Windows 11 24h2
Monthly
Information disclosure in Windows VBS Enclave protection across Windows 11 versions (23h2, 24h2, 25h2) results from unsafe pointer handling that allows local attackers to read sensitive data without authentication. The vulnerability requires local access and carries medium severity with no available patch, making it a persistent risk for systems relying on virtualization-based security controls.
Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.
Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.
Windows NTLM authentication across multiple Windows versions (10, Server 2008/2019) allows remote attackers to manipulate file name or path parameters without authentication, enabling network-based identity spoofing attacks. The vulnerability requires user interaction and has no available patch, affecting systems still running older Windows Server editions alongside current Windows 10 releases. An attacker could impersonate legitimate services or users to compromise trust in networked communications.
Privilege escalation in Windows Virtualization-Based Security (VBS) Enclave affects Windows 11 and Windows Server 2022 through a heap-based buffer overflow in memory management. An authenticated local attacker with high privileges can exploit this vulnerability to gain unauthorized system-level access. No patch is currently available for this medium-severity vulnerability (CVSS 6.7).
Windows NTLM authentication is vulnerable to path manipulation attacks that enable network-based spoofing when users interact with malicious content, affecting Windows 10 22H2 and Windows Server editions 2008-2016. An unauthenticated attacker can exploit improper file name or path validation to impersonate legitimate systems or services, potentially redirecting authentication requests to attacker-controlled resources. No patch is currently available for this vulnerability.
Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.
Information disclosure in Windows Capability Access Management Service (camsvc) enables local attackers to read sensitive data from memory without authentication on Windows 11 24h2, Windows 11 25h2, and Windows Server 2025. The out-of-bounds read vulnerability requires local access but no special privileges or user interaction to trigger. No patch is currently available for this issue.
Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.
Information disclosure in Windows Client-Side Caching Service allows authenticated local users to read sensitive data on affected systems including Windows 10, Windows 11, and Windows Server editions. An attacker with valid credentials can exploit improper access controls to access cached information without additional user interaction. No patch is currently available for this vulnerability.
Sensitive information disclosure in the Windows Kernel error message handling allows local authenticated users to read confidential data they shouldn't have access to. The vulnerability affects Windows and Windows Server 2022/2025 platforms and requires valid credentials to exploit, limiting its attack surface. No patch is currently available for this medium-severity issue.
Information disclosure in Windows Capability Access Management Service (camsvc) allows authenticated local users to read out-of-bounds memory and access sensitive data on Windows 11 24h2, Windows 11 25h2, Windows Server 2022 23h2, and Windows Server 2025. The vulnerability requires valid user credentials and local system access, posing a risk to multi-user environments where privilege escalation chains could amplify the impact. No patch is currently available.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Improper pointer validation in Windows VBS Enclave allows authenticated local users to read sensitive information on Windows 11 systems across multiple versions. An attacker with local access and valid credentials can exploit this memory safety flaw to bypass enclave protections and disclose confidential data. No patch is currently available.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Local privilege escalation in the Windows Shell (the shell32/explorer component handling shell operations and namespace objects) lets an authenticated low-privileged attacker who can already run code on a Windows host race a shared resource against a concurrent privileged operation and cross a security boundary, gaining elevated rights on the same machine. The flaw is CWE-362 (improper synchronization / race condition) and carries CVSS 7.8 with Scope:Changed, reflecting that the vulnerable component's flaw impacts a component with different privileges, but the assessed vector (AC:H, PR:L, AV:L) means exploitation is non-deterministic, requires many timing attempts, and no remote or unauthenticated path exists. All supported Windows client and server branches are affected - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2016 through 2025 - and no public exploit code has been identified at time of analysis, with no CISA KEV listing, so real-world risk sits below what the raw 7.8 score suggests in isolation.
Privilege escalation in the Windows Shell lets a low-privileged local attacker who already has code execution on a host defeat the shell's shared-resource synchronization and gain SYSTEM-level rights (scope change, high confidentiality/integrity/availability impact). Exploitation is constrained on three fronts: the attacker must already hold a local foothold (PR:L), must win a timing-sensitive race condition (AC:H per CWE-362), and must wait for a victim to perform a normal shell or file operation that the attacker can race (UI:R). Affected platforms are Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025, with multi-user, RDP, and terminal-server hosts representing the highest-value targets; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in Windows Application Information Service (AppInfo) allows authenticated attackers with low-privileged access to trigger an out-of-bounds read and elevate to SYSTEM on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. The vulnerability has a CVSS base score of 7.8 and requires no user interaction, but exploitation is limited to post-authentication scenarios where the attacker already has a foothold. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.40%).
Improper access control in the Windows Camera Frame Server Monitor component of Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 allows an authenticated local attacker to disclose sensitive information. Exploitation requires an existing low-privileged foothold on the target host; no remote vector or user interaction is involved. The EPSS score is 0.40% (33rd percentile), and no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows allows an authenticated attacker to gain elevated privileges via a use-after-free in the Brokering File System component. Affected versions include Windows 11 24H2 and 25H2, Windows Server 2022 23H2, and Windows Server 2025. Exploitation requires local access (AV:L) and high attack complexity (AC:H) with low privileges (PR:L); no user interaction is needed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.33%, indicating a low likelihood of exploitation in the wild.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated remote attacker to achieve code execution on affected hosts, but only where the optional RRAS role is installed and enabled and a user is induced to connect to an attacker-controlled routing or VPN endpoint (UI:R). The flaw is an untrusted pointer dereference (CWE-822) in a service that normally runs with high privilege, and it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Server 2025. EPSS is 1.32% (70th percentile) and no public exploit code has been identified at time of analysis; Microsoft has published a security update and third-party detection and mitigation scripts are available, but the non-default nature of the RRAS role and the mandatory user interaction keep exposure limited.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) allows an authenticated attacker with low privileges to gain SYSTEM-level access on affected Windows 10, 11, and Windows Server systems (2008 R2 through 2025). The flaw is an improper access control (CWE-284) issue reachable by local code, requiring no user interaction; exploitation is limited to post-compromise escalation from a standard user to SYSTEM. No public exploit was identified at time of analysis, and EPSS is low (0.37%, 28th percentile).
Information disclosure in Microsoft's Windows Routing and Remote Access Service (RRAS) allows an unauthenticated, remote attacker to trigger a buffer over-read that leaks memory contents over the network. The exposed population is narrow: exploitation requires the optional RRAS role to be enabled (it is not installed by default on Windows 10/11 or Windows Server SKUs), and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates victim-side interaction is needed rather than a fully passive server-side hit. Impact is confined to confidentiality (C:H with I:N/A:N - no code execution, tampering, or denial of service), and no public exploit code has been identified at time of analysis (EPSS 1.08%, roughly the 64th percentile), making this a moderate, non-urgent issue.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
Privilege escalation in the Microsoft Brokering File System lets an authenticated local attacker win a race condition (CWE-362) over an improperly synchronized shared resource and elevate to a higher-integrity privileged context on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Per the assessed vector (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attacker must already hold a low-privileged local account or code execution on the target host - there is no remote path and no user interaction - and success is probabilistic because the timing window is narrow, so attempts often need repetition. There is no public exploit identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and Microsoft has published a remediation advisory for the affected builds.
Information disclosure in Windows Defender Firewall Service allows an authenticated local attacker to read sensitive memory contents. Affected systems include Windows 11 23H2, 24H2, 25H2, and Windows Server 2022 23H2 and 2025. The flaw requires low-privilege local access and cannot alter data or crash the host, but can leak information; no public exploit has been identified at time of analysis, and EPSS indicates a low likelihood of exploitation (0.52%, 42nd percentile).
Local privilege escalation in the Windows Projected File System (ProjFS) component allows an authenticated attacker who already holds low-privileged code execution on a host to elevate to a higher-integrity context, including kernel/SYSTEM, through a memory-safety flaw reported as an integer overflow or wraparound. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation is strictly local and requires no user interaction, but it also offers no remote or network-facing path, which is the main limit on real-world risk. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not urgent patching priority for unpatched Windows 10, Windows 11, and Windows Server systems where ProjFS is active.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged code-execution foothold on a Windows host to trigger a null pointer dereference in the service and escalate to higher privileges, rated CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every affected build - Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, plus the listed Windows Server releases including Server 2008 SP2 x64 - includes the CSC/Offline Files component by default, so no non-default configuration is required for exploitation. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with a post-compromise escalation primitive rather than a remotely reachable threat.
Privilege elevation on Windows 10, Windows 11, and Windows Server systems is possible when a locally authenticated attacker able to run code as a low-privileged user triggers a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS), assigned CVSS v3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft rates the outcome as high impact to confidentiality, integrity, and availability of the elevated context, so the flaw functions as an escalation building block that converts a standard-user foothold into SYSTEM-level access rather than a standalone entry point; no remote path exists and user interaction is not required. No public exploit code has been identified at time of analysis and EPSS is low at 0.40% (32nd percentile), so exploitation is currently expected to be targeted and post-compromise rather than broad and opportunistic.
Denial of service in Microsoft Windows DirectX: a null pointer dereference reachable from a locally authenticated, low-privileged session crashes the affected graphics component, and because the flaw is scoped beyond its own component (S:C) the resulting availability loss is not contained to the attacker's own process. Affected platforms are Windows 10 21H2/22H2 (x64), Windows 11 23H2/24H2/25H2, and Windows Server 2022/2022 23H2/2025, all of which ship DirectX by default, so no non-default feature needs to be enabled beyond obtaining local code execution. Confidence in exploitation is low: EPSS is 0.46% (38th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry; the attack is local-only (AV:L) with no confidentiality or integrity impact.
A buffer over-read in the Windows Projected File System (ProjFS) kernel component lets a locally authenticated attacker who can already run code as a low-privileged user escalate to higher privileges on affected Windows 10, Windows 11, and Windows Server hosts. Because the flaw is reached through resource parsing (AV:L, PR:L, UI:N, AC:L), it is not remotely exploitable and serves primarily as a post-compromise escalation step rather than an initial access vector, but successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and EPSS is low at roughly 0.4% (32nd percentile), so this is a genuine but not urgent priority - patch on the normal monthly update cadence, with faster turnaround on multi-user or high-value systems where local code execution is plausible.
Local privilege escalation in Microsoft Windows stems from a buffer over-read (CWE-126) in the Projected File System filter driver (prjflt.sys), a kernel-mode component that ships in-box with Windows 10 1809, Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019, 2022, 2022 23H2 and 2025. An authenticated attacker who already holds low-privileged local code execution on the host can trigger the over-read and, because the flaw is reachable in kernel context, gain SYSTEM-level elevation - CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no unusual complexity, but a mandatory local foothold. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.40% (32nd percentile), so this is a patch-on-cycle item rather than an emergency, with priority driven by the number of unpatched Windows endpoints exposed to post-compromise escalation. Microsoft published the fix through its standard monthly update channel (MSRC advisory CVE-2025-62461).
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects supported Windows 10, Windows 11, and Windows Server builds, enabling a local attacker with low-privileged code execution to exploit an out-of-bounds read and gain elevated privileges. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires an existing local foothold; it is not remotely reachable and needs no user interaction. No public exploit identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not emergency-grade second-stage escalation issue.
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an authenticated, low-privileged attacker to execute arbitrary code with full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). Exploitation requires the ReFS driver to process attacker-controlled volume data, which in practice means a crafted ReFS image (often delivered as a VHD/VHDX) must be mounted or parsed by the targeted system; no user interaction is needed beyond that mount, and the attacker needs only low privileges. Microsoft Windows 11 23H2, 24H2, and 25H2, plus Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 are affected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS is modest at 1.10% (64th percentile); the vendor advisory and fixes are published through the Microsoft Security Response Center update guide.
Local privilege escalation in the Windows Storage VSP Driver allows an authenticated attacker with low-level privileges to elevate to SYSTEM on affected Windows systems. This post-access flaw requires the attacker to already have local code execution as a low-privileged user (PR:L, AV:L) and does not require user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis, though the EPSS score is 2.45% (84th percentile), indicating a moderate likelihood of exploitation. Affected platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 through 2025.
Local privilege escalation in the Windows Storage VSP (Virtual Storage Port) Driver allows an authenticated, low-privileged attacker who already has code execution on a Windows host to obtain SYSTEM-level control. Tracked as CVE-2025-59516 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025); no user interaction is required once local access exists. Exploitation is a post-compromise escalation step rather than an initial-access vector: there is no remote or network-facing exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while EPSS sits at 2.34% (83rd percentile), indicating elevated but not imminent exploitation likelihood.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated attacker holding only standard-user rights to read out of bounds and elevate to full SYSTEM-level impact on affected Windows hosts. The flaw is scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable and requires a pre-existing foothold with code execution as a low-privileged user; no user interaction is needed. EPSS is low at 0.40% (32nd percentile), no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV, though Microsoft has published a security update via its update guide.
Command injection in Windows PowerShell (CVE-2025-54100) lets an attacker execute arbitrary code in a victim's user context when that user opens or runs attacker-supplied content within the shell. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - it requires local access plus user interaction, not network reachability, so an attacker must first deliver a malicious script, file, or command and persuade the victim to execute it. It affects PowerShell as shipped by default across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 25H2), and Windows Server 2008 SP2 through 2025. EPSS is a modest 2.23% (82nd percentile), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis, making this actionable but not emergency-tier.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. No vendor patch available.
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure and spoofing in Windows NTLM affects Windows 11 22H2, 23H2, 24H2, and 25H2 as well as Windows Server 2025, allowing a local attacker who convinces a logged-on user to interact with crafted content to expose sensitive information. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so exploitation requires local access and user interaction rather than remote, unattended access. No public exploit was identified at time of analysis, and EPSS is about 1% (63rd percentile).
Denial of service in Windows Local Session Manager affects Windows 11 24H2/25H2 and Windows Server 2022 23H2/2025, allowing a remotely reachable attacker who holds low-privileged credentials to send input of a type that LSM fails to validate properly and disrupt availability. The CVSS vector confirms network access, low attack complexity, low privileges required, no user interaction, and a high availability-only impact; confidentiality and integrity are unaffected. EPSS is 1.51% (74th percentile), and no public exploit code or CISA KEV entry was identified in the provided data.
Local privilege escalation in the Windows Health and Optimized Experiences Service on Windows 11 24H2 and 25H2 allows an authenticated low-privileged attacker to make the privileged service follow a crafted filesystem link and access or modify protected files in the service's security context. Affected hosts are Windows 11 24H2 and 25H2 with the default service present; exploitation requires an existing local foothold and timing control, not network access or user interaction. No public exploit was identified at time of analysis, and EPSS is low at 0.35% (27th percentile).
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 when ReFS is in use and the opt-in data deduplication feature is enabled. An authenticated local attacker with low privileges must win a race/timing window to trigger the use-after-free, and successful exploitation can cause high confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and EPSS is low at 0.29% (20th percentile), making this a genuine but second-tier priority rather than an emergency.
Elevation of privilege in the Windows Resilient File System (ReFS) Deduplication Service allows a local attacker who can already run code on the host to trigger a use-after-free (CWE-416) in the service and potentially execute code at a higher privilege level, with high confidentiality, integrity, and availability impact (CVSS 7.4). Exposure is narrow: the host must be running an affected build (Windows 11 24H2, Windows 11 25H2, or Windows Server 2025) and must actually have an ReFS volume with data deduplication enabled, a deliberately configured, non-default feature. Per the assessed vector (PR:L, AC:H), exploitation requires a low-privileged local account and a successful race-condition win against the service, which substantially limits reliability; there is no public exploit code and no confirmed active exploitation at time of analysis, and EPSS is low at 0.38% (30th percentile).
Local privilege escalation in the Microsoft Brokering File System component of Windows 11 24H2/25H2 and Windows Server 2025 allows an authenticated attacker with low-level local access to gain elevated privileges by triggering a use-after-free condition. The CVSS vector (AV:L/AC:H/PR:L/UI:N) shows exploitation requires local access, low privileges, and high attack complexity, with no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.26% (16th percentile).
Denial of service in Windows DirectX affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, where an authorized network attacker with low privileges can trigger a null pointer dereference and disrupt availability. The CVSS 3.1 score is 7.7 with AV:N/AC:L/PR:L/UI:N/S:C and availability-only impact, meaning the attacker must already have low-level authorized access rather than being anonymously reachable. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 1.20% (68th percentile), indicating limited observed likelihood.
Local privilege escalation in Windows Error Reporting (WER) affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, allowing an authenticated low-privileged attacker with local code execution to gain higher privileges. Microsoft rates this 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and EPSS is 3.03% (87th percentile); no public exploit code or CISA KEV entry is identified at time of analysis.
A use-after-free in the Windows kernel lets a locally authenticated attacker with a low-privileged account escalate to SYSTEM on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Because the flaw requires an attacker to already execute code on the host and carries high attack complexity (likely a race or heap-layout condition that must be won), it is a moderate-priority local privilege escalation rather than a remotely reachable or deterministic threat; no public exploit code or CISA KEV entry was identified at time of analysis, and EPSS sits at 2.02% (81st percentile). Tracked as CVE-2025-55693 and rated 7.0 by Microsoft via MSRC.
Information disclosure in Windows VBS Enclave protection across Windows 11 versions (23h2, 24h2, 25h2) results from unsafe pointer handling that allows local attackers to read sensitive data without authentication. The vulnerability requires local access and carries medium severity with no available patch, making it a persistent risk for systems relying on virtualization-based security controls.
Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.
Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.
Windows NTLM authentication across multiple Windows versions (10, Server 2008/2019) allows remote attackers to manipulate file name or path parameters without authentication, enabling network-based identity spoofing attacks. The vulnerability requires user interaction and has no available patch, affecting systems still running older Windows Server editions alongside current Windows 10 releases. An attacker could impersonate legitimate services or users to compromise trust in networked communications.
Privilege escalation in Windows Virtualization-Based Security (VBS) Enclave affects Windows 11 and Windows Server 2022 through a heap-based buffer overflow in memory management. An authenticated local attacker with high privileges can exploit this vulnerability to gain unauthorized system-level access. No patch is currently available for this medium-severity vulnerability (CVSS 6.7).
Windows NTLM authentication is vulnerable to path manipulation attacks that enable network-based spoofing when users interact with malicious content, affecting Windows 10 22H2 and Windows Server editions 2008-2016. An unauthenticated attacker can exploit improper file name or path validation to impersonate legitimate systems or services, potentially redirecting authentication requests to attacker-controlled resources. No patch is currently available for this vulnerability.
Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.
Information disclosure in Windows Capability Access Management Service (camsvc) enables local attackers to read sensitive data from memory without authentication on Windows 11 24h2, Windows 11 25h2, and Windows Server 2025. The out-of-bounds read vulnerability requires local access but no special privileges or user interaction to trigger. No patch is currently available for this issue.
Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.
Information disclosure in Windows Client-Side Caching Service allows authenticated local users to read sensitive data on affected systems including Windows 10, Windows 11, and Windows Server editions. An attacker with valid credentials can exploit improper access controls to access cached information without additional user interaction. No patch is currently available for this vulnerability.
Sensitive information disclosure in the Windows Kernel error message handling allows local authenticated users to read confidential data they shouldn't have access to. The vulnerability affects Windows and Windows Server 2022/2025 platforms and requires valid credentials to exploit, limiting its attack surface. No patch is currently available for this medium-severity issue.
Information disclosure in Windows Capability Access Management Service (camsvc) allows authenticated local users to read out-of-bounds memory and access sensitive data on Windows 11 24h2, Windows 11 25h2, Windows Server 2022 23h2, and Windows Server 2025. The vulnerability requires valid user credentials and local system access, posing a risk to multi-user environments where privilege escalation chains could amplify the impact. No patch is currently available.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Improper pointer validation in Windows VBS Enclave allows authenticated local users to read sensitive information on Windows 11 systems across multiple versions. An attacker with local access and valid credentials can exploit this memory safety flaw to bypass enclave protections and disclose confidential data. No patch is currently available.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Local privilege escalation in the Windows Shell (the shell32/explorer component handling shell operations and namespace objects) lets an authenticated low-privileged attacker who can already run code on a Windows host race a shared resource against a concurrent privileged operation and cross a security boundary, gaining elevated rights on the same machine. The flaw is CWE-362 (improper synchronization / race condition) and carries CVSS 7.8 with Scope:Changed, reflecting that the vulnerable component's flaw impacts a component with different privileges, but the assessed vector (AC:H, PR:L, AV:L) means exploitation is non-deterministic, requires many timing attempts, and no remote or unauthenticated path exists. All supported Windows client and server branches are affected - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2016 through 2025 - and no public exploit code has been identified at time of analysis, with no CISA KEV listing, so real-world risk sits below what the raw 7.8 score suggests in isolation.
Privilege escalation in the Windows Shell lets a low-privileged local attacker who already has code execution on a host defeat the shell's shared-resource synchronization and gain SYSTEM-level rights (scope change, high confidentiality/integrity/availability impact). Exploitation is constrained on three fronts: the attacker must already hold a local foothold (PR:L), must win a timing-sensitive race condition (AC:H per CWE-362), and must wait for a victim to perform a normal shell or file operation that the attacker can race (UI:R). Affected platforms are Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025, with multi-user, RDP, and terminal-server hosts representing the highest-value targets; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in Windows Application Information Service (AppInfo) allows authenticated attackers with low-privileged access to trigger an out-of-bounds read and elevate to SYSTEM on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. The vulnerability has a CVSS base score of 7.8 and requires no user interaction, but exploitation is limited to post-authentication scenarios where the attacker already has a foothold. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.40%).
Improper access control in the Windows Camera Frame Server Monitor component of Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 allows an authenticated local attacker to disclose sensitive information. Exploitation requires an existing low-privileged foothold on the target host; no remote vector or user interaction is involved. The EPSS score is 0.40% (33rd percentile), and no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows allows an authenticated attacker to gain elevated privileges via a use-after-free in the Brokering File System component. Affected versions include Windows 11 24H2 and 25H2, Windows Server 2022 23H2, and Windows Server 2025. Exploitation requires local access (AV:L) and high attack complexity (AC:H) with low privileges (PR:L); no user interaction is needed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.33%, indicating a low likelihood of exploitation in the wild.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated remote attacker to achieve code execution on affected hosts, but only where the optional RRAS role is installed and enabled and a user is induced to connect to an attacker-controlled routing or VPN endpoint (UI:R). The flaw is an untrusted pointer dereference (CWE-822) in a service that normally runs with high privilege, and it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Server 2025. EPSS is 1.32% (70th percentile) and no public exploit code has been identified at time of analysis; Microsoft has published a security update and third-party detection and mitigation scripts are available, but the non-default nature of the RRAS role and the mandatory user interaction keep exposure limited.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) allows an authenticated attacker with low privileges to gain SYSTEM-level access on affected Windows 10, 11, and Windows Server systems (2008 R2 through 2025). The flaw is an improper access control (CWE-284) issue reachable by local code, requiring no user interaction; exploitation is limited to post-compromise escalation from a standard user to SYSTEM. No public exploit was identified at time of analysis, and EPSS is low (0.37%, 28th percentile).
Information disclosure in Microsoft's Windows Routing and Remote Access Service (RRAS) allows an unauthenticated, remote attacker to trigger a buffer over-read that leaks memory contents over the network. The exposed population is narrow: exploitation requires the optional RRAS role to be enabled (it is not installed by default on Windows 10/11 or Windows Server SKUs), and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates victim-side interaction is needed rather than a fully passive server-side hit. Impact is confined to confidentiality (C:H with I:N/A:N - no code execution, tampering, or denial of service), and no public exploit code has been identified at time of analysis (EPSS 1.08%, roughly the 64th percentile), making this a moderate, non-urgent issue.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
Privilege escalation in the Microsoft Brokering File System lets an authenticated local attacker win a race condition (CWE-362) over an improperly synchronized shared resource and elevate to a higher-integrity privileged context on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Per the assessed vector (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attacker must already hold a low-privileged local account or code execution on the target host - there is no remote path and no user interaction - and success is probabilistic because the timing window is narrow, so attempts often need repetition. There is no public exploit identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and Microsoft has published a remediation advisory for the affected builds.
Information disclosure in Windows Defender Firewall Service allows an authenticated local attacker to read sensitive memory contents. Affected systems include Windows 11 23H2, 24H2, 25H2, and Windows Server 2022 23H2 and 2025. The flaw requires low-privilege local access and cannot alter data or crash the host, but can leak information; no public exploit has been identified at time of analysis, and EPSS indicates a low likelihood of exploitation (0.52%, 42nd percentile).
Local privilege escalation in the Windows Projected File System (ProjFS) component allows an authenticated attacker who already holds low-privileged code execution on a host to elevate to a higher-integrity context, including kernel/SYSTEM, through a memory-safety flaw reported as an integer overflow or wraparound. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation is strictly local and requires no user interaction, but it also offers no remote or network-facing path, which is the main limit on real-world risk. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not urgent patching priority for unpatched Windows 10, Windows 11, and Windows Server systems where ProjFS is active.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged code-execution foothold on a Windows host to trigger a null pointer dereference in the service and escalate to higher privileges, rated CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every affected build - Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, plus the listed Windows Server releases including Server 2008 SP2 x64 - includes the CSC/Offline Files component by default, so no non-default configuration is required for exploitation. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with a post-compromise escalation primitive rather than a remotely reachable threat.
Privilege elevation on Windows 10, Windows 11, and Windows Server systems is possible when a locally authenticated attacker able to run code as a low-privileged user triggers a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS), assigned CVSS v3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft rates the outcome as high impact to confidentiality, integrity, and availability of the elevated context, so the flaw functions as an escalation building block that converts a standard-user foothold into SYSTEM-level access rather than a standalone entry point; no remote path exists and user interaction is not required. No public exploit code has been identified at time of analysis and EPSS is low at 0.40% (32nd percentile), so exploitation is currently expected to be targeted and post-compromise rather than broad and opportunistic.
Denial of service in Microsoft Windows DirectX: a null pointer dereference reachable from a locally authenticated, low-privileged session crashes the affected graphics component, and because the flaw is scoped beyond its own component (S:C) the resulting availability loss is not contained to the attacker's own process. Affected platforms are Windows 10 21H2/22H2 (x64), Windows 11 23H2/24H2/25H2, and Windows Server 2022/2022 23H2/2025, all of which ship DirectX by default, so no non-default feature needs to be enabled beyond obtaining local code execution. Confidence in exploitation is low: EPSS is 0.46% (38th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry; the attack is local-only (AV:L) with no confidentiality or integrity impact.
A buffer over-read in the Windows Projected File System (ProjFS) kernel component lets a locally authenticated attacker who can already run code as a low-privileged user escalate to higher privileges on affected Windows 10, Windows 11, and Windows Server hosts. Because the flaw is reached through resource parsing (AV:L, PR:L, UI:N, AC:L), it is not remotely exploitable and serves primarily as a post-compromise escalation step rather than an initial access vector, but successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and EPSS is low at roughly 0.4% (32nd percentile), so this is a genuine but not urgent priority - patch on the normal monthly update cadence, with faster turnaround on multi-user or high-value systems where local code execution is plausible.
Local privilege escalation in Microsoft Windows stems from a buffer over-read (CWE-126) in the Projected File System filter driver (prjflt.sys), a kernel-mode component that ships in-box with Windows 10 1809, Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019, 2022, 2022 23H2 and 2025. An authenticated attacker who already holds low-privileged local code execution on the host can trigger the over-read and, because the flaw is reachable in kernel context, gain SYSTEM-level elevation - CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no unusual complexity, but a mandatory local foothold. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.40% (32nd percentile), so this is a patch-on-cycle item rather than an emergency, with priority driven by the number of unpatched Windows endpoints exposed to post-compromise escalation. Microsoft published the fix through its standard monthly update channel (MSRC advisory CVE-2025-62461).
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects supported Windows 10, Windows 11, and Windows Server builds, enabling a local attacker with low-privileged code execution to exploit an out-of-bounds read and gain elevated privileges. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires an existing local foothold; it is not remotely reachable and needs no user interaction. No public exploit identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not emergency-grade second-stage escalation issue.
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an authenticated, low-privileged attacker to execute arbitrary code with full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). Exploitation requires the ReFS driver to process attacker-controlled volume data, which in practice means a crafted ReFS image (often delivered as a VHD/VHDX) must be mounted or parsed by the targeted system; no user interaction is needed beyond that mount, and the attacker needs only low privileges. Microsoft Windows 11 23H2, 24H2, and 25H2, plus Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 are affected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS is modest at 1.10% (64th percentile); the vendor advisory and fixes are published through the Microsoft Security Response Center update guide.
Local privilege escalation in the Windows Storage VSP Driver allows an authenticated attacker with low-level privileges to elevate to SYSTEM on affected Windows systems. This post-access flaw requires the attacker to already have local code execution as a low-privileged user (PR:L, AV:L) and does not require user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis, though the EPSS score is 2.45% (84th percentile), indicating a moderate likelihood of exploitation. Affected platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 through 2025.
Local privilege escalation in the Windows Storage VSP (Virtual Storage Port) Driver allows an authenticated, low-privileged attacker who already has code execution on a Windows host to obtain SYSTEM-level control. Tracked as CVE-2025-59516 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025); no user interaction is required once local access exists. Exploitation is a post-compromise escalation step rather than an initial-access vector: there is no remote or network-facing exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while EPSS sits at 2.34% (83rd percentile), indicating elevated but not imminent exploitation likelihood.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated attacker holding only standard-user rights to read out of bounds and elevate to full SYSTEM-level impact on affected Windows hosts. The flaw is scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable and requires a pre-existing foothold with code execution as a low-privileged user; no user interaction is needed. EPSS is low at 0.40% (32nd percentile), no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV, though Microsoft has published a security update via its update guide.
Command injection in Windows PowerShell (CVE-2025-54100) lets an attacker execute arbitrary code in a victim's user context when that user opens or runs attacker-supplied content within the shell. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - it requires local access plus user interaction, not network reachability, so an attacker must first deliver a malicious script, file, or command and persuade the victim to execute it. It affects PowerShell as shipped by default across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 25H2), and Windows Server 2008 SP2 through 2025. EPSS is a modest 2.23% (82nd percentile), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis, making this actionable but not emergency-tier.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. No vendor patch available.
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure and spoofing in Windows NTLM affects Windows 11 22H2, 23H2, 24H2, and 25H2 as well as Windows Server 2025, allowing a local attacker who convinces a logged-on user to interact with crafted content to expose sensitive information. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so exploitation requires local access and user interaction rather than remote, unattended access. No public exploit was identified at time of analysis, and EPSS is about 1% (63rd percentile).
Denial of service in Windows Local Session Manager affects Windows 11 24H2/25H2 and Windows Server 2022 23H2/2025, allowing a remotely reachable attacker who holds low-privileged credentials to send input of a type that LSM fails to validate properly and disrupt availability. The CVSS vector confirms network access, low attack complexity, low privileges required, no user interaction, and a high availability-only impact; confidentiality and integrity are unaffected. EPSS is 1.51% (74th percentile), and no public exploit code or CISA KEV entry was identified in the provided data.
Local privilege escalation in the Windows Health and Optimized Experiences Service on Windows 11 24H2 and 25H2 allows an authenticated low-privileged attacker to make the privileged service follow a crafted filesystem link and access or modify protected files in the service's security context. Affected hosts are Windows 11 24H2 and 25H2 with the default service present; exploitation requires an existing local foothold and timing control, not network access or user interaction. No public exploit was identified at time of analysis, and EPSS is low at 0.35% (27th percentile).
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 when ReFS is in use and the opt-in data deduplication feature is enabled. An authenticated local attacker with low privileges must win a race/timing window to trigger the use-after-free, and successful exploitation can cause high confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and EPSS is low at 0.29% (20th percentile), making this a genuine but second-tier priority rather than an emergency.
Elevation of privilege in the Windows Resilient File System (ReFS) Deduplication Service allows a local attacker who can already run code on the host to trigger a use-after-free (CWE-416) in the service and potentially execute code at a higher privilege level, with high confidentiality, integrity, and availability impact (CVSS 7.4). Exposure is narrow: the host must be running an affected build (Windows 11 24H2, Windows 11 25H2, or Windows Server 2025) and must actually have an ReFS volume with data deduplication enabled, a deliberately configured, non-default feature. Per the assessed vector (PR:L, AC:H), exploitation requires a low-privileged local account and a successful race-condition win against the service, which substantially limits reliability; there is no public exploit code and no confirmed active exploitation at time of analysis, and EPSS is low at 0.38% (30th percentile).
Local privilege escalation in the Microsoft Brokering File System component of Windows 11 24H2/25H2 and Windows Server 2025 allows an authenticated attacker with low-level local access to gain elevated privileges by triggering a use-after-free condition. The CVSS vector (AV:L/AC:H/PR:L/UI:N) shows exploitation requires local access, low privileges, and high attack complexity, with no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.26% (16th percentile).
Denial of service in Windows DirectX affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, where an authorized network attacker with low privileges can trigger a null pointer dereference and disrupt availability. The CVSS 3.1 score is 7.7 with AV:N/AC:L/PR:L/UI:N/S:C and availability-only impact, meaning the attacker must already have low-level authorized access rather than being anonymously reachable. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 1.20% (68th percentile), indicating limited observed likelihood.
Local privilege escalation in Windows Error Reporting (WER) affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, allowing an authenticated low-privileged attacker with local code execution to gain higher privileges. Microsoft rates this 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and EPSS is 3.03% (87th percentile); no public exploit code or CISA KEV entry is identified at time of analysis.
A use-after-free in the Windows kernel lets a locally authenticated attacker with a low-privileged account escalate to SYSTEM on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Because the flaw requires an attacker to already execute code on the host and carries high attack complexity (likely a race or heap-layout condition that must be won), it is a moderate-priority local privilege escalation rather than a remotely reachable or deterministic threat; no public exploit code or CISA KEV entry was identified at time of analysis, and EPSS sits at 2.02% (81st percentile). Tracked as CVE-2025-55693 and rated 7.0 by Microsoft via MSRC.