Windows 11 26h1
Monthly
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Information disclosure in the Microsoft Windows Update component allows a local, low-privileged authenticated attacker (CVSS AV:L/PR:L, UI:N) to trigger an out-of-bounds read and expose contents of process memory. Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 - including Server Core - below the fixed build numbers are affected; the flaw cannot be reached remotely or by an unauthenticated actor, and impact is limited to confidentiality (C:H) with no integrity or availability effect and no code execution or privilege escalation on its own. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor patches are available, making this a moderate, low-priority issue when all signals are weighed together.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Information disclosure in Microsoft Windows kernel-mode drivers allows an attacker who already holds a low-privileged local account to read data they are not authorized to access, stemming from an incorrect authorization check (CWE-863) rather than a memory-safety bug. Only local access is required (AV:L, PR:L) with no user interaction (UI:N), and the impact is confined to confidentiality (C:H) with no integrity or availability effect, giving a moderate CVSS 3.1 base score of 5.5. Microsoft has released fixes through the MSRC update guide covering Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core); there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no.
Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
Local information disclosure in Windows Cryptographic Services (CryptSvc) allows an attacker who already holds authenticated, low-privileged access to the host to trigger an out-of-bounds read and leak bytes from process memory, potentially including cryptographic material handled by the service. Only Windows Server 2025 (including Server Core installations) and Windows 11 24H2, 25H2, 26H1, and 26H2 builds older than the vendor-fixed build numbers are affected; Microsoft has released patches, and no public exploit identified at time of analysis. The CVSS 3.1 score of 5.5 (AV:L/PR:L/UI:N, high confidentiality impact only) alongside a CISA SSVC rating of no exploitation and not automatable places real-world urgency at a low level.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Privilege escalation in the Windows Kernel allows an attacker with physical access to a Windows 11 version 26H1 device to elevate to SYSTEM-level privileges by supplying an untrusted pointer to a kernel routine. Only machines running Windows 11 26H1 builds from 10.0.28000.0 through 10.0.28000.3231 are affected, and the exploit requires hands-on interaction with the hardware (CVSS AV:P), with no authentication or user interaction needed once that access exists. Microsoft has shipped a fix in build 10.0.28000.3231; there is no public exploit code and no evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the EPSS-style urgency is tempered mainly by the physical-access prerequisite, which limits realistic exposure to lost, stolen, unattended, kiosk, or shared hardware rather than remote attack.
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Null pointer dereference in Windows Schannel - Microsoft's native TLS/SSL security package - allows an authenticated network attacker to crash the affected service on Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. The CVSS vector (AV:N/AC:H/PR:L) places this as a moderate-severity denial-of-service requiring valid credentials and non-trivial triggering conditions, with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Information disclosure in the Microsoft Windows Update component allows a local, low-privileged authenticated attacker (CVSS AV:L/PR:L, UI:N) to trigger an out-of-bounds read and expose contents of process memory. Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 - including Server Core - below the fixed build numbers are affected; the flaw cannot be reached remotely or by an unauthenticated actor, and impact is limited to confidentiality (C:H) with no integrity or availability effect and no code execution or privilege escalation on its own. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor patches are available, making this a moderate, low-priority issue when all signals are weighed together.
Security feature bypass in the Windows AppX Deployment Service lets a locally authenticated attacker with low privileges circumvent a deployment-related protection by abusing an alternate path, undermining system integrity while leaving confidentiality and availability unaffected. Exploitation requires a pre-existing local foothold on the host - there is no remote vector and no user interaction - giving a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists, and Microsoft has released a vendor fix covering the listed Windows 10, Windows 11, and Windows Server builds.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Information disclosure in Microsoft Windows kernel-mode drivers allows an attacker who already holds a low-privileged local account to read data they are not authorized to access, stemming from an incorrect authorization check (CWE-863) rather than a memory-safety bug. Only local access is required (AV:L, PR:L) with no user interaction (UI:N), and the impact is confined to confidentiality (C:H) with no integrity or availability effect, giving a moderate CVSS 3.1 base score of 5.5. Microsoft has released fixes through the MSRC update guide covering Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core); there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no.
Local information disclosure in the Windows AppX Deployment Service permits an authenticated local attacker to read file contents outside their own privilege boundary by inducing the service to follow a crafted symbolic link or directory junction. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed levels published in the Microsoft update guide. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and automation as not automatable, so this is a low-priority issue whose CRITICAL-looking confidentiality rating (C:H) is heavily offset by the local, authenticated, high-complexity exploitation prerequisites.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
Local information disclosure in Windows Cryptographic Services (CryptSvc) allows an attacker who already holds authenticated, low-privileged access to the host to trigger an out-of-bounds read and leak bytes from process memory, potentially including cryptographic material handled by the service. Only Windows Server 2025 (including Server Core installations) and Windows 11 24H2, 25H2, 26H1, and 26H2 builds older than the vendor-fixed build numbers are affected; Microsoft has released patches, and no public exploit identified at time of analysis. The CVSS 3.1 score of 5.5 (AV:L/PR:L/UI:N, high confidentiality impact only) alongside a CISA SSVC rating of no exploitation and not automatable places real-world urgency at a low level.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
Privilege escalation in the Windows Kernel allows an attacker with physical access to a Windows 11 version 26H1 device to elevate to SYSTEM-level privileges by supplying an untrusted pointer to a kernel routine. Only machines running Windows 11 26H1 builds from 10.0.28000.0 through 10.0.28000.3231 are affected, and the exploit requires hands-on interaction with the hardware (CVSS AV:P), with no authentication or user interaction needed once that access exists. Microsoft has shipped a fix in build 10.0.28000.3231; there is no public exploit code and no evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the EPSS-style urgency is tempered mainly by the physical-access prerequisite, which limits realistic exposure to lost, stolen, unattended, kiosk, or shared hardware rather than remote attack.
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Null pointer dereference in Windows Schannel - Microsoft's native TLS/SSL security package - allows an authenticated network attacker to crash the affected service on Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. The CVSS vector (AV:N/AC:H/PR:L) places this as a moderate-severity denial-of-service requiring valid credentials and non-trivial triggering conditions, with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.