Windows 11 24h2
Monthly
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Local information disclosure in the Windows Device Association Service (the component that handles device pairing and association) allows an attacker who already holds low-privileged, authenticated access on a Windows host to read out-of-bounds memory and potentially expose sensitive data. Microsoft rates this CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a local-only vector with no user interaction, no integrity or availability impact, and unchanged scope. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation activity, so this is a moderate, low-priority issue best handled through routine patching rather than emergency response.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Local privilege escalation in the Windows Broadcast DVR User Service on unpatched Windows 10 and Windows 11 builds allows an authenticated low-privileged attacker to gain elevated privileges by exploiting a time-of-check time-of-use race condition. The vendor CVSS 3.1 base score is 6.5 Medium (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), while the independent assessment rates the race as high complexity (AC:H) because the attacker must reliably win a narrow timing window; SSVC lists Exploitation: none and Automatable: no. No public exploit code was identified at time of analysis, and vendor patches are available for the affected Windows 10 21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1/26H2 branches.
Stack-based buffer overflow in the Windows Resilient File System (ReFS) driver allows an unauthenticated attacker with direct physical access to a device - for example by attaching or mounting an attacker-controlled ReFS-formatted volume - to corrupt kernel memory and bypass a security feature, resulting in a high integrity impact with no loss of confidentiality or availability. The assessed vector (AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) makes remote or scaled exploitation infeasible: the attacker must be physically present and the overflow is not reliably triggerable, and CISA's SSVC evaluation records no exploitation activity and no automatable path. No public exploit code has been identified at time of analysis.
Spoofing of integrity-protected state inside Windows Virtualization-Based Security (VBS) enclaves is possible on affected Windows 11 and Windows Server builds because of improper synchronization of a shared resource (CWE-362) within the enclave code path. An attacker must already hold authenticated low-privileged code execution on the local host (AV:L, PR:L) and then win a competitive timing race (AC:H) to tamper with enclave-managed data; the changed scope (S:C) reflects that the impact crosses from the attacker's user-mode context into the enclave security boundary, producing high integrity impact with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment classifies the issue as non-automatable with only partial technical impact.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Information disclosure in the Microsoft Windows Update component allows a local, low-privileged authenticated attacker (CVSS AV:L/PR:L, UI:N) to trigger an out-of-bounds read and expose contents of process memory. Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 - including Server Core - below the fixed build numbers are affected; the flaw cannot be reached remotely or by an unauthenticated actor, and impact is limited to confidentiality (C:H) with no integrity or availability effect and no code execution or privilege escalation on its own. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor patches are available, making this a moderate, low-priority issue when all signals are weighed together.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Information disclosure in Microsoft Windows kernel-mode drivers allows an attacker who already holds a low-privileged local account to read data they are not authorized to access, stemming from an incorrect authorization check (CWE-863) rather than a memory-safety bug. Only local access is required (AV:L, PR:L) with no user interaction (UI:N), and the impact is confined to confidentiality (C:H) with no integrity or availability effect, giving a moderate CVSS 3.1 base score of 5.5. Microsoft has released fixes through the MSRC update guide covering Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core); there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no.
Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
Local information disclosure in Windows Cryptographic Services (CryptSvc) allows an attacker who already holds authenticated, low-privileged access to the host to trigger an out-of-bounds read and leak bytes from process memory, potentially including cryptographic material handled by the service. Only Windows Server 2025 (including Server Core installations) and Windows 11 24H2, 25H2, 26H1, and 26H2 builds older than the vendor-fixed build numbers are affected; Microsoft has released patches, and no public exploit identified at time of analysis. The CVSS 3.1 score of 5.5 (AV:L/PR:L/UI:N, high confidentiality impact only) alongside a CISA SSVC rating of no exploitation and not automatable places real-world urgency at a low level.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Local information disclosure in the Windows Device Association Service (the component that handles device pairing and association) allows an attacker who already holds low-privileged, authenticated access on a Windows host to read out-of-bounds memory and potentially expose sensitive data. Microsoft rates this CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a local-only vector with no user interaction, no integrity or availability impact, and unchanged scope. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation activity, so this is a moderate, low-priority issue best handled through routine patching rather than emergency response.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Local privilege escalation in the Windows Broadcast DVR User Service on unpatched Windows 10 and Windows 11 builds allows an authenticated low-privileged attacker to gain elevated privileges by exploiting a time-of-check time-of-use race condition. The vendor CVSS 3.1 base score is 6.5 Medium (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), while the independent assessment rates the race as high complexity (AC:H) because the attacker must reliably win a narrow timing window; SSVC lists Exploitation: none and Automatable: no. No public exploit code was identified at time of analysis, and vendor patches are available for the affected Windows 10 21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1/26H2 branches.
Stack-based buffer overflow in the Windows Resilient File System (ReFS) driver allows an unauthenticated attacker with direct physical access to a device - for example by attaching or mounting an attacker-controlled ReFS-formatted volume - to corrupt kernel memory and bypass a security feature, resulting in a high integrity impact with no loss of confidentiality or availability. The assessed vector (AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) makes remote or scaled exploitation infeasible: the attacker must be physically present and the overflow is not reliably triggerable, and CISA's SSVC evaluation records no exploitation activity and no automatable path. No public exploit code has been identified at time of analysis.
Spoofing of integrity-protected state inside Windows Virtualization-Based Security (VBS) enclaves is possible on affected Windows 11 and Windows Server builds because of improper synchronization of a shared resource (CWE-362) within the enclave code path. An attacker must already hold authenticated low-privileged code execution on the local host (AV:L, PR:L) and then win a competitive timing race (AC:H) to tamper with enclave-managed data; the changed scope (S:C) reflects that the impact crosses from the attacker's user-mode context into the enclave security boundary, producing high integrity impact with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment classifies the issue as non-automatable with only partial technical impact.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Information disclosure in the Microsoft Windows Update component allows a local, low-privileged authenticated attacker (CVSS AV:L/PR:L, UI:N) to trigger an out-of-bounds read and expose contents of process memory. Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 - including Server Core - below the fixed build numbers are affected; the flaw cannot be reached remotely or by an unauthenticated actor, and impact is limited to confidentiality (C:H) with no integrity or availability effect and no code execution or privilege escalation on its own. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor patches are available, making this a moderate, low-priority issue when all signals are weighed together.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Information disclosure in Microsoft Windows kernel-mode drivers allows an attacker who already holds a low-privileged local account to read data they are not authorized to access, stemming from an incorrect authorization check (CWE-863) rather than a memory-safety bug. Only local access is required (AV:L, PR:L) with no user interaction (UI:N), and the impact is confined to confidentiality (C:H) with no integrity or availability effect, giving a moderate CVSS 3.1 base score of 5.5. Microsoft has released fixes through the MSRC update guide covering Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core); there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no.
Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
Local information disclosure in Windows Cryptographic Services (CryptSvc) allows an attacker who already holds authenticated, low-privileged access to the host to trigger an out-of-bounds read and leak bytes from process memory, potentially including cryptographic material handled by the service. Only Windows Server 2025 (including Server Core installations) and Windows 11 24H2, 25H2, 26H1, and 26H2 builds older than the vendor-fixed build numbers are affected; Microsoft has released patches, and no public exploit identified at time of analysis. The CVSS 3.1 score of 5.5 (AV:L/PR:L/UI:N, high confidentiality impact only) alongside a CISA SSVC rating of no exploitation and not automatable places real-world urgency at a low level.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.