Windows 11 26h1
Monthly
Symlink-following in Windows Container Manager Service allows a local low-privileged authenticated user to bypass a security feature and read files outside the intended access boundary. Affected are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across specific build ranges, per EUVD. Impact is limited to confidentiality (C:H), with no integrity or availability consequence. No public exploit code and no CISA KEV listing are present at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local information disclosure in the Windows MIDI Service Module allows a low-privileged authenticated local user to read sensitive system information outside its intended authorization boundary. Affecting Windows 11 versions 24H2, 25H2, and 26H1, the flaw (CWE-497) enables an attacker already present on the system to extract data that should be inaccessible to their privilege level. Microsoft has released patches for all three affected branches; no public exploit code or active exploitation has been identified.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Local information disclosure in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows a low-privileged authenticated local attacker to read sensitive data outside their authorized security scope. The CVSS scope-change metric (S:C) indicates the exposed data originates from a security domain beyond the telemetry component itself - likely higher-privileged OS subsystem data. Affecting Windows 10, Windows 11, and Windows Server 2019/2022/2025 across all mainstream support channels, Microsoft has released patches via the standard Patch Tuesday cadence. No public exploit identified at time of analysis.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Network Connection Broker service allows a local authenticated attacker to read stale heap memory, disclosing potentially sensitive information. The vulnerability spans every supported Windows client and server release from Windows 10 1607 and Windows Server 2016 through Windows 11 25H2 and Windows Server 2025, making the exposed surface extremely broad. Microsoft has shipped patched cumulative updates for all affected SKUs; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Sensitive information disclosure in the Windows Program Compatibility Assistant (PCA) Service allows a locally authenticated attacker with standard user privileges to read sensitive data written to log files. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both full and Server Core configurations. No public exploit code or active exploitation has been identified at time of analysis, and vendor-released patches are available via Microsoft's update guide.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Out-of-bounds read in the Windows Bluetooth Port Driver (bthport.sys) allows a local, low-privileged authenticated attacker to disclose kernel memory contents under high-complexity conditions. Affected platforms span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 across specific build thresholds confirmed by EUVD version data. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis, constraining real-world risk to post-compromise or insider scenarios.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Information disclosure in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, allowing a locally authenticated low-privileged attacker to read sensitive system information that should remain within an authorized control sphere. The vulnerability (CWE-497) requires no user interaction and is limited to local attack vectors with no integrity or availability impact. Microsoft has released patches addressing all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Windows PowerShell (CWE-22) enables network-based security feature bypass across virtually all supported Windows releases, from Server 2012 through Windows Server 2025 and Windows 11 26H2. The flaw allows an unauthenticated remote attacker - contingent on user interaction - to write files outside a restricted directory, circumventing a Windows security boundary with high integrity impact and no direct confidentiality or availability consequence. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the broad affected surface across all major Windows versions warrants prompt patching.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged, authenticated network attacker to crash the service and deny domain authentication. The flaw affects a broad range of Windows Server versions from Windows Server 2012 through Windows Server 2025 as well as Windows 10 and Windows 11 client platforms configured with the AD DS role. Microsoft has issued patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Symlink-following in Windows Container Manager Service allows a local low-privileged authenticated user to bypass a security feature and read files outside the intended access boundary. Affected are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across specific build ranges, per EUVD. Impact is limited to confidentiality (C:H), with no integrity or availability consequence. No public exploit code and no CISA KEV listing are present at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local information disclosure in the Windows MIDI Service Module allows a low-privileged authenticated local user to read sensitive system information outside its intended authorization boundary. Affecting Windows 11 versions 24H2, 25H2, and 26H1, the flaw (CWE-497) enables an attacker already present on the system to extract data that should be inaccessible to their privilege level. Microsoft has released patches for all three affected branches; no public exploit code or active exploitation has been identified.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Local information disclosure in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows a low-privileged authenticated local attacker to read sensitive data outside their authorized security scope. The CVSS scope-change metric (S:C) indicates the exposed data originates from a security domain beyond the telemetry component itself - likely higher-privileged OS subsystem data. Affecting Windows 10, Windows 11, and Windows Server 2019/2022/2025 across all mainstream support channels, Microsoft has released patches via the standard Patch Tuesday cadence. No public exploit identified at time of analysis.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Network Connection Broker service allows a local authenticated attacker to read stale heap memory, disclosing potentially sensitive information. The vulnerability spans every supported Windows client and server release from Windows 10 1607 and Windows Server 2016 through Windows 11 25H2 and Windows Server 2025, making the exposed surface extremely broad. Microsoft has shipped patched cumulative updates for all affected SKUs; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Sensitive information disclosure in the Windows Program Compatibility Assistant (PCA) Service allows a locally authenticated attacker with standard user privileges to read sensitive data written to log files. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both full and Server Core configurations. No public exploit code or active exploitation has been identified at time of analysis, and vendor-released patches are available via Microsoft's update guide.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Out-of-bounds read in the Windows Bluetooth Port Driver (bthport.sys) allows a local, low-privileged authenticated attacker to disclose kernel memory contents under high-complexity conditions. Affected platforms span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 across specific build thresholds confirmed by EUVD version data. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis, constraining real-world risk to post-compromise or insider scenarios.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Information disclosure in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, allowing a locally authenticated low-privileged attacker to read sensitive system information that should remain within an authorized control sphere. The vulnerability (CWE-497) requires no user interaction and is limited to local attack vectors with no integrity or availability impact. Microsoft has released patches addressing all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Windows PowerShell (CWE-22) enables network-based security feature bypass across virtually all supported Windows releases, from Server 2012 through Windows Server 2025 and Windows 11 26H2. The flaw allows an unauthenticated remote attacker - contingent on user interaction - to write files outside a restricted directory, circumventing a Windows security boundary with high integrity impact and no direct confidentiality or availability consequence. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the broad affected surface across all major Windows versions warrants prompt patching.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged, authenticated network attacker to crash the service and deny domain authentication. The flaw affects a broad range of Windows Server versions from Windows Server 2012 through Windows Server 2025 as well as Windows 10 and Windows 11 client platforms configured with the AD DS role. Microsoft has issued patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.