Windows 11 24h2
Monthly
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free memory corruption in the Windows Hello authentication subsystem allows a local, low-privileged authenticated user to escalate privileges to a higher-integrity context across a security boundary. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, with specific patched build numbers published by Microsoft. No public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C, C:H/I:H/A:H) signals that successful exploitation yields full compromise of a more privileged security principal.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem, triggered by a numeric truncation error, enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on all major supported Windows releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction required once local code execution is achieved, yielding full confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Privilege escalation via use-after-free in the Win32K kernel subsystem affects multiple Windows 11 and Windows Server 2025 builds, allowing a locally authenticated low-privileged attacker to achieve full SYSTEM-level access. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including its Server Core variant. No public exploit has been identified at time of analysis, though the high C:H/I:H/A:H impact combined with the kernel attack surface makes this a meaningful post-exploitation and lateral-movement primitive in multi-user or RDP-exposed environments.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Accounts Control exploits a use-after-free (CWE-416) condition, allowing an authorized but low-privileged local attacker to gain full system-level privileges across a wide range of Windows desktop and server versions. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires local authenticated access and high attack complexity, consistent with UAF race-condition exploitation. Microsoft has released patches covering Windows 10, Windows 11, and Windows Server 2016 through 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Memory exhaustion in Windows Active Directory Domain Services enables unauthenticated remote attackers to crash or severely degrade the AD DS service by repeatedly triggering a memory leak (CWE-401), denying authentication and directory services to all domain-joined systems. Affected builds span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit has been identified at time of analysis, though the unauthenticated network vector (PR:N, AV:N) makes this a significant priority for enterprise environments where AD DS availability is business-critical.
Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Heap-based buffer overflow in Windows Credential Providers enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges across a broad range of Windows 10, 11, and Windows Server releases. The CWE-122 flaw resides in the credential provider subsystem, requiring no user interaction and no elevated starting privileges, making it a reliable post-compromise escalation primitive for multi-stage attacks. No public exploit code or active exploitation has been confirmed at time of analysis; a vendor patch from Microsoft is available covering all affected branches.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated attacker to achieve full SYSTEM-level code execution via a time-of-check time-of-use (TOCTOU) race condition in the kernel graphics subsystem. The vulnerability spans an exceptionally broad range of Microsoft Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all current servicing branches - making patch deployment a significant operational undertaking. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically favored as second-stage payloads in multi-stage attack chains following initial remote compromise.
Heap-based buffer overflow in the Windows DHCP Client enables an authenticated attacker on the same network segment to escalate privileges on Windows 11 systems. The vulnerability (CWE-122) affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code and no active exploitation have been identified at the time of analysis; Microsoft has released a patch via the June/July 2026 Patch Tuesday cycle.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Privilege escalation in Microsoft Windows Win32K allows an attacker who already holds low-privilege authenticated access to a target host to corrupt kernel stack memory and obtain SYSTEM-level code execution. The flaw is a stack-based buffer overflow (CWE-121) in the kernel-mode Windows subsystem driver reachable through win32k syscalls, affecting Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2019, 2022 and 2025 on builds below the fixed levels. Despite the published 8.8 score using an AV:N vector, this is a local privilege-escalation primitive requiring a pre-existing foothold, no public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.70% (51st percentile); vendor patches are available and fully remediate the issue.
Privilege escalation in the Windows TCP/IP stack lets an attacker who already holds low-privileged authorized access on a reachable host trigger a kernel use-after-free and elevate to SYSTEM, with full compromise of confidentiality, integrity, and availability on the affected machine. The flaw affects a very broad install base - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - but exploitation is constrained by high attack complexity, since the attacker must reliably win a memory reclamation race in kernel space; Microsoft has shipped fixes and there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and no public exploit identified at time of analysis. EPSS is low at 0.52% (43rd percentile), so this is best handled as a routine but high-priority patch-cycle item rather than an emergency.
Out-of-bounds read (CWE-125) in the Windows Kerberos implementation enables unauthenticated remote denial of service across a broad swath of Microsoft Windows versions. An attacker who can send a crafted Kerberos request over the network can crash the Kerberos service, disrupting authentication for all domain-joined users and services on the affected host. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in the Microsoft Windows TCP/IP kernel stack lets an authenticated attacker who already holds low privileges on a reachable host corrupt kernel memory over the network and escalate to SYSTEM, with high impact to confidentiality, integrity and availability. Exploitation hinges on winning a use-after-free race in tcpip.sys, which is why the vector carries AC:H and CISA SSVC rates the issue as not automatable with no observed exploitation; EPSS is 0.65 percent (49th percentile), and no public exploit was identified at time of analysis. All in-support Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds below the vendor's fixed revisions are affected, and Microsoft has released patches.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain SYSTEM-level control via a heap-based buffer overflow triggered by an integer overflow or wraparound. The flaw affects a wide sweep of Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface nearly universal across modern Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, but vendor patch is available and should be prioritized given the full C:H/I:H/A:H impact after a successful escalation.
Local privilege escalation in the Windows Broadcast DVR User Service allows a low-privileged authenticated attacker to gain full system control via a use-after-free memory corruption bug. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds, with Microsoft releasing patches across all affected branches. No public exploit code or active exploitation has been identified at time of analysis, but local LPE vulnerabilities of this class are routinely incorporated into post-exploitation toolchains following initial access.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a low-privileged authenticated attacker to execute arbitrary code over the network on affected Windows 11 and Windows Server 2025 systems. The flaw (CWE-122) is reachable via network with low complexity and no user interaction required, making it exploitable by any account holder with minimal privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Hello across multiple Windows 10 and 11 versions allows an authorized low-privileged local attacker to gain full system control via a double-free memory corruption vulnerability (CWE-415). Affected builds span Windows 10 21H2/22H2 through Windows 11 26H1. Microsoft has released patched builds via the standard update channel. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows MIDI Service Module enables a local authenticated attacker on Windows 11 to escalate privileges, with full confidentiality, integrity, and availability impact in the compromised process scope. Affected builds span three servicing tracks - 24H2, 25H2, and 26H1 - with fixed builds published by Microsoft through MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Elevation of privilege in Windows Group Policy allows an attacker who already holds valid low-privilege credentials on a network-reachable machine to run code at high integrity/SYSTEM level by inducing an untrusted pointer dereference in the policy-processing component. Unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 (including Server Core installations) builds are affected, with builds below the fixed revision for each product line remaining exposed. Exploitation is unconfirmed: no public exploit code and no KEV listing exist, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.70% (51st percentile) - this is a genuinely serious but not top-tier-urgent issue, with the low-privilege authentication prerequisite (PR:L, AV:N) as the principal limiting factor.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation on unpatched Windows hosts is achievable by a network-positioned attacker who already holds low-privilege credentials, exploiting a stack-based buffer overflow (CWE-121) in the Windows Device Association Service; with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the primitive yields high confidentiality, integrity, and availability impact with no user interaction, though it is a post-foothold escalation rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and EPSS is modest at 0.85% (56th percentile), so this is a genuine patch-priority item rather than an emergency. Microsoft has published vendor patches for every affected Windows 10, Windows 11, and Windows Server build, making remediation a straightforward monthly-update action.
Use-after-free in the Windows Device Association Service enables a local low-privileged attacker to escalate to full system-level privileges across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability stems from improper memory management in the service responsible for pairing devices, where a freed memory region can be reused to redirect execution. Microsoft has released patches addressing all affected builds; no public exploit or CISA KEV listing is recorded at time of analysis, though the high-complexity (AC:H) requirement means reliable exploitation demands careful timing or race-condition abuse.
Privilege escalation in Windows Hello on Windows 10 and 11 allows an authorized local attacker to elevate privileges beyond their current security boundary by exploiting a race condition in a shared resource. The vulnerability requires high initial privileges and high attack complexity due to race timing constraints, but successful exploitation yields scope-changed full C:H/I:H/A:H impact - consistent with SYSTEM-level compromise. Microsoft has released cumulative updates for all affected Windows 10 and Windows 11 builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Privilege escalation via use-after-free (CWE-416) in the Windows Web Platform Storage component affects Windows 10, 11, and multiple Windows Server releases. An authenticated local user with standard (low) privileges can exploit a race condition in memory management to achieve full local system compromise - gaining high confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected Windows versions across the enterprise install base makes patch prioritization essential.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Privilege escalation in the Windows Win32K kernel component allows an attacker who already holds low-privileged execution on a target host (PR:L) to corrupt kernel memory and escalate to SYSTEM-level privileges. Microsoft rates the flaw CVSS 7.5 (HIGH) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, although our assessment reads the practical attack vector as local (AV:L); in either reading the precondition is existing code execution on the box, making this a post-compromise escalation primitive rather than a remotely reachable entry point, and the high attack complexity means a race condition or specific heap/object state must be won reliably. Affected are unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 builds below the fixed build numbers published by Microsoft; there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.44% (37th percentile), so near-term exploitation risk is driven by targeted, post-access actors rather than mass scanning.
Privilege escalation in Windows IP Address Management (IPAM) allows an authenticated local user on any of a broad range of unpatched Windows 10, 11, and Windows Server releases to obtain full system-level control by supplying a crafted serialized payload to the IPAM service. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 7.0 under a local, high-complexity attack vector with full C:H/I:H/A:H impact. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the complete impact triad makes successful exploitation severely damaging on any affected host.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Memory-safety corruption in the Windows Win32K kernel-mode component lets an attacker who already holds low-privileged code execution on a target host escalate to full kernel/SYSTEM privileges, with the vendor rating it CVSS 8.8 on a C:H/I:H/A:H impact profile. All supported Windows 10 builds (1809, 21H2, 22H2), Windows 11 builds (23H2, 24H2, 25H2, 26H1) and Windows Server 2019, 2022 and 2025 (including Server Core) below Microsoft's patched revisions are affected, since Win32K is present in every default installation. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV (SSVC: Exploitation none, Automatable no, Technical Impact total), and EPSS is 0.77% (53rd percentile), so risk is currently driven by the severity of the primitive rather than observed activity.
Privilege escalation on unpatched Windows 10, Windows 11, and Windows Server systems is possible through a heap-based buffer overflow in the Encrypting File System (EFS), which a low-privileged authenticated account can reach over the network to gain SYSTEM-level code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), implying a race condition or precise heap grooming rather than a deterministic one-shot trigger, and no user interaction is required. There is no evidence of active exploitation and no public exploit identified at time of analysis; CISA SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is a low 0.57% (45th percentile) despite the total technical impact score. Microsoft has released fixes, so the residual risk is concentrated on systems that remain unpatched.
Privilege escalation via integer underflow in Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged user to gain SYSTEM-level access across virtually the entire Windows ecosystem. The flaw spans Windows Server 2012 through Windows 11 26H1 and Server 2025, making it a broad-surface local elevation-of-privilege issue. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Privilege escalation in Windows Accounts Control allows an authorized local attacker to gain elevated system access by exploiting a use-after-free memory corruption flaw (CWE-416). The vulnerability spans a broad range of Windows 10, 11, and Windows Server editions from build 14393 through build 28000, making the exposure surface wide across enterprise and consumer deployments. Microsoft has released patches; no public exploit code or CISA KEV listing exists at time of analysis, though the AC:H vector indicates a race-condition-dependent trigger consistent with timing-sensitive UAF exploitation.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Local privilege escalation in the Windows Notification subsystem (CWE-416 use-after-free) affects Windows 10, Windows 11, and Windows Server 2022/2025 across a broad range of release builds. An authenticated low-privilege attacker who successfully exploits the race-condition-dependent memory corruption can achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free memory corruption in the Windows Hello authentication subsystem allows a local, low-privileged authenticated user to escalate privileges to a higher-integrity context across a security boundary. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, with specific patched build numbers published by Microsoft. No public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C, C:H/I:H/A:H) signals that successful exploitation yields full compromise of a more privileged security principal.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem, triggered by a numeric truncation error, enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on all major supported Windows releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction required once local code execution is achieved, yielding full confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Privilege escalation via use-after-free in the Win32K kernel subsystem affects multiple Windows 11 and Windows Server 2025 builds, allowing a locally authenticated low-privileged attacker to achieve full SYSTEM-level access. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including its Server Core variant. No public exploit has been identified at time of analysis, though the high C:H/I:H/A:H impact combined with the kernel attack surface makes this a meaningful post-exploitation and lateral-movement primitive in multi-user or RDP-exposed environments.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Accounts Control exploits a use-after-free (CWE-416) condition, allowing an authorized but low-privileged local attacker to gain full system-level privileges across a wide range of Windows desktop and server versions. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires local authenticated access and high attack complexity, consistent with UAF race-condition exploitation. Microsoft has released patches covering Windows 10, Windows 11, and Windows Server 2016 through 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Memory exhaustion in Windows Active Directory Domain Services enables unauthenticated remote attackers to crash or severely degrade the AD DS service by repeatedly triggering a memory leak (CWE-401), denying authentication and directory services to all domain-joined systems. Affected builds span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit has been identified at time of analysis, though the unauthenticated network vector (PR:N, AV:N) makes this a significant priority for enterprise environments where AD DS availability is business-critical.
Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Heap-based buffer overflow in Windows Credential Providers enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges across a broad range of Windows 10, 11, and Windows Server releases. The CWE-122 flaw resides in the credential provider subsystem, requiring no user interaction and no elevated starting privileges, making it a reliable post-compromise escalation primitive for multi-stage attacks. No public exploit code or active exploitation has been confirmed at time of analysis; a vendor patch from Microsoft is available covering all affected branches.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated attacker to achieve full SYSTEM-level code execution via a time-of-check time-of-use (TOCTOU) race condition in the kernel graphics subsystem. The vulnerability spans an exceptionally broad range of Microsoft Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all current servicing branches - making patch deployment a significant operational undertaking. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically favored as second-stage payloads in multi-stage attack chains following initial remote compromise.
Heap-based buffer overflow in the Windows DHCP Client enables an authenticated attacker on the same network segment to escalate privileges on Windows 11 systems. The vulnerability (CWE-122) affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code and no active exploitation have been identified at the time of analysis; Microsoft has released a patch via the June/July 2026 Patch Tuesday cycle.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Privilege escalation in Microsoft Windows Win32K allows an attacker who already holds low-privilege authenticated access to a target host to corrupt kernel stack memory and obtain SYSTEM-level code execution. The flaw is a stack-based buffer overflow (CWE-121) in the kernel-mode Windows subsystem driver reachable through win32k syscalls, affecting Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2019, 2022 and 2025 on builds below the fixed levels. Despite the published 8.8 score using an AV:N vector, this is a local privilege-escalation primitive requiring a pre-existing foothold, no public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.70% (51st percentile); vendor patches are available and fully remediate the issue.
Privilege escalation in the Windows TCP/IP stack lets an attacker who already holds low-privileged authorized access on a reachable host trigger a kernel use-after-free and elevate to SYSTEM, with full compromise of confidentiality, integrity, and availability on the affected machine. The flaw affects a very broad install base - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - but exploitation is constrained by high attack complexity, since the attacker must reliably win a memory reclamation race in kernel space; Microsoft has shipped fixes and there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and no public exploit identified at time of analysis. EPSS is low at 0.52% (43rd percentile), so this is best handled as a routine but high-priority patch-cycle item rather than an emergency.
Out-of-bounds read (CWE-125) in the Windows Kerberos implementation enables unauthenticated remote denial of service across a broad swath of Microsoft Windows versions. An attacker who can send a crafted Kerberos request over the network can crash the Kerberos service, disrupting authentication for all domain-joined users and services on the affected host. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in the Microsoft Windows TCP/IP kernel stack lets an authenticated attacker who already holds low privileges on a reachable host corrupt kernel memory over the network and escalate to SYSTEM, with high impact to confidentiality, integrity and availability. Exploitation hinges on winning a use-after-free race in tcpip.sys, which is why the vector carries AC:H and CISA SSVC rates the issue as not automatable with no observed exploitation; EPSS is 0.65 percent (49th percentile), and no public exploit was identified at time of analysis. All in-support Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds below the vendor's fixed revisions are affected, and Microsoft has released patches.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain SYSTEM-level control via a heap-based buffer overflow triggered by an integer overflow or wraparound. The flaw affects a wide sweep of Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface nearly universal across modern Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, but vendor patch is available and should be prioritized given the full C:H/I:H/A:H impact after a successful escalation.
Local privilege escalation in the Windows Broadcast DVR User Service allows a low-privileged authenticated attacker to gain full system control via a use-after-free memory corruption bug. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds, with Microsoft releasing patches across all affected branches. No public exploit code or active exploitation has been identified at time of analysis, but local LPE vulnerabilities of this class are routinely incorporated into post-exploitation toolchains following initial access.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a low-privileged authenticated attacker to execute arbitrary code over the network on affected Windows 11 and Windows Server 2025 systems. The flaw (CWE-122) is reachable via network with low complexity and no user interaction required, making it exploitable by any account holder with minimal privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Hello across multiple Windows 10 and 11 versions allows an authorized low-privileged local attacker to gain full system control via a double-free memory corruption vulnerability (CWE-415). Affected builds span Windows 10 21H2/22H2 through Windows 11 26H1. Microsoft has released patched builds via the standard update channel. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows MIDI Service Module enables a local authenticated attacker on Windows 11 to escalate privileges, with full confidentiality, integrity, and availability impact in the compromised process scope. Affected builds span three servicing tracks - 24H2, 25H2, and 26H1 - with fixed builds published by Microsoft through MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Elevation of privilege in Windows Group Policy allows an attacker who already holds valid low-privilege credentials on a network-reachable machine to run code at high integrity/SYSTEM level by inducing an untrusted pointer dereference in the policy-processing component. Unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 (including Server Core installations) builds are affected, with builds below the fixed revision for each product line remaining exposed. Exploitation is unconfirmed: no public exploit code and no KEV listing exist, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.70% (51st percentile) - this is a genuinely serious but not top-tier-urgent issue, with the low-privilege authentication prerequisite (PR:L, AV:N) as the principal limiting factor.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation on unpatched Windows hosts is achievable by a network-positioned attacker who already holds low-privilege credentials, exploiting a stack-based buffer overflow (CWE-121) in the Windows Device Association Service; with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the primitive yields high confidentiality, integrity, and availability impact with no user interaction, though it is a post-foothold escalation rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and EPSS is modest at 0.85% (56th percentile), so this is a genuine patch-priority item rather than an emergency. Microsoft has published vendor patches for every affected Windows 10, Windows 11, and Windows Server build, making remediation a straightforward monthly-update action.
Use-after-free in the Windows Device Association Service enables a local low-privileged attacker to escalate to full system-level privileges across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability stems from improper memory management in the service responsible for pairing devices, where a freed memory region can be reused to redirect execution. Microsoft has released patches addressing all affected builds; no public exploit or CISA KEV listing is recorded at time of analysis, though the high-complexity (AC:H) requirement means reliable exploitation demands careful timing or race-condition abuse.
Privilege escalation in Windows Hello on Windows 10 and 11 allows an authorized local attacker to elevate privileges beyond their current security boundary by exploiting a race condition in a shared resource. The vulnerability requires high initial privileges and high attack complexity due to race timing constraints, but successful exploitation yields scope-changed full C:H/I:H/A:H impact - consistent with SYSTEM-level compromise. Microsoft has released cumulative updates for all affected Windows 10 and Windows 11 builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Privilege escalation via use-after-free (CWE-416) in the Windows Web Platform Storage component affects Windows 10, 11, and multiple Windows Server releases. An authenticated local user with standard (low) privileges can exploit a race condition in memory management to achieve full local system compromise - gaining high confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected Windows versions across the enterprise install base makes patch prioritization essential.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Privilege escalation in the Windows Win32K kernel component allows an attacker who already holds low-privileged execution on a target host (PR:L) to corrupt kernel memory and escalate to SYSTEM-level privileges. Microsoft rates the flaw CVSS 7.5 (HIGH) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, although our assessment reads the practical attack vector as local (AV:L); in either reading the precondition is existing code execution on the box, making this a post-compromise escalation primitive rather than a remotely reachable entry point, and the high attack complexity means a race condition or specific heap/object state must be won reliably. Affected are unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 builds below the fixed build numbers published by Microsoft; there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.44% (37th percentile), so near-term exploitation risk is driven by targeted, post-access actors rather than mass scanning.
Privilege escalation in Windows IP Address Management (IPAM) allows an authenticated local user on any of a broad range of unpatched Windows 10, 11, and Windows Server releases to obtain full system-level control by supplying a crafted serialized payload to the IPAM service. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 7.0 under a local, high-complexity attack vector with full C:H/I:H/A:H impact. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the complete impact triad makes successful exploitation severely damaging on any affected host.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Memory-safety corruption in the Windows Win32K kernel-mode component lets an attacker who already holds low-privileged code execution on a target host escalate to full kernel/SYSTEM privileges, with the vendor rating it CVSS 8.8 on a C:H/I:H/A:H impact profile. All supported Windows 10 builds (1809, 21H2, 22H2), Windows 11 builds (23H2, 24H2, 25H2, 26H1) and Windows Server 2019, 2022 and 2025 (including Server Core) below Microsoft's patched revisions are affected, since Win32K is present in every default installation. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV (SSVC: Exploitation none, Automatable no, Technical Impact total), and EPSS is 0.77% (53rd percentile), so risk is currently driven by the severity of the primitive rather than observed activity.
Privilege escalation on unpatched Windows 10, Windows 11, and Windows Server systems is possible through a heap-based buffer overflow in the Encrypting File System (EFS), which a low-privileged authenticated account can reach over the network to gain SYSTEM-level code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), implying a race condition or precise heap grooming rather than a deterministic one-shot trigger, and no user interaction is required. There is no evidence of active exploitation and no public exploit identified at time of analysis; CISA SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is a low 0.57% (45th percentile) despite the total technical impact score. Microsoft has released fixes, so the residual risk is concentrated on systems that remain unpatched.
Privilege escalation via integer underflow in Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged user to gain SYSTEM-level access across virtually the entire Windows ecosystem. The flaw spans Windows Server 2012 through Windows 11 26H1 and Server 2025, making it a broad-surface local elevation-of-privilege issue. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Privilege escalation in Windows Accounts Control allows an authorized local attacker to gain elevated system access by exploiting a use-after-free memory corruption flaw (CWE-416). The vulnerability spans a broad range of Windows 10, 11, and Windows Server editions from build 14393 through build 28000, making the exposure surface wide across enterprise and consumer deployments. Microsoft has released patches; no public exploit code or CISA KEV listing exists at time of analysis, though the AC:H vector indicates a race-condition-dependent trigger consistent with timing-sensitive UAF exploitation.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Local privilege escalation in the Windows Notification subsystem (CWE-416 use-after-free) affects Windows 10, Windows 11, and Windows Server 2022/2025 across a broad range of release builds. An authenticated low-privilege attacker who successfully exploits the race-condition-dependent memory corruption can achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.