Windows 11 24h2
Monthly
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
Information disclosure in the Windows Print Spooler on affected client and server editions lets an authenticated local user obtain uninitialized memory contents from spooler components, potentially exposing residual sensitive data held by a privileged process. The flaw is rated 5.5 (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation is strictly local, requires a valid low-privileged account with local code execution or session access, needs no user interaction, and cannot be triggered remotely or by an unauthenticated attacker. Exploitation against CVE-2026-85320 is not currently observed, no public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, so exposure is concentrated in shared multi-user hosts such as RDP servers, terminal servers and jump boxes; Microsoft has released patches.
Improper authorization logic in the Windows SMB Client lets an authenticated local user bypass a Windows security feature, yielding a high-integrity impact on the affected system (CVE-2026-84011, CVSS 5.5). Exploitation requires an attacker to already hold valid low-privileged credentials and local code execution on the host (CVSS vector AV:L/PR:L/UI:N), so this is a post-compromise privilege-context escalation rather than a remotely reachable flaw; no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis and CISA SSVC rates exploitation as "none" with the issue considered non-automatable; Microsoft has released fixed builds for all affected Windows 11 and Windows Server 2022/2025 editions.
Local tampering in the Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker who already holds a foothold on the machine to win a time-of-check time-of-use race and alter data the component is handling. The flaw is scored CVSS v3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) - it is not remotely reachable, requires local authenticated access, and is gated by high attack complexity, so success depends on repeatedly hitting a narrow race window rather than a single deterministic action, with the only impact being a high integrity/tampering effect and no confidentiality or availability loss. No public exploit has been identified at time of analysis - there is no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable - while Microsoft has published a fix, making this a low-to-moderate priority patching item rather than an emergency.
Improper link resolution in the Windows Update Orchestrator Service allows a locally authenticated, low-privileged attacker to read files they would not otherwise be permitted to access on Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2022/2025. Because the service runs as SYSTEM and dereferences filesystem paths without validating reparse points, an attacker who already holds a foothold can plant a symbolic link, junction or hard link and race the service into opening a protected file, yielding high-confidentiality information disclosure with no integrity or availability impact (CVSS 5.5). Exploitation is assessed as non-automatable under CISA's SSVC framework, no public exploit code has been identified at time of analysis, and overall risk is comparatively low-priority given the local, post-compromise prerequisites.
Improper certificate validation in Windows Hello lets an attacker who already holds high local privileges on an affected Windows host bypass the feature's certificate-based authentication check, exposing credential material that Windows Hello would otherwise protect (confidentiality impact only). The defect is strictly local - there is no network attack path and no user interaction is required - and it affects Windows 10, Windows 11 and Windows Server builds below their respective patched levels, including Windows 11 24H2 (below 10.0.26100.9711) and Windows Server 2025 (below 10.0.26100.33650). Exploitation has not been observed: CISA's SSVC assessment records exploitation status 'none' and automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity issue best handled by routine patching rather than emergency response.
Information disclosure in the Windows Kernel allows an authenticated attacker who can already execute code locally on a vulnerable host to read sensitive data that the kernel fails to properly initialize or sanitize before exposing it (CWE-497). Exploitation is not remotely reachable: the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N requires local authenticated access plus code execution, and the high attack complexity means the attacker must both reach the specific kernel code path and satisfy timing/memory-state conditions to capture meaningful leaked content rather than zeroes or stale noise. Impact is strictly confidentiality (C:H with I:N/A:N) and stays within the current security context (S:U) rather than escalating privileges; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, making this a genuinely low-priority item despite the HIGH confidentiality metric. All supported Windows 10, Windows 11, and Windows Server builds up to the January-class update thresholds listed by EUVD are affected, and vendor patches are available.
Information disclosure in the Windows Win32 kernel subsystem allows an authenticated local attacker holding low-level privileges to read sensitive system data that should be confined to a more privileged control sphere. Unpatched Windows 10, Windows 11 and Windows Server builds are affected, and triggering the flaw requires local interactive or code-execution access plus a hard-to-control precondition, which is why the vendor scores it only 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N - confidentiality impact only, no integrity or availability loss). No public exploit was identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and vendor-released patches are available from Microsoft.
Local information disclosure in Microsoft Windows Hello allows an attacker who already holds low-privileged authenticated access on a Windows 10 or Windows 11 host to read sensitive system data that should be outside their control sphere. Exploitation requires local interactive access (AV:L, PR:L), involves no victim user interaction (UI:N), and yields only confidentiality impact - no code execution, tampering, or denial of service - which is why our assessment rates this a genuine but comparatively low-priority issue rather than an urgent one. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, SSVC rates it not automatable, and Microsoft has released fixed build floors for every affected branch.
Spoofing in Windows Shell allows unauthenticated remote attackers to impersonate trusted content by exploiting an incorrectly implemented authentication algorithm (CWE-303), requiring the victim to interact with attacker-supplied content (UI:R). Affects Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core installation) on builds prior to the patched versions, with high confidentiality impact but no integrity or availability loss. No public exploit identified at time of analysis (CISA SSVC: Exploitation none).
Information disclosure in the Windows Shell lets an attacker who already holds a valid low-privileged local account on a Windows host read sensitive system information that should fall outside that account's access sphere. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms this is not remotely reachable, requires an authenticated local logon, needs no user interaction, and is gated by high attack complexity such as a race condition or a specific system state the attacker must win, so reliability is limited; only confidentiality is affected. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC records Exploitation: none, Automatable: no), and the patch is available from the vendor, making this a low-to-moderate priority issue despite the critical confidentiality rating.
An out-of-bounds read in the Windows HID Parser Library (hidparse.sys) allows an attacker who already holds low-privileged local access to read beyond the bounds of a buffer and disclose kernel memory contents to user space, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is local only - the attacker must be authenticated on the host and must cause the parser to process a malformed HID report descriptor, typically by attaching or emulating a crafted USB or Bluetooth HID device - and the result is read-only information disclosure with no code execution or system modification. No public exploit has been identified at time of analysis, CISA SSVC records no observed exploitation and rates the issue non-automatable with partial technical impact, and a vendor patch is available from Microsoft (MSRC update guide, EUVD-2026-100040).
An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.
Information disclosure in the Windows Win32 Kernel Subsystem allows an authenticated local user who can already execute code on the host to read sensitive system information that should remain outside their control. Exploitation is gated by a hard-to-satisfy, attacker-uncontrollable condition (CVSS AC:H), so the flaw is unreliable to trigger, and the impact is confidentiality-only with no integrity or availability loss. There is no CISA KEV listing and no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for every affected Windows client and server branch, making this a genuinely low-priority, moderate-severity issue despite the ubiquity of the platform.
Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.
Local information disclosure in the Windows Clipboard User Service lets an authenticated attacker who already holds a low-privileged foothold on the host read sensitive system information the service is meant to keep segregated (CVSS 3.1 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - integrity and availability are untouched - and exploitation requires valid local credentials, so it cannot be reached remotely or by an unauthenticated actor. Microsoft has published fixes for all supported Windows client and server branches; no public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none, automatable: no, technical impact: partial), making this a moderate, low-priority hardening item.
Local information disclosure in the Windows HID Parser Library (CWE-125, out-of-bounds read) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019/2022/2025, allowing a low-privileged local actor to read memory beyond an intended buffer and potentially disclose sensitive data. Successful exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) plus the ability to get the parser to process attacker-influenced HID descriptor or report data, for example via an attached or emulated USB HID device; integrity and availability are unaffected. The issue is rated moderate rather than high priority: there is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available from Microsoft.
Out-of-bounds read in the Windows HID Parser Library lets an attacker who already holds authenticated local access to a Windows host read beyond the bounds of a parser buffer by supplying a crafted or emulated HID input (for example a malicious USB HID device or a malformed HID report descriptor), resulting in local information disclosure. The affected component is only reachable after local authentication and requires attacker-controlled HID traffic, and the outcome is limited to confidentiality loss (C:H) with no integrity or availability impact and no scope change, so this is a genuine but comparatively low-urgency issue. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as "none" and the issue as non-automatable, and vendor-released patches are available in the form of the Windows build updates listed below.
Spoofing of data protected by the Windows Virtualization-Based Security (VBS) Enclave is possible for a local attacker who already holds a low-privileged foothold on the machine, because the enclave relies on encryption of insufficient strength. Exploitation requires the VBS Enclave feature to be in use and is constrained by high attack complexity (AC:H) and non-automatable conditions per SSVC, and it yields integrity/spoofing impact only (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; severity is moderate (CVSS 5.6) and a vendor patch is available.
An out-of-bounds read in the Windows HID Parser Library lets a locally present, low-privileged authenticated attacker disclose information from the affected system's memory by supplying a malformed HID descriptor or report to the parser. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and yields confidentiality impact only - no code execution, no privilege escalation, and no integrity or availability effect - though leaked memory contents could assist follow-on attacks. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and Microsoft has published a patch; exploitation requires an existing local foothold plus the ability to feed crafted HID data (physical, emulated, or virtual HID device).
An out-of-bounds read in the Windows HID Parser Library allows an attacker who already holds a valid local session on an affected Windows host to disclose memory contents by supplying crafted or malformed HID descriptor data (for example via an emulated or malicious USB/Bluetooth HID device, or a local process feeding HID input). Exploitation requires local access and low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in information disclosure only - no code execution, integrity, or availability impact - and no public exploit was identified at time of analysis, with CISA's SSVC rating exploitation as none and the flaw as non-automatable. Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server editions, so this is a moderate, not urgent, priority that is resolved by applying current cumulative updates.
Local information disclosure in the Windows Aggregated Data Platform Service allows an authenticated, low-privileged user on an affected Windows 11 host to read past the bounds of an in-memory buffer and potentially expose sensitive data that the account would not otherwise be entitled to see. Only unpatched Windows 11 builds - 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H2 below 10.0.26300.9711, and 26H1 below 10.0.28000.3231 - are affected; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5) confirms the attacker must already hold a local account and that no integrity or availability impact is possible. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and no EPSS score was supplied; the mandatory local foothold keeps this a moderate-severity, patch-cycle item rather than an emergency.
Local file tampering through a relative path traversal flaw in Windows WinINet (wininet.dll) requires an attacker to already hold authenticated, low-privileged access to the machine and to satisfy a high-complexity precondition, so it cannot be triggered remotely and carries no confidentiality or availability impact. All supported Windows client and server branches are affected - Windows 10 and 11 releases plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - up to the fixed build numbers published in Microsoft's update guide. No public exploit code has been identified, CISA's SSVC assessment records exploitation as 'none', and Microsoft rates the issue Medium (CVSS 4.7), making it a routine patch-cycle item rather than an emergency.
Information disclosure in Microsoft Windows NTFS lets an attacker who already holds low-privileged local access on a target machine bypass access control checks and read file data they are not authorized to view (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no ability to modify data or cause a denial of service. The local-access prerequisite is the key limiting factor - there is no remote or network-facing attack path, and no user interaction is required once a foothold exists, so this is a post-compromise privilege-escalation-of-information concern rather than an entry point. No public exploit code or confirmed active exploitation was identified at the time of analysis (CISA SSVC: Exploitation none, Automatable no), and the vendor has released patches, making this a moderate-priority patch-and-move-on item - not an emergency - for environments that cannot already be reached by a local standard user.
Information disclosure in the Microsoft Windows Notification component allows a locally authenticated, low-privileged user to read information outside their intended authorization boundary. The underlying weakness is improper/missing access control (CWE-306), exploitable only by an attacker who already holds interactive local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with impact confined to confidentiality (C:H) and no integrity or availability effect and no privilege escalation. This is a moderate-severity issue (CVSS 5.5) that is not known to be actively exploited and for which no public exploit code was identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none', the attack as non-automatable, and technical impact as partial, while Microsoft has published vendor patches fixing the affected builds.
Information disclosure in Windows Hello allows an authenticated local attacker with low privileges to read out-of-bounds memory and expose potentially sensitive data on affected Windows 10 and Windows 11 systems. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) confirms a local, authenticated, low-privilege attack with no user interaction and impact limited to confidentiality. CISA SSVC rates exploitation as none and automatable as no; no public exploit was identified at time of analysis, and Microsoft has a vendor patch available.
A local information-disclosure flaw in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged local access on a Windows host to trigger a buffer over-read and read beyond the bounds of a kernel buffer, exposing memory contents (CVSS 5.5, C:H/I:N/A:N). Exploitation requires local authenticated access (AV:L/PR:L) with no user interaction, but does not yield code execution or system compromise; the attack surface is strictly local. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Microsoft has released patched builds addressing the affected CLFS driver versions.
Spoofing of update content in the Windows Update Stack on Windows 10, Windows 11, and Windows Server allows a locally authenticated attacker (AV:L, PR:L) to bypass cryptographic signature verification and modify update artifacts, yielding integrity impact (CVSS 5.5). Vendor-released cumulative updates fix the flaw; no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows Portable Device MTP (Media Transfer Protocol) driver lets a locally authenticated attacker disclose memory contents from the host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The attacker must already hold a local account or code-execution foothold on the machine and must be able to present a portable device (physical, emulated, or over a bridged interface) that issues crafted MTP requests to the vulnerable driver; no victim user interaction is required. Exploitation status is limited: CISA SSVC reports no known or expected exploitation and no public exploit code was identified at time of analysis, so this is a routine patch-cycle priority rather than an emergency. A vendor patch is available and the affected build list spans Windows 10, Windows 11, and Windows Server 2012 through 2025.
Physical attackers can read out-of-bounds kernel memory through the Windows RNDIS (Remote NDIS) driver, which mishandles attacker-supplied RNDIS protocol data presented over USB. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. The CVSS vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6), so no authentication or user interaction is needed once the attacker has physical access, but remote or network-based exploitation is not possible and impact is confined to information disclosure with no code execution, integrity, or availability effect; there is no public exploit identified at time of analysis and CISA SSVC records Exploitation: none with Automatable: no, so this is a genuinely low-priority issue despite the HIGH confidentiality rating. Practical risk is limited to kiosks, shared or unattended machines, and evil-maid scenarios where an untrusted party can plug in a device.
Information disclosure in the Windows NTFS file system driver lets a locally authenticated low-privilege user read sensitive data that leaks out through error messages when the filesystem is driven into a specific fault condition. Only hosts running the affected Windows client and server builds are exposed, and because the assessed vector is AV:L/AC:H/PR:L/UI:N the issue is neither remotely reachable nor anonymous: the attacker must already hold local, authenticated low-privilege access and must hit a precise, difficult-to-control race or system state, with impact confined to confidentiality (C:H/I:N/A:N). Microsoft has shipped fixes through the MSRC update guide, and independent intelligence (CISA SSVC: exploitation none, automatable no, technical impact partial) reports no active exploitation and no public exploit code identified at time of analysis, making this a low-priority hardening item rather than an urgent response.
Information disclosure in the Windows Win32 kernel subsystem lets an attacker who already holds a low-privilege local account (or equivalent local code-execution context) on a target host read sensitive kernel-maintained information that they should not be able to see. The vulnerability affects default configurations of a broad set of Windows 10 and Windows 11 releases and Windows Server 2012 through 2025 builds that have not yet been updated to the fixed build levels published in Microsoft's advisory; it is not remotely reachable (CVSS AV:L, PR:L) and the high attack complexity (AC:H) means a specific, attacker-uncontrolled kernel condition must be met before information is disclosed, so success is not guaranteed on every attempt and there is no user-interaction step (UI:N). Impact is confined to confidentiality (C:H, I:N, A:N) with no code execution or system modification, and this is confirmed as not actively exploited (CISA SSVC exploitation: none) with no public exploit identified at time of analysis; no EPSS score was supplied with the source data, and vendor-released patches are available.
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions could let an attacker who already holds high privileges on a guest or host bypass a Hyper-V security feature when positioned on the same adjacent network, but the attacker cannot read data or cause availability loss in the assessed vector. No public exploit code was identified at time of analysis, and all available signals - including the SSVC exploitation decision of 'none' and the high attack complexity - indicate low real-world risk despite Hyper-V’s security-sensitive role.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated, low-privileged local attacker to disclose sensitive information from the affected host. Only systems running vulnerable builds of Windows 10, Windows 11, and their corresponding Windows Server editions are affected, and exploitation requires that the attacker already holds a local interactive session on the target machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5). There is no remote attack path: per CISA's SSVC decision framework, exploitation is assessed as none and the vulnerability is not automatable, and no public exploit code has been identified at time of analysis; the confidentiality-only impact and the local-vector prerequisite keep this a moderate-priority issue, most relevant on shared, multi-user, or Remote Desktop hosts where untrusted users can obtain local sessions.
Local information disclosure in the Windows Clipboard User Service allows an attacker who already holds an authenticated, low-privileged logon session on a Windows host to read clipboard data that should not be accessible to that user. Because the vector is AV:L/PR:L with UI:N, the flaw cannot be triggered remotely or by an unauthenticated party - the attacker must first establish a foothold on the machine - and the sole impact is confidentiality loss, with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; CISA's SSVC assessment rates exploitation likelihood as none and the issue is not automatable, which keeps near-term risk moderate.
Information disclosure in the Microsoft Bluetooth Driver allows a locally authenticated attacker with low-level privileges to trigger an out-of-bounds memory read and obtain sensitive data from the affected Windows host. The issue spans an unusually broad servicing footprint covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, and is scored CVSS 5.5 with high confidentiality impact but no integrity or availability impact. There is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation: none), so this rates as a moderate-severity, low-priority hardening item rather than an emergency; Microsoft has already published fixed builds, so remediation is a routine servicing update applied to the Bluetooth driver stack.
Local information disclosure in the Windows Win32K kernel-mode subsystem allows an attacker who already holds a low-privileged, authenticated local session to trigger a use of uninitialized resource and read memory contents that should not be exposed to their privilege level. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is confidentiality-only: it does not by itself grant code execution, privilege escalation, or persistence, but the leaked data can be used to defeat memory-layout protections and support a follow-on attack. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025 (including Server Core) at default configuration, with no special feature or non-default setting required. Microsoft has released fixed builds through the MSRC update guide; there is no public exploit code and CISA's SSVC decision framework records exploitation as 'none', so no public exploit identified at time of analysis.
An out-of-bounds read in the Windows Error Reporting (WER) component of affected Windows client and server builds lets an attacker who already holds low-privileged local access on the host read memory beyond the bounds of an allocated buffer, resulting in disclosure of potentially sensitive information from the affected process's address space. The flaw carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-125, meaning the sole impact is confidentiality - the bug cannot by itself modify data or cause a denial of service. There is no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and CISA KEV does not list this issue. This is a genuinely moderate, low-priority issue rather than an urgent threat: the attack surface is local-only, requires existing authenticated access and the ability to drive the vulnerable code path through WER, and yields information disclosure rather than code execution.
Local information disclosure in the Windows NTFS driver lets an authenticated, low-privileged user trigger an out-of-bounds read that exposes kernel memory contents on unpatched Windows 10, Windows 11 and Windows Server builds. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is only reachable after an attacker already has a local foothold on the host, and it yields confidentiality impact alone with no integrity or availability effect. Microsoft has published a vendor patch, CISA's SSVC evaluation records no exploitation and no automation, and no public exploit code has been identified at time of analysis, so this is a genuine but low-urgency issue that matters mainly as a post-compromise or chained-attack primitive rather than a standalone remote threat.
Heap corruption in the Windows Kernel lets an attacker who already holds local, low-privileged code execution on a target host escalate to higher privileges; the authoritative assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning full confidentiality, integrity and availability impact on the compromised machine, while NVD's published base score of 5.5 reflects availability impact only. All supported Windows 10 (21H2 and 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 builds below the vendor-fixed levels are affected, and exploitation requires an existing local, authenticated foothold as a low-privileged user (PR:L, AV:L) with no user interaction (UI:N) and low complexity (AC:L) beyond reaching the vulnerable kernel code path. Microsoft has shipped patches per its update guide, CISA's SSVC decision framework records exploitation as none, and no public exploit code has been identified at time of analysis, so this is a moderate-priority post-compromise escalation primitive rather than an initial-access or remotely reachable flaw.
Local information disclosure in the Windows Print Spooler allows an authenticated, low-privileged user (CVSS PR:L, AV:L) to read memory beyond the bounds of a buffer handled by the printing subsystem, which runs by default on Windows client and server editions. Affected builds are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 that predate the fixed build levels published in the vendor update (for example Windows 11 24H2 before 10.0.26100.9711 and Windows Server 2025 before 10.0.26100.33650). The issue is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N) and no user interaction required; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity, making this a moderate-severity, low-priority issue under real-world scrutiny, with vendor patches available.
Information disclosure in the Windows Event Logging Service allows an authenticated, low-privileged local user to read leftover uninitialized memory from the service, potentially exposing data belonging to other processes or system structures. Every listed Windows 10 and Windows 11 release and Windows Server 2012 through 2025 edition (including Server Core installations) is affected below its patched build number, but exploitation requires the attacker to already have a valid local account plus the ability to execute code on the host - it cannot be triggered remotely or without credentials. Microsoft has published fixes through the MSRC update guide, no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and the assessed 5.5 CVSS reflects confidentiality-only impact with no integrity or availability effect.
Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally authenticated attacker with only low privileges to read data from an uninitialized resource, potentially exposing kernel memory contents that were never cleared before use. Exploitation requires a prior local foothold on an affected host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base score 5.5) and affects only the pre-patch builds enumerated in EUVD-2026-99961, such as Windows Server 2022 below 10.0.20348.5761, Windows 11 24H2 below 10.0.26100.9711, and Windows Server 2012 below 6.2.9200.26434. Impact is confidentiality-only with no integrity or availability effect, CISA's SSVC framework rates the flaw as non-exploited and non-automatable, and no public exploit identified at time of analysis; Microsoft has released a vendor patch. Real-world priority is therefore low-to-moderate despite HTTP.sys being present in essentially every supported Windows installation.
Local information disclosure in the Windows Universal Disk Format file system driver (UDFS, udfs.sys) allows an authenticated low-privilege attacker to read out-of-bounds memory by supplying a maliciously crafted UDF volume - a rogue optical disc, ISO/UDF disk image, or removable/mounted device - that the targeted host then mounts and parses. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5): exploitation requires an existing local authenticated session, there is no remote vector and no victim user interaction, and impact is confined to confidentiality with no integrity or availability loss. Microsoft has shipped fixes per its advisory, CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation 'no' and partial technical impact, and no public exploit code was identified at time of analysis - making this a genuinely moderate, low-urgency issue rather than a top-tier priority.
Local privilege escalation in Windows NTFS lets an authenticated attacker with local access to an affected Windows host trigger a use-after-free in the NTFS file system driver, which can lead to high-integrity code execution in kernel context and elevation to SYSTEM. The issue affects specific Windows 11 24H2, 25H2, and 26H1 builds and Windows Server 2025 (including Server Core) below the fixed builds listed in the Microsoft advisory. CVSS base score is 6.7, it is not in CISA KEV, and no public exploit identified at time of analysis; SSVC records exploitation as none and automatable as no, keeping the practical risk moderate and requiring a local foothold.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally positioned attacker who already holds low-privileged code execution on a target host to read sensitive system memory information that should be restricted to a higher privilege sphere. The flaw requires local access and existing low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5), needs no user interaction, and affects default installations of the listed Windows client and server builds because HTTP.sys is a core OS component; a remote, unauthenticated attacker cannot trigger it directly. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and Microsoft has shipped vendor fixes - making this a moderate, low-urgency hardening item rather than an emergency patch.
Adjacent-network denial of service in the Windows Wi-Fi driver affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, where a crafted 802.11 frame reaching the wireless stack triggers an out-of-bounds read (CWE-125) that can crash the driver and render the wireless connection unavailable. Per the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no authentication and no user interaction are required, and unauthenticated attackers within Wi-Fi radio range - on the same wireless LAN, a shared hotspot, or a rogue access point - can reach the target, making this a moderate-severity availability issue rather than a remotely exploitable internet-facing one. No public exploit code has been identified at the time of analysis (CISA SSVC: Exploitation=none, Automatable=no), though the vendor has released patched builds, and the impact is confined to availability with no assessed data exposure or code execution.
Local tampering of Windows Modern Device Management (MDM) state is possible on affected Windows 10, Windows 11, and Windows Server builds, because a TOCTOU race condition (CWE-367) lets an attacker who already holds an authenticated low-privileged local account alter a resource in the window between its validation and its use. Exploitation is non-deterministic and typically requires many attempts (CVSS 4.7, AV:L/AC:H/PR:L/UI:N), there is no remote vector and no user-interaction requirement, and impact is confined to integrity (I:H) with no confidentiality or availability effect. Microsoft has shipped fixes and CISA's SSVC assessment records no observed exploitation and no automatable path, so this ranks as a genuinely low-priority issue; no public exploit code has been identified at time of analysis.
Information disclosure via use of an uninitialized resource in the Microsoft Windows Event Logging Service allows a locally authenticated attacker holding only low privileges (PR:L) to read stale memory contents from the affected service, yielding high confidentiality impact with no integrity or availability effect (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts running unpatched builds of Windows 10, Windows 11, and Windows Server 2012 through 2025 within the version ranges listed in the EUVD advisory are affected, and the flaw cannot be reached remotely - an attacker must already have local code execution and a valid session on the target. Exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit is identified at time of analysis, so real-world urgency is LOW despite the HIGH confidentiality rating; vendor patches are available that eliminate the condition.
An out-of-bounds read in the Microsoft Windows Search Component lets a locally authenticated, low-privileged attacker read memory adjacent to search operations, resulting in information disclosure without any user interaction. Impact is confined to confidentiality (C:H) with no integrity or availability effect, and exploitation requires an existing local session on an affected Windows 10, Windows 11, or Windows Server build - there is no remote or unauthenticated path. No public exploit code and no confirmed active exploitation have been identified (CISA KEV absent; SSVC exploitation: none), and the vendor has released fixed builds, so this is a low-to-moderate priority patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft Windows via the IKE Extension (IKEEXT) service, which can be crashed or disrupted when it processes malformed IKE protocol input, causing a buffer over-read (CWE-126). All supported Windows client and server platforms that ship IKEEXT are affected - including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 through 2025 - but only systems with IPsec/IKE or Windows VPN functionality active and network-reachable are exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an authorized attacker with low-level network access (not anonymous reachability) can cause an availability-only impact; there is no confidentiality or integrity effect and no code execution, and no public exploit has been identified at time of analysis (CISA SSVC: exploitation none, automatable no), making this a moderate-priority patching item rather than an emergency.
An authenticated, network-reachable attacker can disclose files outside the intended directory through absolute path traversal in the Windows Encrypting File System (EFS), tracked as CVE-2026-83683. Only unpatched Windows client and server builds are affected - for example Windows 11 24H2 before 10.0.26100.9711, Windows Server 2022 before 10.0.20348.5761, and legacy platforms back to Windows Server 2012 before 6.2.9200.26434. Exploitation requires the attacker to already hold low-privilege authenticated access (CVSS vector PR:L, AV:N), and the impact is limited to confidentiality (C:H with I:N/A:N), so there is no file modification or denial of service; no public exploit has been identified at time of analysis and CISA's SSVC assessment rates the issue non-automatable, making opportunistic mass exploitation unlikely.
Information disclosure in Microsoft Windows Installer allows an authenticated local attacker holding only low privileges to read sensitive system information that should remain outside their control sphere. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 including Server Core installations, with a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires prior local interactive authentication plus a high-complexity, non-deterministic condition; there is no remote vector, no user interaction, no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available per the Microsoft advisory.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An out-of-bounds read in the Windows WLAN Service lets a locally authenticated attacker disclose information from the host's memory on affected Windows 10, Windows 11 and Windows Server builds. Exploitation requires the attacker to already hold a low-privileged interactive logon or to run code under an existing user token on the target host (CVSS AV:L, PR:L); the issue is not remotely or anonymously reachable, no user interaction is needed (UI:N), and impact is limited to confidentiality (C:H with I:N/A:N), so there is no code execution or system modification. Severity is CVSS 5.5 (MEDIUM), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis; a vendor patch is available and the signal set is consistent with a moderate, low-priority hardening item.
An out-of-bounds read in Active Directory Domain Services (AD DS) on unpatched domain controllers allows an authenticated, low-privileged attacker to crash or hang the directory service over the network, producing a denial of service against domain authentication and directory lookups. The flaw requires a valid domain account or equivalent foothold (CVSS vector PR:L) and no user interaction; success yields only availability impact with no confidentiality or integrity loss (C:N/I:N/A:H, assessed 6.5). No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and non-automatable, and no CISA KEV listing exists, so this is a moderate-priority, availability-only issue affecting a critical infrastructure component rather than an emergency patch case.
Local information disclosure in the Windows Portable Device (WPD) File System driver affects Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 hosts that have not installed the corresponding cumulative update. A type-confusion flaw (CWE-843) lets an attacker who already holds an authenticated, low-privileged local session (CVSS AV:L/PR:L, no user interaction) coerce the driver into treating one object type as another and read memory the caller should not be able to access, yielding high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). There is no network vector, no public exploit identified at time of analysis, and CISA SSVC rates the issue non-automatable with only partial technical impact, so it is best treated as a moderate-priority local information-leak primitive to be fixed on a normal patch cycle rather than as an emergency.
Local information disclosure in Windows Error Reporting (WER) allows an authenticated low-privileged attacker with an existing session on a Windows host to read report data that should be restricted from their privilege level, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) under CWE-862 missing authorization. The impact is confidentiality-only: no data is modified and availability is unaffected, and because the vector is local there is no network path to exploit it, so the attacker must first hold valid low-privileged credentials or a running session on the machine. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', but vendor patches are available for the affected Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 builds listed in EUVD-2026-99319.
Tampering with device-management configuration on Windows is possible because the Windows Modern Device Management (MDM) stack fails to enforce an authentication/authorization check on a critical function (CWE-306). Exploitation requires an attacker to already hold authenticated local access (CVSS PR:L) on an affected Windows 10, Windows 11, or Windows Server host, and the high attack complexity rating (AC:H) indicates an additional constraint such as specific system state, ordering, or a timing window the attacker cannot fully control; the resulting impact is limited to integrity (I:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with 'not automatable', and no KEV listing applies, so this should be treated as a moderate, post-foothold local tampering issue rather than a remotely exploitable emergency; a vendor patch is available.
An authenticated, network-positioned attacker can force an out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS), crashing the service and producing a denial of service on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The vulnerability is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so low-privilege valid credentials and network reachability are prerequisites; unauthenticated attackers cannot exploit it per the assessed vector, and the impact is confined to availability with no confidentiality or integrity consequence. Microsoft has published fixes via its update guide, CISA's SSVC assessment rates exploitation as none, and there is no public exploit identified at time of analysis - making this a moderate-severity, low-urgency patch-cycle item rather than an emergency.
Null pointer dereference in Microsoft's Active Directory Domain Services (AD DS) lets an attacker who already holds valid low-privilege domain credentials crash the service over the network, yielding a denial of service scored CVSS 6.5 with availability impact only (C:N/I:N/A:H). Exploitation requires an authenticated session (PR:L) with no user interaction (UI:N) and low attack complexity (AC:L), so the realistic threat is an insider or a holder of previously compromised credentials targeting a reachable domain controller; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. This is a medium-severity, authenticated DoS that should be treated as a routine patch-cycle item rather than an emergency, and vendor patches are available for every affected Windows Server 2022/2025 and Windows 10/11 build listed in ENISA EUVD-2026-99312.
A null pointer dereference in Microsoft Windows Hyper-V allows an attacker who already holds low-privileged local access to crash the hypervisor or its host, producing a denial-of-service condition. Only hosts with the Hyper-V role enabled are exposed, the vector is local-only, and impact is confined to availability with no confidentiality or integrity loss; affected builds span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations. Vendor patches are available for all listed builds, no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none, with no KEV listing.
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
Local information disclosure in the Windows Update Orchestrator Service allows an authenticated attacker with low-level privileges to read files they could not otherwise access by exploiting a link-following flaw (CWE-59). The attacker must create a symbolic link or junction in a location resolved by the privileged service, which then accesses the linked file with higher privileges. This vulnerability affects various unpatched Windows 10, Windows 11, and Windows Server versions; Microsoft has released patches, and no public exploit identified at time of analysis (CISA SSVC exploitation: none). CVSS 5.5 (Medium) reflects the local-only, authenticated vector with confidentiality-only impact.
Windows SmartScreen on Windows 11 (versions 23H2, 24H2, 25H2 and 26H1) can be driven into disclosing local information through a time-of-check time-of-use (TOCTOU) race condition, but only by an attacker who already holds a low-privileged, authenticated local session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7). The high attack complexity is the dominant constraint: the attacker must reliably win a narrow, non-deterministic timing window that they do not control, which is why CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code was identified at time of analysis. Impact is limited to confidentiality on the local host, with no remote path, no privilege escalation, and no integrity or availability effect; a vendor patch is available via the Microsoft MSRC update guide, and this should be treated as a low-to-moderate priority fix rather than an emergency despite the CRITICAL-looking confidentiality sub-score.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.
Local privilege-based security-feature bypass in the Windows Update Orchestrator Service (UsoSvc): an attacker who already holds a foothold and at least low-level user privileges on an affected Windows host can present hard-coded credentials to defeat a protection mechanism of the service. Because the hard-coded secret is embedded in the component rather than derived per-install, any local user who can invoke the service can reuse it, with the resulting impact limited to integrity (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N) - no confidentiality loss or denial of service. All supported Windows client and server branches below their respective patched builds are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022 and Windows Server 2025; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, and Microsoft has released patched builds.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
Incorrect authorization in Windows Hello allows a locally positioned attacker who already holds high privileges on the host (CVSS PR:H) to bypass the Windows Hello security feature and read data that the feature is meant to protect, resulting in a confidentiality-only impact (C:H, I:N, A:N) and a base score of 4.4. The flaw is local-only (AV:L), low complexity (AC:L), and requires no user interaction (UI:N), so it presupposes pre-existing elevated access to the machine and that Windows Hello is actually in use as the bypassed control; unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds are affected. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Microsoft has published vendor patches that resolve the affected builds via the MSRC update guide.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
Spoofing of Windows Event Tracing (ETW) telemetry on affected Windows 11 and Windows Server 2025 hosts allows a locally authenticated, low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) to falsify event data, undermining the integrity of logs and monitoring without reading protected data or causing denial of service. Only hosts below the vendor's fixed builds are impacted - Windows 11 24H2/25H2 (10.0.26100.9711 / 10.0.26200.9711), Windows 11 26H1 (10.0.28000.3231), Windows 11 26H2 (10.0.26300.9711) and Windows Server 2025 including Server Core (10.0.26100.33650) - and exploitation additionally requires an attacker to already hold a valid low-privileged local account, so realistic exposure is largely insiders or intruders who have already obtained a foothold. There is no public exploit identified at time of analysis; SSVC rates exploitation as 'none' and automatable as 'no', and vendor patches are available.
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
Information disclosure in the Windows Print Spooler on affected client and server editions lets an authenticated local user obtain uninitialized memory contents from spooler components, potentially exposing residual sensitive data held by a privileged process. The flaw is rated 5.5 (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation is strictly local, requires a valid low-privileged account with local code execution or session access, needs no user interaction, and cannot be triggered remotely or by an unauthenticated attacker. Exploitation against CVE-2026-85320 is not currently observed, no public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, so exposure is concentrated in shared multi-user hosts such as RDP servers, terminal servers and jump boxes; Microsoft has released patches.
Improper authorization logic in the Windows SMB Client lets an authenticated local user bypass a Windows security feature, yielding a high-integrity impact on the affected system (CVE-2026-84011, CVSS 5.5). Exploitation requires an attacker to already hold valid low-privileged credentials and local code execution on the host (CVSS vector AV:L/PR:L/UI:N), so this is a post-compromise privilege-context escalation rather than a remotely reachable flaw; no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis and CISA SSVC rates exploitation as "none" with the issue considered non-automatable; Microsoft has released fixed builds for all affected Windows 11 and Windows Server 2022/2025 editions.
Local tampering in the Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker who already holds a foothold on the machine to win a time-of-check time-of-use race and alter data the component is handling. The flaw is scored CVSS v3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) - it is not remotely reachable, requires local authenticated access, and is gated by high attack complexity, so success depends on repeatedly hitting a narrow race window rather than a single deterministic action, with the only impact being a high integrity/tampering effect and no confidentiality or availability loss. No public exploit has been identified at time of analysis - there is no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable - while Microsoft has published a fix, making this a low-to-moderate priority patching item rather than an emergency.
Improper link resolution in the Windows Update Orchestrator Service allows a locally authenticated, low-privileged attacker to read files they would not otherwise be permitted to access on Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2022/2025. Because the service runs as SYSTEM and dereferences filesystem paths without validating reparse points, an attacker who already holds a foothold can plant a symbolic link, junction or hard link and race the service into opening a protected file, yielding high-confidentiality information disclosure with no integrity or availability impact (CVSS 5.5). Exploitation is assessed as non-automatable under CISA's SSVC framework, no public exploit code has been identified at time of analysis, and overall risk is comparatively low-priority given the local, post-compromise prerequisites.
Improper certificate validation in Windows Hello lets an attacker who already holds high local privileges on an affected Windows host bypass the feature's certificate-based authentication check, exposing credential material that Windows Hello would otherwise protect (confidentiality impact only). The defect is strictly local - there is no network attack path and no user interaction is required - and it affects Windows 10, Windows 11 and Windows Server builds below their respective patched levels, including Windows 11 24H2 (below 10.0.26100.9711) and Windows Server 2025 (below 10.0.26100.33650). Exploitation has not been observed: CISA's SSVC assessment records exploitation status 'none' and automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity issue best handled by routine patching rather than emergency response.
Information disclosure in the Windows Kernel allows an authenticated attacker who can already execute code locally on a vulnerable host to read sensitive data that the kernel fails to properly initialize or sanitize before exposing it (CWE-497). Exploitation is not remotely reachable: the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N requires local authenticated access plus code execution, and the high attack complexity means the attacker must both reach the specific kernel code path and satisfy timing/memory-state conditions to capture meaningful leaked content rather than zeroes or stale noise. Impact is strictly confidentiality (C:H with I:N/A:N) and stays within the current security context (S:U) rather than escalating privileges; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, making this a genuinely low-priority item despite the HIGH confidentiality metric. All supported Windows 10, Windows 11, and Windows Server builds up to the January-class update thresholds listed by EUVD are affected, and vendor patches are available.
Information disclosure in the Windows Win32 kernel subsystem allows an authenticated local attacker holding low-level privileges to read sensitive system data that should be confined to a more privileged control sphere. Unpatched Windows 10, Windows 11 and Windows Server builds are affected, and triggering the flaw requires local interactive or code-execution access plus a hard-to-control precondition, which is why the vendor scores it only 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N - confidentiality impact only, no integrity or availability loss). No public exploit was identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and vendor-released patches are available from Microsoft.
Local information disclosure in Microsoft Windows Hello allows an attacker who already holds low-privileged authenticated access on a Windows 10 or Windows 11 host to read sensitive system data that should be outside their control sphere. Exploitation requires local interactive access (AV:L, PR:L), involves no victim user interaction (UI:N), and yields only confidentiality impact - no code execution, tampering, or denial of service - which is why our assessment rates this a genuine but comparatively low-priority issue rather than an urgent one. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, SSVC rates it not automatable, and Microsoft has released fixed build floors for every affected branch.
Spoofing in Windows Shell allows unauthenticated remote attackers to impersonate trusted content by exploiting an incorrectly implemented authentication algorithm (CWE-303), requiring the victim to interact with attacker-supplied content (UI:R). Affects Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core installation) on builds prior to the patched versions, with high confidentiality impact but no integrity or availability loss. No public exploit identified at time of analysis (CISA SSVC: Exploitation none).
Information disclosure in the Windows Shell lets an attacker who already holds a valid low-privileged local account on a Windows host read sensitive system information that should fall outside that account's access sphere. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms this is not remotely reachable, requires an authenticated local logon, needs no user interaction, and is gated by high attack complexity such as a race condition or a specific system state the attacker must win, so reliability is limited; only confidentiality is affected. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC records Exploitation: none, Automatable: no), and the patch is available from the vendor, making this a low-to-moderate priority issue despite the critical confidentiality rating.
An out-of-bounds read in the Windows HID Parser Library (hidparse.sys) allows an attacker who already holds low-privileged local access to read beyond the bounds of a buffer and disclose kernel memory contents to user space, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is local only - the attacker must be authenticated on the host and must cause the parser to process a malformed HID report descriptor, typically by attaching or emulating a crafted USB or Bluetooth HID device - and the result is read-only information disclosure with no code execution or system modification. No public exploit has been identified at time of analysis, CISA SSVC records no observed exploitation and rates the issue non-automatable with partial technical impact, and a vendor patch is available from Microsoft (MSRC update guide, EUVD-2026-100040).
An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.
Information disclosure in the Windows Win32 Kernel Subsystem allows an authenticated local user who can already execute code on the host to read sensitive system information that should remain outside their control. Exploitation is gated by a hard-to-satisfy, attacker-uncontrollable condition (CVSS AC:H), so the flaw is unreliable to trigger, and the impact is confidentiality-only with no integrity or availability loss. There is no CISA KEV listing and no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for every affected Windows client and server branch, making this a genuinely low-priority, moderate-severity issue despite the ubiquity of the platform.
Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.
Local information disclosure in the Windows Clipboard User Service lets an authenticated attacker who already holds a low-privileged foothold on the host read sensitive system information the service is meant to keep segregated (CVSS 3.1 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - integrity and availability are untouched - and exploitation requires valid local credentials, so it cannot be reached remotely or by an unauthenticated actor. Microsoft has published fixes for all supported Windows client and server branches; no public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none, automatable: no, technical impact: partial), making this a moderate, low-priority hardening item.
Local information disclosure in the Windows HID Parser Library (CWE-125, out-of-bounds read) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019/2022/2025, allowing a low-privileged local actor to read memory beyond an intended buffer and potentially disclose sensitive data. Successful exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) plus the ability to get the parser to process attacker-influenced HID descriptor or report data, for example via an attached or emulated USB HID device; integrity and availability are unaffected. The issue is rated moderate rather than high priority: there is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available from Microsoft.
Out-of-bounds read in the Windows HID Parser Library lets an attacker who already holds authenticated local access to a Windows host read beyond the bounds of a parser buffer by supplying a crafted or emulated HID input (for example a malicious USB HID device or a malformed HID report descriptor), resulting in local information disclosure. The affected component is only reachable after local authentication and requires attacker-controlled HID traffic, and the outcome is limited to confidentiality loss (C:H) with no integrity or availability impact and no scope change, so this is a genuine but comparatively low-urgency issue. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as "none" and the issue as non-automatable, and vendor-released patches are available in the form of the Windows build updates listed below.
Spoofing of data protected by the Windows Virtualization-Based Security (VBS) Enclave is possible for a local attacker who already holds a low-privileged foothold on the machine, because the enclave relies on encryption of insufficient strength. Exploitation requires the VBS Enclave feature to be in use and is constrained by high attack complexity (AC:H) and non-automatable conditions per SSVC, and it yields integrity/spoofing impact only (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; severity is moderate (CVSS 5.6) and a vendor patch is available.
An out-of-bounds read in the Windows HID Parser Library lets a locally present, low-privileged authenticated attacker disclose information from the affected system's memory by supplying a malformed HID descriptor or report to the parser. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and yields confidentiality impact only - no code execution, no privilege escalation, and no integrity or availability effect - though leaked memory contents could assist follow-on attacks. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and Microsoft has published a patch; exploitation requires an existing local foothold plus the ability to feed crafted HID data (physical, emulated, or virtual HID device).
An out-of-bounds read in the Windows HID Parser Library allows an attacker who already holds a valid local session on an affected Windows host to disclose memory contents by supplying crafted or malformed HID descriptor data (for example via an emulated or malicious USB/Bluetooth HID device, or a local process feeding HID input). Exploitation requires local access and low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in information disclosure only - no code execution, integrity, or availability impact - and no public exploit was identified at time of analysis, with CISA's SSVC rating exploitation as none and the flaw as non-automatable. Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server editions, so this is a moderate, not urgent, priority that is resolved by applying current cumulative updates.
Local information disclosure in the Windows Aggregated Data Platform Service allows an authenticated, low-privileged user on an affected Windows 11 host to read past the bounds of an in-memory buffer and potentially expose sensitive data that the account would not otherwise be entitled to see. Only unpatched Windows 11 builds - 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H2 below 10.0.26300.9711, and 26H1 below 10.0.28000.3231 - are affected; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5) confirms the attacker must already hold a local account and that no integrity or availability impact is possible. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and no EPSS score was supplied; the mandatory local foothold keeps this a moderate-severity, patch-cycle item rather than an emergency.
Local file tampering through a relative path traversal flaw in Windows WinINet (wininet.dll) requires an attacker to already hold authenticated, low-privileged access to the machine and to satisfy a high-complexity precondition, so it cannot be triggered remotely and carries no confidentiality or availability impact. All supported Windows client and server branches are affected - Windows 10 and 11 releases plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - up to the fixed build numbers published in Microsoft's update guide. No public exploit code has been identified, CISA's SSVC assessment records exploitation as 'none', and Microsoft rates the issue Medium (CVSS 4.7), making it a routine patch-cycle item rather than an emergency.
Information disclosure in Microsoft Windows NTFS lets an attacker who already holds low-privileged local access on a target machine bypass access control checks and read file data they are not authorized to view (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no ability to modify data or cause a denial of service. The local-access prerequisite is the key limiting factor - there is no remote or network-facing attack path, and no user interaction is required once a foothold exists, so this is a post-compromise privilege-escalation-of-information concern rather than an entry point. No public exploit code or confirmed active exploitation was identified at the time of analysis (CISA SSVC: Exploitation none, Automatable no), and the vendor has released patches, making this a moderate-priority patch-and-move-on item - not an emergency - for environments that cannot already be reached by a local standard user.
Information disclosure in the Microsoft Windows Notification component allows a locally authenticated, low-privileged user to read information outside their intended authorization boundary. The underlying weakness is improper/missing access control (CWE-306), exploitable only by an attacker who already holds interactive local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with impact confined to confidentiality (C:H) and no integrity or availability effect and no privilege escalation. This is a moderate-severity issue (CVSS 5.5) that is not known to be actively exploited and for which no public exploit code was identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none', the attack as non-automatable, and technical impact as partial, while Microsoft has published vendor patches fixing the affected builds.
Information disclosure in Windows Hello allows an authenticated local attacker with low privileges to read out-of-bounds memory and expose potentially sensitive data on affected Windows 10 and Windows 11 systems. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) confirms a local, authenticated, low-privilege attack with no user interaction and impact limited to confidentiality. CISA SSVC rates exploitation as none and automatable as no; no public exploit was identified at time of analysis, and Microsoft has a vendor patch available.
A local information-disclosure flaw in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged local access on a Windows host to trigger a buffer over-read and read beyond the bounds of a kernel buffer, exposing memory contents (CVSS 5.5, C:H/I:N/A:N). Exploitation requires local authenticated access (AV:L/PR:L) with no user interaction, but does not yield code execution or system compromise; the attack surface is strictly local. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Microsoft has released patched builds addressing the affected CLFS driver versions.
Spoofing of update content in the Windows Update Stack on Windows 10, Windows 11, and Windows Server allows a locally authenticated attacker (AV:L, PR:L) to bypass cryptographic signature verification and modify update artifacts, yielding integrity impact (CVSS 5.5). Vendor-released cumulative updates fix the flaw; no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows Portable Device MTP (Media Transfer Protocol) driver lets a locally authenticated attacker disclose memory contents from the host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The attacker must already hold a local account or code-execution foothold on the machine and must be able to present a portable device (physical, emulated, or over a bridged interface) that issues crafted MTP requests to the vulnerable driver; no victim user interaction is required. Exploitation status is limited: CISA SSVC reports no known or expected exploitation and no public exploit code was identified at time of analysis, so this is a routine patch-cycle priority rather than an emergency. A vendor patch is available and the affected build list spans Windows 10, Windows 11, and Windows Server 2012 through 2025.
Physical attackers can read out-of-bounds kernel memory through the Windows RNDIS (Remote NDIS) driver, which mishandles attacker-supplied RNDIS protocol data presented over USB. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. The CVSS vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6), so no authentication or user interaction is needed once the attacker has physical access, but remote or network-based exploitation is not possible and impact is confined to information disclosure with no code execution, integrity, or availability effect; there is no public exploit identified at time of analysis and CISA SSVC records Exploitation: none with Automatable: no, so this is a genuinely low-priority issue despite the HIGH confidentiality rating. Practical risk is limited to kiosks, shared or unattended machines, and evil-maid scenarios where an untrusted party can plug in a device.
Information disclosure in the Windows NTFS file system driver lets a locally authenticated low-privilege user read sensitive data that leaks out through error messages when the filesystem is driven into a specific fault condition. Only hosts running the affected Windows client and server builds are exposed, and because the assessed vector is AV:L/AC:H/PR:L/UI:N the issue is neither remotely reachable nor anonymous: the attacker must already hold local, authenticated low-privilege access and must hit a precise, difficult-to-control race or system state, with impact confined to confidentiality (C:H/I:N/A:N). Microsoft has shipped fixes through the MSRC update guide, and independent intelligence (CISA SSVC: exploitation none, automatable no, technical impact partial) reports no active exploitation and no public exploit code identified at time of analysis, making this a low-priority hardening item rather than an urgent response.
Information disclosure in the Windows Win32 kernel subsystem lets an attacker who already holds a low-privilege local account (or equivalent local code-execution context) on a target host read sensitive kernel-maintained information that they should not be able to see. The vulnerability affects default configurations of a broad set of Windows 10 and Windows 11 releases and Windows Server 2012 through 2025 builds that have not yet been updated to the fixed build levels published in Microsoft's advisory; it is not remotely reachable (CVSS AV:L, PR:L) and the high attack complexity (AC:H) means a specific, attacker-uncontrolled kernel condition must be met before information is disclosed, so success is not guaranteed on every attempt and there is no user-interaction step (UI:N). Impact is confined to confidentiality (C:H, I:N, A:N) with no code execution or system modification, and this is confirmed as not actively exploited (CISA SSVC exploitation: none) with no public exploit identified at time of analysis; no EPSS score was supplied with the source data, and vendor-released patches are available.
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions could let an attacker who already holds high privileges on a guest or host bypass a Hyper-V security feature when positioned on the same adjacent network, but the attacker cannot read data or cause availability loss in the assessed vector. No public exploit code was identified at time of analysis, and all available signals - including the SSVC exploitation decision of 'none' and the high attack complexity - indicate low real-world risk despite Hyper-V’s security-sensitive role.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated, low-privileged local attacker to disclose sensitive information from the affected host. Only systems running vulnerable builds of Windows 10, Windows 11, and their corresponding Windows Server editions are affected, and exploitation requires that the attacker already holds a local interactive session on the target machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5). There is no remote attack path: per CISA's SSVC decision framework, exploitation is assessed as none and the vulnerability is not automatable, and no public exploit code has been identified at time of analysis; the confidentiality-only impact and the local-vector prerequisite keep this a moderate-priority issue, most relevant on shared, multi-user, or Remote Desktop hosts where untrusted users can obtain local sessions.
Local information disclosure in the Windows Clipboard User Service allows an attacker who already holds an authenticated, low-privileged logon session on a Windows host to read clipboard data that should not be accessible to that user. Because the vector is AV:L/PR:L with UI:N, the flaw cannot be triggered remotely or by an unauthenticated party - the attacker must first establish a foothold on the machine - and the sole impact is confidentiality loss, with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; CISA's SSVC assessment rates exploitation likelihood as none and the issue is not automatable, which keeps near-term risk moderate.
Information disclosure in the Microsoft Bluetooth Driver allows a locally authenticated attacker with low-level privileges to trigger an out-of-bounds memory read and obtain sensitive data from the affected Windows host. The issue spans an unusually broad servicing footprint covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, and is scored CVSS 5.5 with high confidentiality impact but no integrity or availability impact. There is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation: none), so this rates as a moderate-severity, low-priority hardening item rather than an emergency; Microsoft has already published fixed builds, so remediation is a routine servicing update applied to the Bluetooth driver stack.
Local information disclosure in the Windows Win32K kernel-mode subsystem allows an attacker who already holds a low-privileged, authenticated local session to trigger a use of uninitialized resource and read memory contents that should not be exposed to their privilege level. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is confidentiality-only: it does not by itself grant code execution, privilege escalation, or persistence, but the leaked data can be used to defeat memory-layout protections and support a follow-on attack. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025 (including Server Core) at default configuration, with no special feature or non-default setting required. Microsoft has released fixed builds through the MSRC update guide; there is no public exploit code and CISA's SSVC decision framework records exploitation as 'none', so no public exploit identified at time of analysis.
An out-of-bounds read in the Windows Error Reporting (WER) component of affected Windows client and server builds lets an attacker who already holds low-privileged local access on the host read memory beyond the bounds of an allocated buffer, resulting in disclosure of potentially sensitive information from the affected process's address space. The flaw carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-125, meaning the sole impact is confidentiality - the bug cannot by itself modify data or cause a denial of service. There is no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and CISA KEV does not list this issue. This is a genuinely moderate, low-priority issue rather than an urgent threat: the attack surface is local-only, requires existing authenticated access and the ability to drive the vulnerable code path through WER, and yields information disclosure rather than code execution.
Local information disclosure in the Windows NTFS driver lets an authenticated, low-privileged user trigger an out-of-bounds read that exposes kernel memory contents on unpatched Windows 10, Windows 11 and Windows Server builds. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is only reachable after an attacker already has a local foothold on the host, and it yields confidentiality impact alone with no integrity or availability effect. Microsoft has published a vendor patch, CISA's SSVC evaluation records no exploitation and no automation, and no public exploit code has been identified at time of analysis, so this is a genuine but low-urgency issue that matters mainly as a post-compromise or chained-attack primitive rather than a standalone remote threat.
Heap corruption in the Windows Kernel lets an attacker who already holds local, low-privileged code execution on a target host escalate to higher privileges; the authoritative assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning full confidentiality, integrity and availability impact on the compromised machine, while NVD's published base score of 5.5 reflects availability impact only. All supported Windows 10 (21H2 and 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 builds below the vendor-fixed levels are affected, and exploitation requires an existing local, authenticated foothold as a low-privileged user (PR:L, AV:L) with no user interaction (UI:N) and low complexity (AC:L) beyond reaching the vulnerable kernel code path. Microsoft has shipped patches per its update guide, CISA's SSVC decision framework records exploitation as none, and no public exploit code has been identified at time of analysis, so this is a moderate-priority post-compromise escalation primitive rather than an initial-access or remotely reachable flaw.
Local information disclosure in the Windows Print Spooler allows an authenticated, low-privileged user (CVSS PR:L, AV:L) to read memory beyond the bounds of a buffer handled by the printing subsystem, which runs by default on Windows client and server editions. Affected builds are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 that predate the fixed build levels published in the vendor update (for example Windows 11 24H2 before 10.0.26100.9711 and Windows Server 2025 before 10.0.26100.33650). The issue is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N) and no user interaction required; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity, making this a moderate-severity, low-priority issue under real-world scrutiny, with vendor patches available.
Information disclosure in the Windows Event Logging Service allows an authenticated, low-privileged local user to read leftover uninitialized memory from the service, potentially exposing data belonging to other processes or system structures. Every listed Windows 10 and Windows 11 release and Windows Server 2012 through 2025 edition (including Server Core installations) is affected below its patched build number, but exploitation requires the attacker to already have a valid local account plus the ability to execute code on the host - it cannot be triggered remotely or without credentials. Microsoft has published fixes through the MSRC update guide, no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and the assessed 5.5 CVSS reflects confidentiality-only impact with no integrity or availability effect.
Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally authenticated attacker with only low privileges to read data from an uninitialized resource, potentially exposing kernel memory contents that were never cleared before use. Exploitation requires a prior local foothold on an affected host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base score 5.5) and affects only the pre-patch builds enumerated in EUVD-2026-99961, such as Windows Server 2022 below 10.0.20348.5761, Windows 11 24H2 below 10.0.26100.9711, and Windows Server 2012 below 6.2.9200.26434. Impact is confidentiality-only with no integrity or availability effect, CISA's SSVC framework rates the flaw as non-exploited and non-automatable, and no public exploit identified at time of analysis; Microsoft has released a vendor patch. Real-world priority is therefore low-to-moderate despite HTTP.sys being present in essentially every supported Windows installation.
Local information disclosure in the Windows Universal Disk Format file system driver (UDFS, udfs.sys) allows an authenticated low-privilege attacker to read out-of-bounds memory by supplying a maliciously crafted UDF volume - a rogue optical disc, ISO/UDF disk image, or removable/mounted device - that the targeted host then mounts and parses. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5): exploitation requires an existing local authenticated session, there is no remote vector and no victim user interaction, and impact is confined to confidentiality with no integrity or availability loss. Microsoft has shipped fixes per its advisory, CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation 'no' and partial technical impact, and no public exploit code was identified at time of analysis - making this a genuinely moderate, low-urgency issue rather than a top-tier priority.
Local privilege escalation in Windows NTFS lets an authenticated attacker with local access to an affected Windows host trigger a use-after-free in the NTFS file system driver, which can lead to high-integrity code execution in kernel context and elevation to SYSTEM. The issue affects specific Windows 11 24H2, 25H2, and 26H1 builds and Windows Server 2025 (including Server Core) below the fixed builds listed in the Microsoft advisory. CVSS base score is 6.7, it is not in CISA KEV, and no public exploit identified at time of analysis; SSVC records exploitation as none and automatable as no, keeping the practical risk moderate and requiring a local foothold.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally positioned attacker who already holds low-privileged code execution on a target host to read sensitive system memory information that should be restricted to a higher privilege sphere. The flaw requires local access and existing low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5), needs no user interaction, and affects default installations of the listed Windows client and server builds because HTTP.sys is a core OS component; a remote, unauthenticated attacker cannot trigger it directly. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and Microsoft has shipped vendor fixes - making this a moderate, low-urgency hardening item rather than an emergency patch.
Adjacent-network denial of service in the Windows Wi-Fi driver affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, where a crafted 802.11 frame reaching the wireless stack triggers an out-of-bounds read (CWE-125) that can crash the driver and render the wireless connection unavailable. Per the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no authentication and no user interaction are required, and unauthenticated attackers within Wi-Fi radio range - on the same wireless LAN, a shared hotspot, or a rogue access point - can reach the target, making this a moderate-severity availability issue rather than a remotely exploitable internet-facing one. No public exploit code has been identified at the time of analysis (CISA SSVC: Exploitation=none, Automatable=no), though the vendor has released patched builds, and the impact is confined to availability with no assessed data exposure or code execution.
Local tampering of Windows Modern Device Management (MDM) state is possible on affected Windows 10, Windows 11, and Windows Server builds, because a TOCTOU race condition (CWE-367) lets an attacker who already holds an authenticated low-privileged local account alter a resource in the window between its validation and its use. Exploitation is non-deterministic and typically requires many attempts (CVSS 4.7, AV:L/AC:H/PR:L/UI:N), there is no remote vector and no user-interaction requirement, and impact is confined to integrity (I:H) with no confidentiality or availability effect. Microsoft has shipped fixes and CISA's SSVC assessment records no observed exploitation and no automatable path, so this ranks as a genuinely low-priority issue; no public exploit code has been identified at time of analysis.
Information disclosure via use of an uninitialized resource in the Microsoft Windows Event Logging Service allows a locally authenticated attacker holding only low privileges (PR:L) to read stale memory contents from the affected service, yielding high confidentiality impact with no integrity or availability effect (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts running unpatched builds of Windows 10, Windows 11, and Windows Server 2012 through 2025 within the version ranges listed in the EUVD advisory are affected, and the flaw cannot be reached remotely - an attacker must already have local code execution and a valid session on the target. Exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit is identified at time of analysis, so real-world urgency is LOW despite the HIGH confidentiality rating; vendor patches are available that eliminate the condition.
An out-of-bounds read in the Microsoft Windows Search Component lets a locally authenticated, low-privileged attacker read memory adjacent to search operations, resulting in information disclosure without any user interaction. Impact is confined to confidentiality (C:H) with no integrity or availability effect, and exploitation requires an existing local session on an affected Windows 10, Windows 11, or Windows Server build - there is no remote or unauthenticated path. No public exploit code and no confirmed active exploitation have been identified (CISA KEV absent; SSVC exploitation: none), and the vendor has released fixed builds, so this is a low-to-moderate priority patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft Windows via the IKE Extension (IKEEXT) service, which can be crashed or disrupted when it processes malformed IKE protocol input, causing a buffer over-read (CWE-126). All supported Windows client and server platforms that ship IKEEXT are affected - including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 through 2025 - but only systems with IPsec/IKE or Windows VPN functionality active and network-reachable are exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an authorized attacker with low-level network access (not anonymous reachability) can cause an availability-only impact; there is no confidentiality or integrity effect and no code execution, and no public exploit has been identified at time of analysis (CISA SSVC: exploitation none, automatable no), making this a moderate-priority patching item rather than an emergency.
An authenticated, network-reachable attacker can disclose files outside the intended directory through absolute path traversal in the Windows Encrypting File System (EFS), tracked as CVE-2026-83683. Only unpatched Windows client and server builds are affected - for example Windows 11 24H2 before 10.0.26100.9711, Windows Server 2022 before 10.0.20348.5761, and legacy platforms back to Windows Server 2012 before 6.2.9200.26434. Exploitation requires the attacker to already hold low-privilege authenticated access (CVSS vector PR:L, AV:N), and the impact is limited to confidentiality (C:H with I:N/A:N), so there is no file modification or denial of service; no public exploit has been identified at time of analysis and CISA's SSVC assessment rates the issue non-automatable, making opportunistic mass exploitation unlikely.
Information disclosure in Microsoft Windows Installer allows an authenticated local attacker holding only low privileges to read sensitive system information that should remain outside their control sphere. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 including Server Core installations, with a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires prior local interactive authentication plus a high-complexity, non-deterministic condition; there is no remote vector, no user interaction, no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available per the Microsoft advisory.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An out-of-bounds read in the Windows WLAN Service lets a locally authenticated attacker disclose information from the host's memory on affected Windows 10, Windows 11 and Windows Server builds. Exploitation requires the attacker to already hold a low-privileged interactive logon or to run code under an existing user token on the target host (CVSS AV:L, PR:L); the issue is not remotely or anonymously reachable, no user interaction is needed (UI:N), and impact is limited to confidentiality (C:H with I:N/A:N), so there is no code execution or system modification. Severity is CVSS 5.5 (MEDIUM), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis; a vendor patch is available and the signal set is consistent with a moderate, low-priority hardening item.
An out-of-bounds read in Active Directory Domain Services (AD DS) on unpatched domain controllers allows an authenticated, low-privileged attacker to crash or hang the directory service over the network, producing a denial of service against domain authentication and directory lookups. The flaw requires a valid domain account or equivalent foothold (CVSS vector PR:L) and no user interaction; success yields only availability impact with no confidentiality or integrity loss (C:N/I:N/A:H, assessed 6.5). No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and non-automatable, and no CISA KEV listing exists, so this is a moderate-priority, availability-only issue affecting a critical infrastructure component rather than an emergency patch case.
Local information disclosure in the Windows Portable Device (WPD) File System driver affects Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 hosts that have not installed the corresponding cumulative update. A type-confusion flaw (CWE-843) lets an attacker who already holds an authenticated, low-privileged local session (CVSS AV:L/PR:L, no user interaction) coerce the driver into treating one object type as another and read memory the caller should not be able to access, yielding high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). There is no network vector, no public exploit identified at time of analysis, and CISA SSVC rates the issue non-automatable with only partial technical impact, so it is best treated as a moderate-priority local information-leak primitive to be fixed on a normal patch cycle rather than as an emergency.
Local information disclosure in Windows Error Reporting (WER) allows an authenticated low-privileged attacker with an existing session on a Windows host to read report data that should be restricted from their privilege level, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) under CWE-862 missing authorization. The impact is confidentiality-only: no data is modified and availability is unaffected, and because the vector is local there is no network path to exploit it, so the attacker must first hold valid low-privileged credentials or a running session on the machine. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', but vendor patches are available for the affected Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 builds listed in EUVD-2026-99319.
Tampering with device-management configuration on Windows is possible because the Windows Modern Device Management (MDM) stack fails to enforce an authentication/authorization check on a critical function (CWE-306). Exploitation requires an attacker to already hold authenticated local access (CVSS PR:L) on an affected Windows 10, Windows 11, or Windows Server host, and the high attack complexity rating (AC:H) indicates an additional constraint such as specific system state, ordering, or a timing window the attacker cannot fully control; the resulting impact is limited to integrity (I:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with 'not automatable', and no KEV listing applies, so this should be treated as a moderate, post-foothold local tampering issue rather than a remotely exploitable emergency; a vendor patch is available.
An authenticated, network-positioned attacker can force an out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS), crashing the service and producing a denial of service on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The vulnerability is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so low-privilege valid credentials and network reachability are prerequisites; unauthenticated attackers cannot exploit it per the assessed vector, and the impact is confined to availability with no confidentiality or integrity consequence. Microsoft has published fixes via its update guide, CISA's SSVC assessment rates exploitation as none, and there is no public exploit identified at time of analysis - making this a moderate-severity, low-urgency patch-cycle item rather than an emergency.
Null pointer dereference in Microsoft's Active Directory Domain Services (AD DS) lets an attacker who already holds valid low-privilege domain credentials crash the service over the network, yielding a denial of service scored CVSS 6.5 with availability impact only (C:N/I:N/A:H). Exploitation requires an authenticated session (PR:L) with no user interaction (UI:N) and low attack complexity (AC:L), so the realistic threat is an insider or a holder of previously compromised credentials targeting a reachable domain controller; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. This is a medium-severity, authenticated DoS that should be treated as a routine patch-cycle item rather than an emergency, and vendor patches are available for every affected Windows Server 2022/2025 and Windows 10/11 build listed in ENISA EUVD-2026-99312.
A null pointer dereference in Microsoft Windows Hyper-V allows an attacker who already holds low-privileged local access to crash the hypervisor or its host, producing a denial-of-service condition. Only hosts with the Hyper-V role enabled are exposed, the vector is local-only, and impact is confined to availability with no confidentiality or integrity loss; affected builds span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations. Vendor patches are available for all listed builds, no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none, with no KEV listing.
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
Local information disclosure in the Windows Update Orchestrator Service allows an authenticated attacker with low-level privileges to read files they could not otherwise access by exploiting a link-following flaw (CWE-59). The attacker must create a symbolic link or junction in a location resolved by the privileged service, which then accesses the linked file with higher privileges. This vulnerability affects various unpatched Windows 10, Windows 11, and Windows Server versions; Microsoft has released patches, and no public exploit identified at time of analysis (CISA SSVC exploitation: none). CVSS 5.5 (Medium) reflects the local-only, authenticated vector with confidentiality-only impact.
Windows SmartScreen on Windows 11 (versions 23H2, 24H2, 25H2 and 26H1) can be driven into disclosing local information through a time-of-check time-of-use (TOCTOU) race condition, but only by an attacker who already holds a low-privileged, authenticated local session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7). The high attack complexity is the dominant constraint: the attacker must reliably win a narrow, non-deterministic timing window that they do not control, which is why CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code was identified at time of analysis. Impact is limited to confidentiality on the local host, with no remote path, no privilege escalation, and no integrity or availability effect; a vendor patch is available via the Microsoft MSRC update guide, and this should be treated as a low-to-moderate priority fix rather than an emergency despite the CRITICAL-looking confidentiality sub-score.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.
Local privilege-based security-feature bypass in the Windows Update Orchestrator Service (UsoSvc): an attacker who already holds a foothold and at least low-level user privileges on an affected Windows host can present hard-coded credentials to defeat a protection mechanism of the service. Because the hard-coded secret is embedded in the component rather than derived per-install, any local user who can invoke the service can reuse it, with the resulting impact limited to integrity (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N) - no confidentiality loss or denial of service. All supported Windows client and server branches below their respective patched builds are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022 and Windows Server 2025; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, and Microsoft has released patched builds.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
Incorrect authorization in Windows Hello allows a locally positioned attacker who already holds high privileges on the host (CVSS PR:H) to bypass the Windows Hello security feature and read data that the feature is meant to protect, resulting in a confidentiality-only impact (C:H, I:N, A:N) and a base score of 4.4. The flaw is local-only (AV:L), low complexity (AC:L), and requires no user interaction (UI:N), so it presupposes pre-existing elevated access to the machine and that Windows Hello is actually in use as the bypassed control; unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds are affected. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Microsoft has published vendor patches that resolve the affected builds via the MSRC update guide.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
Spoofing of Windows Event Tracing (ETW) telemetry on affected Windows 11 and Windows Server 2025 hosts allows a locally authenticated, low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) to falsify event data, undermining the integrity of logs and monitoring without reading protected data or causing denial of service. Only hosts below the vendor's fixed builds are impacted - Windows 11 24H2/25H2 (10.0.26100.9711 / 10.0.26200.9711), Windows 11 26H1 (10.0.28000.3231), Windows 11 26H2 (10.0.26300.9711) and Windows Server 2025 including Server Core (10.0.26100.33650) - and exploitation additionally requires an attacker to already hold a valid low-privileged local account, so realistic exposure is largely insiders or intruders who have already obtained a foothold. There is no public exploit identified at time of analysis; SSVC rates exploitation as 'none' and automatable as 'no', and vendor patches are available.