Windows 11 26h1
Monthly
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Windows Push Notifications (WPN) exploits a use-after-free (CWE-416) to allow a low-privileged authenticated attacker to achieve full system compromise - confidentiality, integrity, and availability all rated High. The flaw spans Windows 11 (23H2 through 26H1) and Windows Server 2022/2025, with Microsoft confirming patch availability via the MSRC update guide. CVSS AC:H reflects a race-condition timing requirement that raises the exploitation bar above trivial one-shot attacks.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. No public exploit or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the affected builds.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Local privilege escalation in the Windows Cross Device Service (CVE-2026-66804) allows a low-privileged authenticated user to gain SYSTEM or elevated permissions on the local machine. The flaw stems from CWE-284 (Improper Access Control), meaning the service fails to adequately enforce authorization boundaries between user privilege levels. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a straightforward target for post-compromise lateral movement or privilege escalation tooling.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Windows Autopilot on Windows 11 versions 24H2, 25H2, and 26H1 contains a double-free memory corruption flaw that allows a locally authenticated, low-privileged attacker to escalate to full system privileges. The vulnerability carries a CVSS 3.1 score of 7.0 with high attack complexity (AC:H), meaning reliable exploitation requires specific conditions or timing to be met rather than being trivially reproducible. A vendor-released patch is available via the Microsoft Security Response Center, and no public exploit has been identified at time of analysis.
Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Windows Push Notifications (WPN) exploits a use-after-free (CWE-416) to allow a low-privileged authenticated attacker to achieve full system compromise - confidentiality, integrity, and availability all rated High. The flaw spans Windows 11 (23H2 through 26H1) and Windows Server 2022/2025, with Microsoft confirming patch availability via the MSRC update guide. CVSS AC:H reflects a race-condition timing requirement that raises the exploitation bar above trivial one-shot attacks.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. No public exploit or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the affected builds.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Local privilege escalation in the Windows Cross Device Service (CVE-2026-66804) allows a low-privileged authenticated user to gain SYSTEM or elevated permissions on the local machine. The flaw stems from CWE-284 (Improper Access Control), meaning the service fails to adequately enforce authorization boundaries between user privilege levels. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a straightforward target for post-compromise lateral movement or privilege escalation tooling.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Windows Autopilot on Windows 11 versions 24H2, 25H2, and 26H1 contains a double-free memory corruption flaw that allows a locally authenticated, low-privileged attacker to escalate to full system privileges. The vulnerability carries a CVSS 3.1 score of 7.0 with high attack complexity (AC:H), meaning reliable exploitation requires specific conditions or timing to be met rather than being trivially reproducible. A vendor-released patch is available via the Microsoft Security Response Center, and no public exploit has been identified at time of analysis.
Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.