Windows 11 24h2
Monthly
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated local attacker on a Windows host abuse improper access control in the driver's file-link handling to run code with elevated rights. Exploitation requires the attacker to already hold a valid low-privileged account (CVSS vector PR:L, AV:L) and to reach the container-isolation driver path; no user interaction is needed and attack complexity is low (AC:L), with high confidentiality, integrity and availability impact scored (7.8). Microsoft has published an advisory entry via the MSRC update guide, there is no indication of CISA KEV listing, and no public exploit code was identified at time of analysis - this is a patch-priority issue for Windows container hosts rather than a wormable emergency.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.
No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker to elevate privileges on the host by triggering a use-after-free. The flaw affects Windows systems where the service is present, requires local access and high attack complexity, and no public exploit code has been identified at time of analysis. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system.
Local privilege escalation in the Windows Storage component lets an authenticated, low-privileged user already running code on a Windows host drive a heap-based buffer overflow to gain high-integrity (SYSTEM-level) privileges. Exploitation is not remote: it requires an existing local session (CVSS AV:L, PR:L) and no user interaction (UI:N), but the high attack complexity (AC:H) means the attacker must win a non-deterministic heap-layout or timing condition, which makes reliable weaponization harder than a typical PR:L/AC:L elevation-of-privilege bug. At the time of analysis there is no public exploit identified, no EPSS or KEV signal in the provided intelligence, and the authoritative source for fixed builds is the Microsoft MSRC update guide; the moderate-priority character of this issue reflects that prior host access is a hard prerequisite and success is probabilistic.
Heap-based buffer overflow in the Windows Storage subsystem (CWE-122) allows an authenticated local attacker holding low privileges to elevate to a higher-privileged context on the affected host. The CVSS vector (AV:L/AC:H/PR:L/UI:N) and the assessment confirm the attacker must already be able to execute code locally and that exploitation is gated by high complexity, most likely a race condition or a carefully groomed heap layout, making success unreliable rather than repeatable. This is a moderate-priority local privilege-escalation issue rather than a remote emergency; no public exploit identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV). The supplied data does not enumerate affected Windows builds, so the MSRC update guide must be consulted for the precise vulnerable and fixed versions.
Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.
Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.
Remote code execution in Microsoft QUIC (MsQuic) is possible for unauthenticated network attackers via a use-after-free (CWE-416), with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The independent assessment adjusts the attack complexity to High (AC:H), since exploitation requires a reachable QUIC/UDP endpoint running a service built on the MsQuic stack, such as an HTTP/3 listener on UDP 443 or an SMB-over-QUIC file server. No public exploit code has been identified at time of analysis, and weaponization demands precise heap manipulation to turn the memory corruption into code execution.
Remote code execution in the Remote Desktop Gateway Service (Windows Server) via a use-after-free memory corruption flaw (CWE-416) allows an unauthenticated network attacker to execute code with high impact. Although the assessed vector (AV:N/AC:H/PR:N/UI:N) requires no authentication or user interaction, the high attack complexity means exploitation depends on winning a memory-reuse race, making success probabilistic. No public exploit code or confirmed active exploitation has been identified at time of analysis, and organizations that restrict RD Gateway exposure behind VPN/MFA or do not deploy the role are materially less exposed.
Local privilege escalation in Windows Group Policy allows an authenticated, low-privileged attacker who already has interactive or code-execution access on a Windows host to elevate privileges to a higher-integrity context. The flaw is an access-control weakness (CWE-862) in how a privileged Group Policy operation is authorized, requiring no user interaction (UI:N) and low attack complexity (AC:L) once a foothold exists, which makes it most impactful on shared multi-user systems such as terminal/RDS servers, VDI hosts, and domain-joined endpoints where untrusted users hold accounts. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is credited as the reporting vendor.
Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.
Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.
Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.
Unauthenticated remote code execution in Windows Message Queuing (MSMQ) Queue Manager affects systems where the optional MSMQ feature is installed and reachable. The use-after-free (CWE-416) in the Queue Manager allows an attacker to execute arbitrary code over the network without authentication, but the attack surface is significantly limited because MSMQ is not enabled by default and must be exposed on TCP port 1801 (or related ports). No public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.
Local privilege escalation in the Windows Update Service on Microsoft Windows allows an authenticated attacker with low privileges to gain full control of a host by exploiting a use-after-free memory corruption flaw. The vulnerability requires high attack complexity to win a race condition, and no public exploit code has been identified at time of analysis. The CVSS 3.1 base score is 7.0 (HIGH), with full impact to confidentiality, integrity, and availability upon successful exploitation.
Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows a low-privileged authenticated attacker to gain full system control via improper symlink/junction resolution (CWE-59). Affected platforms include Windows Server 2025 and Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires local access and a race condition (AC:H), making this a targeted rather than opportunistic threat; no public exploit or CISA KEV listing exists at time of analysis.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave exposes authenticated local attackers to full system compromise via an untrusted pointer dereference (CWE-822). Affected platforms include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both standard and Server Core configurations, with Microsoft confirming a patch is available. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (AC:L) makes post-access escalation straightforward for any attacker holding a standard local session.
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) miniport driver (vhdmp.sys) allows an attacker who already holds local, low-privileged access on an affected Windows 10, Windows 11, or Windows Server build to corrupt kernel heap memory and potentially execute code in kernel context by triggering driver processing of a mounted VHD/VHDX virtual disk. The issue is rated 7.8 and was addressed by Microsoft as a kernel elevation-of-privilege fix; there is no public exploit identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.21% (12th percentile), indicating limited near-term exploitation likelihood. Independent assessment scores AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so this is a genuine but not high-urgency priority: exploitation requires pre-existing authenticated local access plus heap grooming to overcome high attack complexity, but the technical impact is total because success yields kernel-level control of the host.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Guest-to-host code execution in Windows Hyper-V affects authorized guest VM users who can trigger an untrusted pointer dereference (CWE-822) to execute code in the hypervisor context, effectively escaping the VM sandbox. The CVSS scope-change metric (S:C) confirms this is a privilege escalation from guest to host, making it a hypervisor escape with full High C/I/A impact on the underlying host. Affected platforms span Windows Server 2022 and 2025 and multiple Windows 11 release channels (23H2 through 25H2). No public exploit or CISA KEV listing identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Work Folders synchronization component allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across Windows 10 and Windows 11. The vulnerability (CWE-122) stems from improper bounds checking in a privileged Work Folders process and requires only a standard user account with no secondary user interaction. Microsoft has released cumulative updates addressing the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows 11 MIDI Service Module exploits a time-of-check time-of-use (TOCTOU) race condition, allowing an authenticated low-privilege local attacker to gain SYSTEM-level control of an affected endpoint. All three currently supported Windows 11 feature versions - 24H2, 25H2, and 26H1 - are affected prior to their respective cumulative update thresholds. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
A use-after-free (CWE-416) in the Microsoft Windows Distributed File System (DFS) service lets an attacker who already holds low-privilege authorized access and can reach DFS over the network crash or destabilize the service, producing a denial-of-service condition on the affected host. Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 are in scope, and the attack surface only exists where DFS is enabled or in use. Exploitation is limited by the high attack complexity of the underlying memory-reuse race, no public exploit code has been identified at time of analysis, and EPSS is low at 0.61% (47th percentile), so this is a moderate-priority patch rather than an emergency. Vendor-released patches are available through Microsoft's update guide.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Windows Security Center allows an authenticated low-privileged attacker to gain full system control through a use-after-free memory corruption flaw. Affected builds span Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2012 (including Server Core installations). Microsoft has released patches via the standard Update Guide; no public exploit code or active exploitation has been identified at time of analysis.
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution via a double-free memory corruption flaw (CWE-415) in Microsoft Office Word enables an unauthenticated network-reachable attacker to execute arbitrary code on a victim's machine when the victim opens or previews a specially crafted document (UI:R). The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full host compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated local user to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-763 (Release of Invalid Pointer or Reference) - a memory-safety defect in the service's pointer lifecycle management that, when triggered, enables code execution at elevated privilege. No public exploit code or active exploitation has been identified at time of analysis, but the zero-interaction, low-complexity CVSS vector makes this a high-priority patching target for any organization running unpatched Windows endpoints or servers.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated local attacker on a Windows host abuse improper access control in the driver's file-link handling to run code with elevated rights. Exploitation requires the attacker to already hold a valid low-privileged account (CVSS vector PR:L, AV:L) and to reach the container-isolation driver path; no user interaction is needed and attack complexity is low (AC:L), with high confidentiality, integrity and availability impact scored (7.8). Microsoft has published an advisory entry via the MSRC update guide, there is no indication of CISA KEV listing, and no public exploit code was identified at time of analysis - this is a patch-priority issue for Windows container hosts rather than a wormable emergency.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.
No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker to elevate privileges on the host by triggering a use-after-free. The flaw affects Windows systems where the service is present, requires local access and high attack complexity, and no public exploit code has been identified at time of analysis. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system.
Local privilege escalation in the Windows Storage component lets an authenticated, low-privileged user already running code on a Windows host drive a heap-based buffer overflow to gain high-integrity (SYSTEM-level) privileges. Exploitation is not remote: it requires an existing local session (CVSS AV:L, PR:L) and no user interaction (UI:N), but the high attack complexity (AC:H) means the attacker must win a non-deterministic heap-layout or timing condition, which makes reliable weaponization harder than a typical PR:L/AC:L elevation-of-privilege bug. At the time of analysis there is no public exploit identified, no EPSS or KEV signal in the provided intelligence, and the authoritative source for fixed builds is the Microsoft MSRC update guide; the moderate-priority character of this issue reflects that prior host access is a hard prerequisite and success is probabilistic.
Heap-based buffer overflow in the Windows Storage subsystem (CWE-122) allows an authenticated local attacker holding low privileges to elevate to a higher-privileged context on the affected host. The CVSS vector (AV:L/AC:H/PR:L/UI:N) and the assessment confirm the attacker must already be able to execute code locally and that exploitation is gated by high complexity, most likely a race condition or a carefully groomed heap layout, making success unreliable rather than repeatable. This is a moderate-priority local privilege-escalation issue rather than a remote emergency; no public exploit identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV). The supplied data does not enumerate affected Windows builds, so the MSRC update guide must be consulted for the precise vulnerable and fixed versions.
Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.
Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.
Remote code execution in Microsoft QUIC (MsQuic) is possible for unauthenticated network attackers via a use-after-free (CWE-416), with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The independent assessment adjusts the attack complexity to High (AC:H), since exploitation requires a reachable QUIC/UDP endpoint running a service built on the MsQuic stack, such as an HTTP/3 listener on UDP 443 or an SMB-over-QUIC file server. No public exploit code has been identified at time of analysis, and weaponization demands precise heap manipulation to turn the memory corruption into code execution.
Remote code execution in the Remote Desktop Gateway Service (Windows Server) via a use-after-free memory corruption flaw (CWE-416) allows an unauthenticated network attacker to execute code with high impact. Although the assessed vector (AV:N/AC:H/PR:N/UI:N) requires no authentication or user interaction, the high attack complexity means exploitation depends on winning a memory-reuse race, making success probabilistic. No public exploit code or confirmed active exploitation has been identified at time of analysis, and organizations that restrict RD Gateway exposure behind VPN/MFA or do not deploy the role are materially less exposed.
Local privilege escalation in Windows Group Policy allows an authenticated, low-privileged attacker who already has interactive or code-execution access on a Windows host to elevate privileges to a higher-integrity context. The flaw is an access-control weakness (CWE-862) in how a privileged Group Policy operation is authorized, requiring no user interaction (UI:N) and low attack complexity (AC:L) once a foothold exists, which makes it most impactful on shared multi-user systems such as terminal/RDS servers, VDI hosts, and domain-joined endpoints where untrusted users hold accounts. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is credited as the reporting vendor.
Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.
Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.
Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.
Unauthenticated remote code execution in Windows Message Queuing (MSMQ) Queue Manager affects systems where the optional MSMQ feature is installed and reachable. The use-after-free (CWE-416) in the Queue Manager allows an attacker to execute arbitrary code over the network without authentication, but the attack surface is significantly limited because MSMQ is not enabled by default and must be exposed on TCP port 1801 (or related ports). No public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.
Local privilege escalation in the Windows Update Service on Microsoft Windows allows an authenticated attacker with low privileges to gain full control of a host by exploiting a use-after-free memory corruption flaw. The vulnerability requires high attack complexity to win a race condition, and no public exploit code has been identified at time of analysis. The CVSS 3.1 base score is 7.0 (HIGH), with full impact to confidentiality, integrity, and availability upon successful exploitation.
Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows a low-privileged authenticated attacker to gain full system control via improper symlink/junction resolution (CWE-59). Affected platforms include Windows Server 2025 and Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires local access and a race condition (AC:H), making this a targeted rather than opportunistic threat; no public exploit or CISA KEV listing exists at time of analysis.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave exposes authenticated local attackers to full system compromise via an untrusted pointer dereference (CWE-822). Affected platforms include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both standard and Server Core configurations, with Microsoft confirming a patch is available. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (AC:L) makes post-access escalation straightforward for any attacker holding a standard local session.
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) miniport driver (vhdmp.sys) allows an attacker who already holds local, low-privileged access on an affected Windows 10, Windows 11, or Windows Server build to corrupt kernel heap memory and potentially execute code in kernel context by triggering driver processing of a mounted VHD/VHDX virtual disk. The issue is rated 7.8 and was addressed by Microsoft as a kernel elevation-of-privilege fix; there is no public exploit identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.21% (12th percentile), indicating limited near-term exploitation likelihood. Independent assessment scores AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so this is a genuine but not high-urgency priority: exploitation requires pre-existing authenticated local access plus heap grooming to overcome high attack complexity, but the technical impact is total because success yields kernel-level control of the host.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Guest-to-host code execution in Windows Hyper-V affects authorized guest VM users who can trigger an untrusted pointer dereference (CWE-822) to execute code in the hypervisor context, effectively escaping the VM sandbox. The CVSS scope-change metric (S:C) confirms this is a privilege escalation from guest to host, making it a hypervisor escape with full High C/I/A impact on the underlying host. Affected platforms span Windows Server 2022 and 2025 and multiple Windows 11 release channels (23H2 through 25H2). No public exploit or CISA KEV listing identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Work Folders synchronization component allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across Windows 10 and Windows 11. The vulnerability (CWE-122) stems from improper bounds checking in a privileged Work Folders process and requires only a standard user account with no secondary user interaction. Microsoft has released cumulative updates addressing the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows 11 MIDI Service Module exploits a time-of-check time-of-use (TOCTOU) race condition, allowing an authenticated low-privilege local attacker to gain SYSTEM-level control of an affected endpoint. All three currently supported Windows 11 feature versions - 24H2, 25H2, and 26H1 - are affected prior to their respective cumulative update thresholds. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
A use-after-free (CWE-416) in the Microsoft Windows Distributed File System (DFS) service lets an attacker who already holds low-privilege authorized access and can reach DFS over the network crash or destabilize the service, producing a denial-of-service condition on the affected host. Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 are in scope, and the attack surface only exists where DFS is enabled or in use. Exploitation is limited by the high attack complexity of the underlying memory-reuse race, no public exploit code has been identified at time of analysis, and EPSS is low at 0.61% (47th percentile), so this is a moderate-priority patch rather than an emergency. Vendor-released patches are available through Microsoft's update guide.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Windows Security Center allows an authenticated low-privileged attacker to gain full system control through a use-after-free memory corruption flaw. Affected builds span Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2012 (including Server Core installations). Microsoft has released patches via the standard Update Guide; no public exploit code or active exploitation has been identified at time of analysis.
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution via a double-free memory corruption flaw (CWE-415) in Microsoft Office Word enables an unauthenticated network-reachable attacker to execute arbitrary code on a victim's machine when the victim opens or previews a specially crafted document (UI:R). The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full host compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated local user to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-763 (Release of Invalid Pointer or Reference) - a memory-safety defect in the service's pointer lifecycle management that, when triggered, enables code execution at elevated privilege. No public exploit code or active exploitation has been identified at time of analysis, but the zero-interaction, low-complexity CVSS vector makes this a high-priority patching target for any organization running unpatched Windows endpoints or servers.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.