9 due to scope change and high confidentiality/integrity impact, and no public exploit identified at time of analysis. Successful exploitation undermines a foundational anti-tamper control and can enable persistent pre-OS implants such as bootkits.

Local code execution in Microsoft Windows Media is possible through a heap-based buffer overflow that triggers when a user opens or processes a crafted media file. The flaw (CWE-122) carries a CVSS 7.8 with local attack vector and user interaction required, and no public exploit identified at time of analysis. Successful exploitation yields high impact to confidentiality, integrity, and availability within the user's security context.

Secure Boot bypass in Microsoft Windows allows an authorized local attacker with high privileges to defeat the platform's protection mechanism and tamper with the pre-OS boot chain. The CVSS 7.9 score reflects a scope-changing impact on confidentiality and integrity from a local vector, and no public exploit identified at time of analysis. The single MSRC reference indicates a Microsoft-tracked issue that primarily threatens code-integrity and boot-trust guarantees rather than runtime availability.

Secure Boot bypass in Microsoft Windows allows an authorized local attacker with high privileges to defeat the firmware-level boot integrity protection, breaking the chain of trust intended to prevent unauthorized boot-time code. The CVSS 7.9 rating with scope change (S:C) indicates the bypass affects components beyond the initially compromised context, enabling pre-OS persistence. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Security feature bypass in Microsoft Windows Secure Boot allows a local attacker with high privileges to defeat the platform's boot-time integrity protections, achieving cross-scope confidentiality and integrity impact on the host. The flaw is tracked under CWE-693 (Protection Mechanism Failure) and carries a CVSS 3.1 base score of 7.9 with no public exploit identified at time of analysis. Because the scope is Changed (S:C), successful exploitation lets the attacker influence components outside the originally vulnerable security boundary - typically the trusted boot chain itself.

Remote code execution in Microsoft Remote Desktop Client is possible via a heap-based buffer overflow that an unauthenticated remote attacker can trigger when a user is convinced to connect to a malicious RDP server. The flaw is rated CVSS 7.5 (High) with attack complexity High and required user interaction, and no public exploit identified at time of analysis. The CWE-416 classification combined with the vendor's tags points to a use-after-free condition reachable through crafted RDP server responses.

Security feature bypass in Microsoft Windows Boot Manager enables an authorized local attacker with high privileges to defeat a protection mechanism during the boot process, with scope change extending impact beyond the initial security boundary. The flaw carries a CVSS 7.9 rating reflecting high confidentiality and integrity impact, and no public exploit identified at time of analysis. The scope-changed nature suggests the bypass undermines a trust boundary such as Secure Boot or BitLocker pre-boot integrity.