Windows 11 24h2
Monthly
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privilege attacker to achieve full SYSTEM-level access via a use-after-free (CWE-416) memory corruption condition. The flaw spans an exceptionally broad surface - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making it relevant to virtually every supported enterprise Windows deployment using MDM enrollment. Vendor patches are available via the MSRC advisory; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Local privilege escalation in the Windows Data Sharing Service Client (DsSvc) enables a low-privileged authenticated local user to gain SYSTEM-level access across a sweeping range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-862 (Missing Authorization): the service client fails to enforce authorization checks on operations that should be restricted to higher-privilege callers, allowing a standard user account to invoke privileged service operations without additional conditions. Vendor-released patches are available via Microsoft's update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Authentication Methods affects all supported Windows 10, Windows 11, and Windows Server releases through a use-after-free condition triggered via a race condition (CWE-362). An attacker with low-privileged local access can win a timing window in the authentication subsystem, corrupt freed memory, and elevate to full SYSTEM-level privileges with complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions - spanning every major Windows release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - makes this a high-priority patch for any Windows fleet.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated attacker with low privileges to gain full system-level access via a use-after-free memory corruption condition. The vulnerability affects a broad surface of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Microsoft has released patches across all affected product lines; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WinBio) allows an authenticated low-privileged user to gain full system control via a heap-based buffer overflow. The flaw spans a broad surface - Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016 through 2025 - all pre-patched builds are affected. Microsoft has released security updates addressing the overflow; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service enables local privilege escalation to SYSTEM-level access across a wide range of Windows client and server releases. Any low-privileged, authorized local user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) affects the full current Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated local user can trigger the overflow to achieve full SYSTEM-level code execution, with complete confidentiality, integrity, and availability impact on the local machine. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build branches via the standard update guide.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation through a double-free memory corruption flaw in Windows Credential Guard affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. An attacker who already holds elevated local privileges on a target system can exploit the CWE-415 defect to escape the Credential Guard security boundary, achieving scope change with high confidentiality, integrity, and availability impact on protected credential stores. No public exploit code and no CISA KEV listing are present at time of analysis; Microsoft has released patches as part of its update guidance.
Privilege escalation via heap-based buffer overflow in the Windows USB driver stack allows a low-privileged local attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) resides in kernel-mode USB driver handling, where malformed or malicious USB-related input can corrupt heap memory and redirect execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the low attack complexity and broad Windows footprint make this a meaningful post-exploitation and insider-threat vector.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Heap-based buffer overflow in the Windows Storage Port Driver enables local privilege escalation on Windows 11 and Windows Server 2025. An authenticated low-privilege local attacker can exploit the overflow to achieve full C:H/I:H/A:H impact, effectively gaining SYSTEM-level access. No public exploit identified at time of analysis, and the flaw is not listed in the CISA KEV catalog; Microsoft has released patches resolving the issue.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Privilege escalation in Windows Installer affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, allowing a locally authenticated low-privileged attacker to gain full SYSTEM-level control by exploiting improper validation of integrity check values (CWE-354). The CVSS vector (AV:L/PR:L) confirms local exploitation requiring only a standard user account, with no user interaction needed once access is established. No public exploit has been identified at time of analysis, but Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Winsock allows a locally authenticated, low-privileged attacker to elevate privileges to kernel level on unpatched Windows hosts. The flaw resides in the default-present Winsock socket stack and affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025, including Server Core installations; exploitation requires the attacker to already hold a foothold on the host (CVSS AV:L, PR:L, UI:N), making this a privilege-escalation primitive rather than a remotely reachable entry point. No public exploit code has been identified at time of analysis - EPSS is 0.26% (17th percentile) and CISA SSVC records exploitation as "none" - but vendor patches are available and the technical impact of a successful heap corruption is total (C:H/I:H/A:H).
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an authorized local attacker with low privileges to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) reflects that exploitation requires local access and elevated complexity, limiting opportunistic automated attacks but not targeted use. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows Display Enhancement Service (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a locally authenticated low-privileged attacker to gain elevated privileges through exploitation of a double-free memory corruption flaw (CWE-415). The vulnerability requires local access and high attack complexity, reflecting the precision required to reliably trigger and exploit heap corruption. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Windows Shell's link-resolution logic fails to safely handle symbolic or hard links before granting file access, enabling a remote unauthenticated attacker to perform network-based spoofing against a victim who interacts with a crafted payload. The flaw (CWE-59) spans the full current Windows ecosystem - from Server 2012 R2 through Windows 11 26H2 and Server 2025 - and can yield both confidentiality and integrity compromise (C:H/I:H). No public exploit or CISA KEV listing has been identified at time of analysis, but user interaction (UI:R) is the sole barrier to exploitation.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privilege attacker to achieve full SYSTEM-level access via a use-after-free (CWE-416) memory corruption condition. The flaw spans an exceptionally broad surface - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making it relevant to virtually every supported enterprise Windows deployment using MDM enrollment. Vendor patches are available via the MSRC advisory; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Local privilege escalation in the Windows Data Sharing Service Client (DsSvc) enables a low-privileged authenticated local user to gain SYSTEM-level access across a sweeping range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-862 (Missing Authorization): the service client fails to enforce authorization checks on operations that should be restricted to higher-privilege callers, allowing a standard user account to invoke privileged service operations without additional conditions. Vendor-released patches are available via Microsoft's update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Authentication Methods affects all supported Windows 10, Windows 11, and Windows Server releases through a use-after-free condition triggered via a race condition (CWE-362). An attacker with low-privileged local access can win a timing window in the authentication subsystem, corrupt freed memory, and elevate to full SYSTEM-level privileges with complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions - spanning every major Windows release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - makes this a high-priority patch for any Windows fleet.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated attacker with low privileges to gain full system-level access via a use-after-free memory corruption condition. The vulnerability affects a broad surface of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Microsoft has released patches across all affected product lines; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WinBio) allows an authenticated low-privileged user to gain full system control via a heap-based buffer overflow. The flaw spans a broad surface - Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016 through 2025 - all pre-patched builds are affected. Microsoft has released security updates addressing the overflow; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service enables local privilege escalation to SYSTEM-level access across a wide range of Windows client and server releases. Any low-privileged, authorized local user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) affects the full current Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated local user can trigger the overflow to achieve full SYSTEM-level code execution, with complete confidentiality, integrity, and availability impact on the local machine. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build branches via the standard update guide.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation through a double-free memory corruption flaw in Windows Credential Guard affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. An attacker who already holds elevated local privileges on a target system can exploit the CWE-415 defect to escape the Credential Guard security boundary, achieving scope change with high confidentiality, integrity, and availability impact on protected credential stores. No public exploit code and no CISA KEV listing are present at time of analysis; Microsoft has released patches as part of its update guidance.
Privilege escalation via heap-based buffer overflow in the Windows USB driver stack allows a low-privileged local attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) resides in kernel-mode USB driver handling, where malformed or malicious USB-related input can corrupt heap memory and redirect execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the low attack complexity and broad Windows footprint make this a meaningful post-exploitation and insider-threat vector.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Heap-based buffer overflow in the Windows Storage Port Driver enables local privilege escalation on Windows 11 and Windows Server 2025. An authenticated low-privilege local attacker can exploit the overflow to achieve full C:H/I:H/A:H impact, effectively gaining SYSTEM-level access. No public exploit identified at time of analysis, and the flaw is not listed in the CISA KEV catalog; Microsoft has released patches resolving the issue.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Privilege escalation in Windows Installer affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, allowing a locally authenticated low-privileged attacker to gain full SYSTEM-level control by exploiting improper validation of integrity check values (CWE-354). The CVSS vector (AV:L/PR:L) confirms local exploitation requiring only a standard user account, with no user interaction needed once access is established. No public exploit has been identified at time of analysis, but Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Winsock allows a locally authenticated, low-privileged attacker to elevate privileges to kernel level on unpatched Windows hosts. The flaw resides in the default-present Winsock socket stack and affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025, including Server Core installations; exploitation requires the attacker to already hold a foothold on the host (CVSS AV:L, PR:L, UI:N), making this a privilege-escalation primitive rather than a remotely reachable entry point. No public exploit code has been identified at time of analysis - EPSS is 0.26% (17th percentile) and CISA SSVC records exploitation as "none" - but vendor patches are available and the technical impact of a successful heap corruption is total (C:H/I:H/A:H).
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an authorized local attacker with low privileges to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) reflects that exploitation requires local access and elevated complexity, limiting opportunistic automated attacks but not targeted use. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows Display Enhancement Service (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a locally authenticated low-privileged attacker to gain elevated privileges through exploitation of a double-free memory corruption flaw (CWE-415). The vulnerability requires local access and high attack complexity, reflecting the precision required to reliably trigger and exploit heap corruption. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Windows Shell's link-resolution logic fails to safely handle symbolic or hard links before granting file access, enabling a remote unauthenticated attacker to perform network-based spoofing against a victim who interacts with a crafted payload. The flaw (CWE-59) spans the full current Windows ecosystem - from Server 2012 R2 through Windows 11 26H2 and Server 2025 - and can yield both confidentiality and integrity compromise (C:H/I:H). No public exploit or CISA KEV listing has been identified at time of analysis, but user interaction (UI:R) is the sole barrier to exploitation.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.