Windows 11 24h2
Monthly
Local privilege escalation in the Windows PrintWorkflowUserSvc (the print workflow user service shipped by default on Windows 11 24H2, Windows 11 25H2 and Windows Server 2025) allows an attacker who already holds low-privileged local code execution to drive the service into a use-after-free and elevate to a higher-integrity context. Exploitation is gated by high attack complexity - the attacker must win a race/timing window before freed memory is reused - so reliability is limited, and no public exploit code or CISA KEV activity is associated with the CVE at time of analysis. EPSS is 0.32% (23rd percentile), consistent with a hard-to-trigger, local-only primitive rather than a broadly exploited one.
Local privilege escalation in Windows PrintWorkflowUserSvc on Windows 11 24H2/25H2 and Windows Server 2025 arises from a use-after-free that an authorized low-privileged local user can trigger to gain higher integrity, confidentiality, and availability impact (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation depends on winning a memory-reuse timing race, making success non-deterministic and typically requiring repeated attempts; no public exploit identified at time of analysis, and EPSS is 0.34% (26th percentile).
Local privilege escalation in Windows PrintWorkflowUserSvc lets an authenticated low-privileged user already holding an interactive session on the host drive the print workflow service into a use-after-free and, by winning a timing/race window, execute code at higher integrity (SYSTEM) with high confidentiality and integrity impact. Affected platforms span Windows 10 21H2/22H2, Windows 11 22H2 through 25H2, and Windows Server 2022, 2022 23H2, and 2025, where the service is present by default and no special configuration is required. Exploitation is constrained: it is strictly local (AV:L), requires a valid low-privileged account (PR:L), and carries high attack complexity (AC:H) due to the non-deterministic race, so reliability is poor and multiple attempts may be needed; no public exploit code has been identified and EPSS is low at 0.35% (27th percentile), with no CISA KEV listing.
Elevation of privilege in Windows PrintWorkflowUserSvc on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 lets a locally authenticated low-privileged user trigger a use-after-free through print-workflow operations and potentially gain higher privileges. The CVSS 3.1 score is 7.0 with high attack complexity, and no public exploit or CISA KEV entry is indicated; EPSS is low at 0.32%, so this is a moderate-priority local EoP flaw rather than an urgent emergency.
Local privilege elevation in the Windows Print Workflow User Service (PrintWorkflowUserSvc) allows an authenticated attacker holding only low-level privileges on a Windows host to corrupt freed memory and escalate to a higher-integrity context, with potential for full confidentiality, integrity, and availability impact on the affected system. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, and Windows Server 2022, Server 2022 23H2 and Server 2025. Exploitation is local only and complicated by a memory-reclamation race, no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at roughly 0.35% (27th percentile), making this a moderate-priority patching item rather than an emergency.
Local privilege escalation in Windows PrintWorkflowUserSvc allows a low-privileged authenticated attacker with an existing local session to exploit a use-after-free race and gain higher privileges on affected Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems. The high attack complexity reflects the timing window required for memory-corruption exploitation, and no public exploit code was identified at time of analysis; EPSS is 0.32% (23rd percentile), so near-term exploitation is assessed as unlikely but not impossible.
Physical attackers who obtain hands-on access to a device running BitLocker on Windows 11 24H2, Windows 11 25H2, or Windows Server 2025 can bypass the disk-encryption security feature and access data at rest, with high confidentiality impact but no integrity or availability impact. The flaw is CWE-841 improper enforcement of a behavioral workflow; exploitation requires physical access (AV:P), does not require authentication or user interaction once that access exists (PR:N/UI:N), and is therefore limited to lost, stolen, unattended, or seized devices rather than remote attacks. No public exploit code or CISA KEV active-exploitation signal was provided at time of analysis, and EPSS is low at 0.52% (43rd percentile), making this a low-to-moderate priority despite the security-feature-bypass label.
Local privilege escalation in the Windows Device Association Broker affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. An authenticated low-privileged local attacker can interact with the service to trigger an untrusted pointer dereference (CWE-822), potentially gaining elevated privileges. The CVSS score is 7.8, EPSS is 0.42% (35th percentile), and no public exploit identified at time of analysis.
Local information disclosure in the Windows USB Video Driver affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, allowing an authenticated attacker with local access to induce an error condition that exposes sensitive information (CWE-209). The assessed CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so exploitation requires prior valid credentials on the host and yields confidentiality impact only. EPSS is 0.66% (51st percentile) and no public exploit has been identified at time of analysis.
Physical-access bypass of BitLocker on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 lets an attacker with custody of the device circumvent an expected security workflow and read confidential volume data without credentials or user interaction. The impact is confidentiality-only and cannot be triggered remotely (CVSS 4.6, AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or CISA KEV entry is reported, and EPSS is 0.52%.
Cleartext storage of sensitive information in the Windows 11 kernel can expose protected data to a low-privilege local user who already has authenticated access to an affected 22H2, 23H2, 24H2, or 25H2 system. Rated CVSS 5.5, the flaw requires local access (AV:L/PR:L), needs no user interaction, and affects confidentiality only; it does not by itself provide code execution, privilege escalation, or system disruption. No public exploit code was identified at time of analysis, and EPSS is 0.35% (27th percentile).
Local privilege elevation in the Windows 11 Virtualization-Based Security (VBS) Enclave lets a low-privileged attacker who already has code execution on the host feed untrusted input into a security decision and potentially gain high-integrity code execution and information exposure. Affected systems are Windows 11 22H2, 23H2, 24H2, and 25H2 with VBS/enclave features in use; the attack is local, requires no user interaction, and has high complexity (AC:H), so it depends on winning a race or reaching a specific state. No public exploit was identified at the time of analysis, and EPSS is low at 0.35% (27th percentile).
Local privilege escalation in the Windows Device Association Broker service affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, where a low-privileged authenticated local user can trigger a use-after-free race condition to gain higher-integrity code execution. Exploitation requires a pre-existing local session and is complicated by a high-complexity timing window, making this a post-compromise elevation path rather than a remote attack. EPSS is low at 0.35%, and no public exploit identified at time of analysis.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
SMB Server might be susceptible to relay attacks depending on the configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally. Rated medium severity (CVSS 6.7). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.5). No vendor patch available.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges. Rated high severity (CVSS 7.0). No vendor patch available.
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 10.2% and no vendor patch available.
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Local privilege escalation in the Windows PrintWorkflowUserSvc (the print workflow user service shipped by default on Windows 11 24H2, Windows 11 25H2 and Windows Server 2025) allows an attacker who already holds low-privileged local code execution to drive the service into a use-after-free and elevate to a higher-integrity context. Exploitation is gated by high attack complexity - the attacker must win a race/timing window before freed memory is reused - so reliability is limited, and no public exploit code or CISA KEV activity is associated with the CVE at time of analysis. EPSS is 0.32% (23rd percentile), consistent with a hard-to-trigger, local-only primitive rather than a broadly exploited one.
Local privilege escalation in Windows PrintWorkflowUserSvc on Windows 11 24H2/25H2 and Windows Server 2025 arises from a use-after-free that an authorized low-privileged local user can trigger to gain higher integrity, confidentiality, and availability impact (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation depends on winning a memory-reuse timing race, making success non-deterministic and typically requiring repeated attempts; no public exploit identified at time of analysis, and EPSS is 0.34% (26th percentile).
Local privilege escalation in Windows PrintWorkflowUserSvc lets an authenticated low-privileged user already holding an interactive session on the host drive the print workflow service into a use-after-free and, by winning a timing/race window, execute code at higher integrity (SYSTEM) with high confidentiality and integrity impact. Affected platforms span Windows 10 21H2/22H2, Windows 11 22H2 through 25H2, and Windows Server 2022, 2022 23H2, and 2025, where the service is present by default and no special configuration is required. Exploitation is constrained: it is strictly local (AV:L), requires a valid low-privileged account (PR:L), and carries high attack complexity (AC:H) due to the non-deterministic race, so reliability is poor and multiple attempts may be needed; no public exploit code has been identified and EPSS is low at 0.35% (27th percentile), with no CISA KEV listing.
Elevation of privilege in Windows PrintWorkflowUserSvc on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 lets a locally authenticated low-privileged user trigger a use-after-free through print-workflow operations and potentially gain higher privileges. The CVSS 3.1 score is 7.0 with high attack complexity, and no public exploit or CISA KEV entry is indicated; EPSS is low at 0.32%, so this is a moderate-priority local EoP flaw rather than an urgent emergency.
Local privilege elevation in the Windows Print Workflow User Service (PrintWorkflowUserSvc) allows an authenticated attacker holding only low-level privileges on a Windows host to corrupt freed memory and escalate to a higher-integrity context, with potential for full confidentiality, integrity, and availability impact on the affected system. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, and Windows Server 2022, Server 2022 23H2 and Server 2025. Exploitation is local only and complicated by a memory-reclamation race, no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at roughly 0.35% (27th percentile), making this a moderate-priority patching item rather than an emergency.
Local privilege escalation in Windows PrintWorkflowUserSvc allows a low-privileged authenticated attacker with an existing local session to exploit a use-after-free race and gain higher privileges on affected Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems. The high attack complexity reflects the timing window required for memory-corruption exploitation, and no public exploit code was identified at time of analysis; EPSS is 0.32% (23rd percentile), so near-term exploitation is assessed as unlikely but not impossible.
Physical attackers who obtain hands-on access to a device running BitLocker on Windows 11 24H2, Windows 11 25H2, or Windows Server 2025 can bypass the disk-encryption security feature and access data at rest, with high confidentiality impact but no integrity or availability impact. The flaw is CWE-841 improper enforcement of a behavioral workflow; exploitation requires physical access (AV:P), does not require authentication or user interaction once that access exists (PR:N/UI:N), and is therefore limited to lost, stolen, unattended, or seized devices rather than remote attacks. No public exploit code or CISA KEV active-exploitation signal was provided at time of analysis, and EPSS is low at 0.52% (43rd percentile), making this a low-to-moderate priority despite the security-feature-bypass label.
Local privilege escalation in the Windows Device Association Broker affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. An authenticated low-privileged local attacker can interact with the service to trigger an untrusted pointer dereference (CWE-822), potentially gaining elevated privileges. The CVSS score is 7.8, EPSS is 0.42% (35th percentile), and no public exploit identified at time of analysis.
Local information disclosure in the Windows USB Video Driver affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, allowing an authenticated attacker with local access to induce an error condition that exposes sensitive information (CWE-209). The assessed CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so exploitation requires prior valid credentials on the host and yields confidentiality impact only. EPSS is 0.66% (51st percentile) and no public exploit has been identified at time of analysis.
Physical-access bypass of BitLocker on Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 lets an attacker with custody of the device circumvent an expected security workflow and read confidential volume data without credentials or user interaction. The impact is confidentiality-only and cannot be triggered remotely (CVSS 4.6, AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or CISA KEV entry is reported, and EPSS is 0.52%.
Cleartext storage of sensitive information in the Windows 11 kernel can expose protected data to a low-privilege local user who already has authenticated access to an affected 22H2, 23H2, 24H2, or 25H2 system. Rated CVSS 5.5, the flaw requires local access (AV:L/PR:L), needs no user interaction, and affects confidentiality only; it does not by itself provide code execution, privilege escalation, or system disruption. No public exploit code was identified at time of analysis, and EPSS is 0.35% (27th percentile).
Local privilege elevation in the Windows 11 Virtualization-Based Security (VBS) Enclave lets a low-privileged attacker who already has code execution on the host feed untrusted input into a security decision and potentially gain high-integrity code execution and information exposure. Affected systems are Windows 11 22H2, 23H2, 24H2, and 25H2 with VBS/enclave features in use; the attack is local, requires no user interaction, and has high complexity (AC:H), so it depends on winning a race or reaching a specific state. No public exploit was identified at the time of analysis, and EPSS is low at 0.35% (27th percentile).
Local privilege escalation in the Windows Device Association Broker service affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025, where a low-privileged authenticated local user can trigger a use-after-free race condition to gain higher-integrity code execution. Exploitation requires a pre-existing local session and is complicated by a high-complexity timing window, making this a post-compromise elevation path rather than a remote attack. EPSS is low at 0.35%, and no public exploit identified at time of analysis.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
SMB Server might be susceptible to relay attacks depending on the configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally. Rated medium severity (CVSS 6.7). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.5). No vendor patch available.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges. Rated high severity (CVSS 7.0). No vendor patch available.
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 10.2% and no vendor patch available.
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.