Windows 11 23h2
Monthly
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows 11 Virtualization-Based Security (VBS) Enclave allows an attacker who already holds low-privileged, authorized code execution on a host to trigger an integer overflow (CWE-190) and gain full control over confidentiality, integrity, and availability of that machine. Only unpatched Windows 11 builds 23H2, 24H2, 25H2, 26H1, and 26H2 with VBS enabled are affected; the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local-only, post-compromise escalation with no user interaction and no remote exposure. Vendor-released patches are available from Microsoft, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an attacker who already holds low-privileged code execution on a target host to elevate to SYSTEM through a use-after-free (CWE-416) memory corruption flaw in the kernel-mode graphics subsystem. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is authenticated in the sense that the attacker must already have a local foothold; no user interaction is required and there is no remote or network vector, so this is a post-compromise escalation primitive rather than an initial access path. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2025 (including Server Core installations); no public exploit code has been identified at time of analysis, EPSS is low at 0.27% (17th percentile), CISA SSVC records no known exploitation, and a vendor patch is available.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.
Double free in the Windows Hyper-V hypervisor component allows an authenticated local attacker to corrupt memory in a privileged context and elevate to SYSTEM on affected Windows 11 (23H2, 24H2, 25H2, 26H2) and Windows Server 2022/2025 hosts, including Server Core installations, with the Hyper-V role present. Exploitation requires that the attacker already hold local code execution on the host (CVSS AV:L/PR:L, no user interaction), so this is a privilege-escalation primitive rather than a remote entry point, and hosts without the Hyper-V role are not exposed. No public exploit code or active exploitation has been identified at time of analysis - CISA SSVC reports exploitation none and automatable no - and vendor patches are available, making this a genuine but second-tier priority relative to remotely reachable or actively exploited Hyper-V flaws.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem lets an attacker who already holds low-privileged code execution on a host escalate to full kernel-level (SYSTEM) privileges on unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and on Windows Server 2025, including Server Core installs. The underlying defect is a use-after-free (CWE-416) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the access vector is strictly local and the attacker must already be an authenticated user on the machine, so this is a post-foothold escalation rather than a remotely reachable bug, and no user interaction is needed. At time of analysis there is no public exploit code and no public exploit identified at time of analysis, and Microsoft has published vendor patches; exploitation would require reliably winning the object-reuse condition in kernel memory, and a failed attempt is likely to crash the host rather than succeed silently.
Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an authenticated low-privileged user with an existing local foothold to corrupt heap memory in the host-side WSL components and cross a security boundary to gain elevated code execution, rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). The attack is entirely local - there is no network vector - and it requires the optional WSL feature to already be installed and enabled on an affected Windows 10, Windows 11 or Windows Server build, which meaningfully limits the exposed population since WSL is not present by default. Microsoft has published a fix through the MSRC update guide and there is no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none and automatable as no.
Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Local privilege escalation in Microsoft Windows Hyper-V lets an authenticated, low-privileged attacker who already has code execution on a host with the Hyper-V role enabled trigger a use-after-free in a Hyper-V component and gain SYSTEM-level code execution (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H). Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022, and 2025 including Server Core installations; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none with Automatable: no, so risk is concentrated on multi-tenant, shared, or virtualization hosts where untrusted low-privilege principals already run. Microsoft has released fixes through the standard Windows cumulative update channel (MSRC advisory CVE-2026-70023, mirrored in ENISA EUVD-2026-100338), and administrators of Hyper-V hosts should treat this as a priority local escalation patch rather than a remote emergency.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Local privilege escalation in the Windows AppX Deployment Extensions component allows an authenticated, low-privileged attacker who already has code execution or interactive access on a host to elevate to a higher-integrity context, including SYSTEM, because a required authorization check is missing (CWE-862). The flaw carries a CVSS 3.1 base score of 8.8 from the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - the Scope:Changed rating reflects that a successful exploit crosses a privilege boundary, granting high confidentiality, integrity, and availability impact. Every supported Windows client and server release is exposed, and because the component ships in default Windows installations, no unusual configuration is required once the attacker has a foothold; there is no KEV listing and no public exploit identified at time of analysis, though the low attack complexity and absence of user interaction make it an attractive post-compromise escalation primitive. Microsoft has released fixed builds, so this is a genuine prioritization candidate for patch cycles rather than an unmitigable emergency, but the hard prerequisite of existing local access is the main constraint on real-world risk.
Code execution in the Windows Overlay Filter (WOF) driver lets a locally authenticated attacker trigger an out-of-bounds memory read and, per Microsoft's severity rating, achieve code execution with high confidentiality, integrity and availability impact on unpatched machines. The flaw (CVE-2026-69942, CWE-126, CVSS 7.8 / AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing local foothold and low-privileged credentials, so it is a post-compromise privilege-escalation issue rather than an initial access vector, affecting Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core) below their fixed build levels. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis; Microsoft has released a fix, so exposure is confined to systems that have not yet installed the current cumulative update.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Spaceport.sys Storage Spaces kernel driver allows an authenticated attacker who already has the ability to execute code as a low-privileged user on an affected host to gain full SYSTEM-level privileges. An integer overflow/wraparound in the driver's handling of size or index values lets a crafted request corrupt kernel memory, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All unpatched Windows 11 releases from 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) installations with the driver loaded at defaults are in scope, but exploitation is not automatable per SSVC, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows 11 Virtualization-Based Security (VBS) Enclave allows an attacker who already holds low-privileged, authorized code execution on a host to trigger an integer overflow (CWE-190) and gain full control over confidentiality, integrity, and availability of that machine. Only unpatched Windows 11 builds 23H2, 24H2, 25H2, 26H1, and 26H2 with VBS enabled are affected; the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local-only, post-compromise escalation with no user interaction and no remote exposure. Vendor-released patches are available from Microsoft, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an attacker who already holds low-privileged code execution on a target host to elevate to SYSTEM through a use-after-free (CWE-416) memory corruption flaw in the kernel-mode graphics subsystem. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is authenticated in the sense that the attacker must already have a local foothold; no user interaction is required and there is no remote or network vector, so this is a post-compromise escalation primitive rather than an initial access path. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2025 (including Server Core installations); no public exploit code has been identified at time of analysis, EPSS is low at 0.27% (17th percentile), CISA SSVC records no known exploitation, and a vendor patch is available.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.
Double free in the Windows Hyper-V hypervisor component allows an authenticated local attacker to corrupt memory in a privileged context and elevate to SYSTEM on affected Windows 11 (23H2, 24H2, 25H2, 26H2) and Windows Server 2022/2025 hosts, including Server Core installations, with the Hyper-V role present. Exploitation requires that the attacker already hold local code execution on the host (CVSS AV:L/PR:L, no user interaction), so this is a privilege-escalation primitive rather than a remote entry point, and hosts without the Hyper-V role are not exposed. No public exploit code or active exploitation has been identified at time of analysis - CISA SSVC reports exploitation none and automatable no - and vendor patches are available, making this a genuine but second-tier priority relative to remotely reachable or actively exploited Hyper-V flaws.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem lets an attacker who already holds low-privileged code execution on a host escalate to full kernel-level (SYSTEM) privileges on unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and on Windows Server 2025, including Server Core installs. The underlying defect is a use-after-free (CWE-416) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the access vector is strictly local and the attacker must already be an authenticated user on the machine, so this is a post-foothold escalation rather than a remotely reachable bug, and no user interaction is needed. At time of analysis there is no public exploit code and no public exploit identified at time of analysis, and Microsoft has published vendor patches; exploitation would require reliably winning the object-reuse condition in kernel memory, and a failed attempt is likely to crash the host rather than succeed silently.
Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an authenticated low-privileged user with an existing local foothold to corrupt heap memory in the host-side WSL components and cross a security boundary to gain elevated code execution, rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). The attack is entirely local - there is no network vector - and it requires the optional WSL feature to already be installed and enabled on an affected Windows 10, Windows 11 or Windows Server build, which meaningfully limits the exposed population since WSL is not present by default. Microsoft has published a fix through the MSRC update guide and there is no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none and automatable as no.
Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Local privilege escalation in Microsoft Windows Hyper-V lets an authenticated, low-privileged attacker who already has code execution on a host with the Hyper-V role enabled trigger a use-after-free in a Hyper-V component and gain SYSTEM-level code execution (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H). Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022, and 2025 including Server Core installations; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none with Automatable: no, so risk is concentrated on multi-tenant, shared, or virtualization hosts where untrusted low-privilege principals already run. Microsoft has released fixes through the standard Windows cumulative update channel (MSRC advisory CVE-2026-70023, mirrored in ENISA EUVD-2026-100338), and administrators of Hyper-V hosts should treat this as a priority local escalation patch rather than a remote emergency.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Local privilege escalation in the Windows AppX Deployment Extensions component allows an authenticated, low-privileged attacker who already has code execution or interactive access on a host to elevate to a higher-integrity context, including SYSTEM, because a required authorization check is missing (CWE-862). The flaw carries a CVSS 3.1 base score of 8.8 from the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - the Scope:Changed rating reflects that a successful exploit crosses a privilege boundary, granting high confidentiality, integrity, and availability impact. Every supported Windows client and server release is exposed, and because the component ships in default Windows installations, no unusual configuration is required once the attacker has a foothold; there is no KEV listing and no public exploit identified at time of analysis, though the low attack complexity and absence of user interaction make it an attractive post-compromise escalation primitive. Microsoft has released fixed builds, so this is a genuine prioritization candidate for patch cycles rather than an unmitigable emergency, but the hard prerequisite of existing local access is the main constraint on real-world risk.
Code execution in the Windows Overlay Filter (WOF) driver lets a locally authenticated attacker trigger an out-of-bounds memory read and, per Microsoft's severity rating, achieve code execution with high confidentiality, integrity and availability impact on unpatched machines. The flaw (CVE-2026-69942, CWE-126, CVSS 7.8 / AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing local foothold and low-privileged credentials, so it is a post-compromise privilege-escalation issue rather than an initial access vector, affecting Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core) below their fixed build levels. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis; Microsoft has released a fix, so exposure is confined to systems that have not yet installed the current cumulative update.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Spaceport.sys Storage Spaces kernel driver allows an authenticated attacker who already has the ability to execute code as a low-privileged user on an affected host to gain full SYSTEM-level privileges. An integer overflow/wraparound in the driver's handling of size or index values lets a crafted request corrupt kernel memory, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All unpatched Windows 11 releases from 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) installations with the driver loaded at defaults are in scope, but exploitation is not automatable per SSVC, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.