Windows 11 26h1
Monthly
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Local privilege escalation in the Windows Health and Optimized Experiences Service on Windows 11 (24H2, 25H2, 26H1, 26H2) allows an authenticated low-privileged attacker to gain elevated privileges by exploiting missing authentication for a critical function (CWE-306). The service runs by default and requires no user interaction, with low attack complexity, but the attacker must already have local access; this is an escalation primitive, not a remote entry vector. No public exploit identified at time of analysis.
Use-after-free in the Windows Message Queuing (MSMQ) Queue Manager lets a locally authenticated, low-privilege attacker execute arbitrary code on the host, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating full loss of confidentiality, integrity and availability once the flaw is triggered. Exploitation is constrained: the MSMQ feature is not part of a default Windows installation, so the Queue Manager service must be deliberately deployed, and per the assessed vector the attacker must already hold local low-privilege access - there is no remote or anonymous path and no user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and this is assessed as a plausible but not top-tier priority because local-only access, prior authentication and the optional non-default MSMQ component collectively narrow realistic exposure to hosts where MSMQ is intentionally enabled and an attacker already has a foothold.
A local privilege escalation vulnerability in the Windows Storage VSP (Virtual Storage Provider) driver allows a low-privileged, authenticated attacker with existing code execution on a Windows host to elevate to SYSTEM-level privileges by triggering a use-after-free race condition in the driver. The flaw affects a broad range of Windows client and server platforms, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2016 through Windows Server 2025, and carries a CVSS 3.1 score of 7.8. Exploitation is difficult because it depends on winning a race condition (AC:H) and the CISA SSVC assessment rates it as not automatable with no known exploitation, so no public exploit code or active in-the-wild abuse has been identified at time of analysis.
Privilege escalation in the Windows kernel-mode drivers lets an authenticated attacker who already holds low-privileged local code execution on a host trigger a heap-based buffer overflow and elevate to SYSTEM-level rights. Affected are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds below their respective patched revisions. This is strictly a post-compromise local escalation (CVSS 3.1 7.8, AV:L/PR:L/UI:N) with no remote or network-facing attack surface; no public exploit code has been identified at time of analysis and there is no KEV listing, so it should be treated as a high-value chaining primitive rather than an initial-access vector.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.
Local privilege escalation in the Microsoft Windows Search Component (CWE-122 heap-based buffer overflow) allows an attacker who already holds a low-privileged, authenticated local foothold on a Windows host to corrupt heap memory and achieve high-impact code execution. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming the flaw is not remotely triggerable and needs no victim interaction, but does require the attacker to already be running code locally. Affected builds span Windows 10, Windows 11, and Windows Server 2012 through 2025; Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged execution or credentials on a host to abuse a use-after-free race in the driver and gain kernel-level (SYSTEM) privileges, per CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable driver ships and loads by default on every listed Windows 10, Windows 11 and Windows Server build, so no non-default feature or configuration has to be enabled to reach the code - but the high attack complexity reflects the fact that the freed object must be reclaimed inside a narrow timing window, which weakens real-world reliability and complicates weaponization. No public exploit code has been identified and there is no evidence of active exploitation (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has published fixes for the affected builds.
Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.
Local privilege escalation affecting Microsoft Windows builds that ship the vulnerable Python component allows an authenticated, low-privileged local user to elevate to SYSTEM-level rights, resulting in full loss of confidentiality, integrity, and availability on the host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely exploitable and requires a pre-existing foothold or valid local account on an unpatched build, with no user interaction needed once that access exists; there is no public exploit identified at time of analysis and no CISA KEV entry, so exploitation is currently a post-compromise escalation concern rather than a remote mass-exploitation risk. Patches are available from Microsoft for all listed Windows 10, Windows 11, and Windows Server builds, and systems at or above the fixed build numbers (for example Windows 11 24H2 at 10.0.26100.9711 or Windows Server 2022 at 10.0.20348.5761) are not exposed.
Local privilege escalation in the Windows Clipboard User Service lets an authenticated low-privileged attacker who can already run code on a target host raise their rights to SYSTEM-level by triggering a use-after-free in the service's memory handling. Exploitation is timing-sensitive rather than trivial: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker needs local authenticated access and must win a race to reclaim freed memory, but no victim interaction and no network path are required, and the resulting scope change means full compromise of confidentiality, integrity, and availability on the host. Microsoft has released fixed builds for all affected Windows branches, and as of analysis there is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); this is a moderate-priority, real-but-not-urgent elevation-of-privilege flaw that matters most on multi-user, RDP, or kiosk-style systems where untrusted users share a session host.
Local privilege escalation in the Windows Clipboard User Service allows an authenticated low-privileged attacker who already holds a foothold on the host to elevate to higher integrity via a use-after-free (CWE-416) in the service's object handling. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and because the Scope metric is Changed the successful exploit crosses a privilege boundary rather than merely corrupting the vulnerable process. Exploitation is constrained by high attack complexity - the attacker must win a timing window and reliably reclaim the freed object, so CISA's SSVC assessment rates it non-automatable with exploitation observed as none, and no public exploit code has been identified at time of analysis. All supported Windows 10, Windows 11 and Windows Server branches up to the January-class build cutoffs listed in the advisory are affected, and a vendor patch is available.
Local privilege escalation in the Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privilege attacker with an existing foothold on the host to trigger a use-after-free in the queue manager and elevate to SYSTEM (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, requires MSMQ - an optional Windows component that is not installed or running by default - and provides no path to initial access, so the realistically exposed population is limited to hosts where MSMQ is enabled and to attackers who have already obtained a local account. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a vendor patch; the risk is credible but not a drop-everything emergency.
Local privilege escalation in the Windows Win32k kernel subsystem allows an attacker who already holds a low-privileged local account on an affected Windows 11 or Windows Server build to trigger an out-of-bounds kernel read that Microsoft rates as elevation of privilege with High confidentiality, integrity, and availability impact. Exploitation requires local authenticated access (AV:L, PR:L) and no user interaction (UI:N), but the High attack complexity (AC:H) indicates success likely depends on winning a race or arranging a specific kernel memory state, so it is not reliably repeatable. There is no public exploit identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the CVSS 7.8 (High) score reflects severe technical impact rather than an imminent, easily triggered attack.
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
Privilege escalation in the Windows DWM Core Library lets a locally authenticated attacker with only low-level privileges raise their rights on an affected host by triggering a use-after-free (CWE-416) in the Desktop Window Manager's core component. Successful exploitation is constrained by high attack complexity (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), meaning it depends on winning a race/timing window and arranging a specific memory layout, so it is expected to be unreliable per attempt rather than a guaranteed escalation. This is a post-access escalation path rather than a remote entry point: the attacker must already hold a standard/interactive foothold on an unpatched build, and no user interaction is required. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.
Local privilege escalation in Windows SmartScreen allows an authenticated attacker holding only standard-user rights to trigger a use-after-free in the reputation-checking component and escalate to a high-integrity context on an unpatched host. The flaw is rated CVSS 7.8 (HIGH) with full confidentiality, integrity, and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is exploitable locally without user interaction but requires an existing low-privileged session, so it functions as a post-compromise escalation step rather than a remote initial-access vector. Affected builds span Windows 11 23H2 through 26H2 and Windows Server 2025; Microsoft has published vendor patches that raise the OS build above the vulnerable thresholds, and no public exploit code was identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a Windows 11 version 26H1 host (builds from 10.0.28000.0 up to, but not including, 10.0.28000.3231) to raise their privileges to kernel/SYSTEM level. The defect is a release of an invalid pointer or reference (CWE-763), which under the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H requires no user interaction and no non-default configuration, so any standard interactive or service account able to run code can attempt it. Successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; Microsoft has published a vendor fix through the MSRC update guide, making this a patch-priority item rather than an emergency one, with the mandatory prior local foothold being the primary limiting factor.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) allows an authenticated, low-privileged attacker who already has code execution on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to SYSTEM-level privileges by planting a symbolic link, junction, or hardlink at a path the service later resolves during a privileged file operation. The issue is a classic link-following flaw (CWE-59) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and no user interaction, and the affected service runs by default on all listed builds, so multi-user and shared hosts are the realistic exposure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); vendor patches are available, making this a credible operational priority but not an emergency.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker who already holds a low-privilege foothold on a Windows host to leverage an externally-controlled format string and reach full SYSTEM-level code execution. Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the only meaningful barrier is the local, authenticated prerequisite: it is not remotely reachable and requires no user interaction. Our independent assessment rates this a credible but not top-tier priority, and no public exploit code has been identified at time of analysis; the vendor has released a patch.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on a vulnerable build to trigger an out-of-bounds read that the vendor rates as full-impact (C:H/I:H/A:H) on confidentiality, integrity, and availability. Only pre-patch builds of Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), are affected; patched builds are not exploitable, so this functions as a post-compromise escalation step rather than an initial access vector. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS 7.8 (HIGH) score and the low-privilege local prerequisite make it a realistic follow-on step after a workstation or server foothold, and Microsoft has released fixes.
A use-after-free in the Windows Kernel lets an authenticated, low-privileged local attacker escalate to kernel-level (SYSTEM) privileges on affected Windows 11 and Windows Server 2025 builds. Exploitation requires an existing local foothold on the host and cannot be triggered remotely, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no user interaction is required and attack complexity is low (CVSS 7.8, AV:L/PR:L/UI:N). Microsoft has released fixes that raise the kernel build numbers listed in the advisory, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in the Windows Modern Device Management (MDM) component allows an authenticated low-privileged user who already has code execution on a Windows host to gain SYSTEM-level privileges by triggering a use-after-free in the MDM code path. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning it is not remotely reachable, requires no victim interaction, and depends on the attacker already holding a local foothold; successful exploitation also requires winning the heap-reuse race to reclaim the freed object. Consistent with our independent assessment this is a moderate-priority local escalation issue, and no public exploit identified at time of analysis; Microsoft has released patches through its update guide.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
Local privilege escalation in the Microsoft Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged authenticated session on a Windows host to elevate to SYSTEM-level privileges by triggering a double-free memory corruption in the service. The flaw (CWE-415, CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affects the full range of supported Windows 10, Windows 11, and Windows Server releases enumerated in the EUVD data, including Server 2012 through Server 2025. Microsoft has published a vendor patch (MSRC update guide for CVE-2026-85829); CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so this is a post-access escalation risk rather than a wormable or remote-entry issue.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
Local privilege escalation in Windows Composite Image File System (CimFS) affects Windows 11 24H2, 25H2, 26H1, and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core). An authenticated attacker who already has local access and standard user privileges (CVSS PR:L) and the ability to execute code that interacts with the CimFS driver can trigger a use-after-free (CWE-416) for high confidentiality, integrity, and availability impact inside the OS, though High attack complexity (AC:H) makes reliable exploitation dependent on winning a memory-reclamation race. Patch available per vendor advisory; no public exploit identified at time of analysis, and this is a medium-to-high priority local privilege escalation rather than a drop-everything emergency.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem lets an attacker who already holds low-privileged code execution on a host escalate to full kernel-level (SYSTEM) privileges on unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and on Windows Server 2025, including Server Core installs. The underlying defect is a use-after-free (CWE-416) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the access vector is strictly local and the attacker must already be an authenticated user on the machine, so this is a post-foothold escalation rather than a remotely reachable bug, and no user interaction is needed. At time of analysis there is no public exploit code and no public exploit identified at time of analysis, and Microsoft has published vendor patches; exploitation would require reliably winning the object-reuse condition in kernel memory, and a failed attempt is likely to crash the host rather than succeed silently.
Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Local privilege elevation in Microsoft Hyper-V allows a low-privileged, authenticated attacker on a Hyper-V-enabled Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read and gain elevated privileges. The CVSS 8.8 score reflects local access, no user interaction, scope change, and high confidentiality, integrity, and availability impact, but exploitation requires an existing local foothold and active Hyper-V. No public exploit has been identified at time of analysis, EPSS is 0.33%, and CISA SSVC records exploitation as none and automatable as no.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Performance Monitor (CWE-94 code injection) lets an attacker who already holds authenticated low-privileged access to a Windows host run code in a higher-privileged context, yielding full confidentiality, integrity and availability impact on that machine at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds include Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through Server 2025 (Server Core variants included) below their respective fixed build numbers. The attack is local-only and requires no victim interaction, so it is a post-compromise escalation path rather than an initial-access vector; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, though CISA rates the technical impact as total. Vendor patches are available from Microsoft via the MSRC update guide.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows Phone Service on Windows 11 (23H2 through 26H2) and Windows Server 2022 lets an authenticated, low-privileged user on the machine win a race condition in a shared resource and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable and requires a pre-existing local account, and the AC:H rating reflects that a narrow, non-deterministic synchronization window must be won reliably - typically over many repeated attempts - so this is a patch-cycle item rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no). Vendor patches are available per the MSRC advisory.
Local privilege escalation in the Windows Volume Manager Extension Driver (volmgrx) lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger an out-of-bounds read and escalate to full control of the machine, carrying a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected driver ships by default across an unusually wide range of releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, and Microsoft has published fixes through its MSRC Update Guide. Exploitation requires a pre-existing local foothold and cannot be triggered remotely, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates it Exploitation: none and Automatable: no, making this a moderate post-compromise hardening priority rather than an emergency.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.
An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.
Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.
A local privilege-escalation flaw in the Windows Hyper-V hypervisor's file-access path (CWE-59, improper link resolution) allows an attacker who already holds authenticated low-privileged code execution on a Hyper-V-enabled host to have a privileged operation follow an attacker-planted symbolic link, junction, or hard link, resulting in full loss of confidentiality and integrity (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H). Impact is limited to systems where the Hyper-V role is actually installed or enabled, since non-virtualization Windows installs do not expose the vulnerable component; exploitation is not remote and requires a pre-existing foothold. No public exploit was identified at time of analysis and CISA SSVC rates the issue as not automatable, though a vendor patch is available per Microsoft's advisory. Because the escalation yields SYSTEM-level access on virtualization hosts, the effective blast radius is high wherever Hyper-V underpins tenant or workload isolation.
Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Local privilege escalation in the Windows Health and Optimized Experiences Service on Windows 11 (24H2, 25H2, 26H1, 26H2) allows an authenticated low-privileged attacker to gain elevated privileges by exploiting missing authentication for a critical function (CWE-306). The service runs by default and requires no user interaction, with low attack complexity, but the attacker must already have local access; this is an escalation primitive, not a remote entry vector. No public exploit identified at time of analysis.
Use-after-free in the Windows Message Queuing (MSMQ) Queue Manager lets a locally authenticated, low-privilege attacker execute arbitrary code on the host, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating full loss of confidentiality, integrity and availability once the flaw is triggered. Exploitation is constrained: the MSMQ feature is not part of a default Windows installation, so the Queue Manager service must be deliberately deployed, and per the assessed vector the attacker must already hold local low-privilege access - there is no remote or anonymous path and no user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and this is assessed as a plausible but not top-tier priority because local-only access, prior authentication and the optional non-default MSMQ component collectively narrow realistic exposure to hosts where MSMQ is intentionally enabled and an attacker already has a foothold.
A local privilege escalation vulnerability in the Windows Storage VSP (Virtual Storage Provider) driver allows a low-privileged, authenticated attacker with existing code execution on a Windows host to elevate to SYSTEM-level privileges by triggering a use-after-free race condition in the driver. The flaw affects a broad range of Windows client and server platforms, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2016 through Windows Server 2025, and carries a CVSS 3.1 score of 7.8. Exploitation is difficult because it depends on winning a race condition (AC:H) and the CISA SSVC assessment rates it as not automatable with no known exploitation, so no public exploit code or active in-the-wild abuse has been identified at time of analysis.
Privilege escalation in the Windows kernel-mode drivers lets an authenticated attacker who already holds low-privileged local code execution on a host trigger a heap-based buffer overflow and elevate to SYSTEM-level rights. Affected are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds below their respective patched revisions. This is strictly a post-compromise local escalation (CVSS 3.1 7.8, AV:L/PR:L/UI:N) with no remote or network-facing attack surface; no public exploit code has been identified at time of analysis and there is no KEV listing, so it should be treated as a high-value chaining primitive rather than an initial-access vector.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.
Local privilege escalation in the Microsoft Windows Search Component (CWE-122 heap-based buffer overflow) allows an attacker who already holds a low-privileged, authenticated local foothold on a Windows host to corrupt heap memory and achieve high-impact code execution. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming the flaw is not remotely triggerable and needs no victim interaction, but does require the attacker to already be running code locally. Affected builds span Windows 10, Windows 11, and Windows Server 2012 through 2025; Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged execution or credentials on a host to abuse a use-after-free race in the driver and gain kernel-level (SYSTEM) privileges, per CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable driver ships and loads by default on every listed Windows 10, Windows 11 and Windows Server build, so no non-default feature or configuration has to be enabled to reach the code - but the high attack complexity reflects the fact that the freed object must be reclaimed inside a narrow timing window, which weakens real-world reliability and complicates weaponization. No public exploit code has been identified and there is no evidence of active exploitation (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has published fixes for the affected builds.
Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.
Local privilege escalation affecting Microsoft Windows builds that ship the vulnerable Python component allows an authenticated, low-privileged local user to elevate to SYSTEM-level rights, resulting in full loss of confidentiality, integrity, and availability on the host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely exploitable and requires a pre-existing foothold or valid local account on an unpatched build, with no user interaction needed once that access exists; there is no public exploit identified at time of analysis and no CISA KEV entry, so exploitation is currently a post-compromise escalation concern rather than a remote mass-exploitation risk. Patches are available from Microsoft for all listed Windows 10, Windows 11, and Windows Server builds, and systems at or above the fixed build numbers (for example Windows 11 24H2 at 10.0.26100.9711 or Windows Server 2022 at 10.0.20348.5761) are not exposed.
Local privilege escalation in the Windows Clipboard User Service lets an authenticated low-privileged attacker who can already run code on a target host raise their rights to SYSTEM-level by triggering a use-after-free in the service's memory handling. Exploitation is timing-sensitive rather than trivial: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker needs local authenticated access and must win a race to reclaim freed memory, but no victim interaction and no network path are required, and the resulting scope change means full compromise of confidentiality, integrity, and availability on the host. Microsoft has released fixed builds for all affected Windows branches, and as of analysis there is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); this is a moderate-priority, real-but-not-urgent elevation-of-privilege flaw that matters most on multi-user, RDP, or kiosk-style systems where untrusted users share a session host.
Local privilege escalation in the Windows Clipboard User Service allows an authenticated low-privileged attacker who already holds a foothold on the host to elevate to higher integrity via a use-after-free (CWE-416) in the service's object handling. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and because the Scope metric is Changed the successful exploit crosses a privilege boundary rather than merely corrupting the vulnerable process. Exploitation is constrained by high attack complexity - the attacker must win a timing window and reliably reclaim the freed object, so CISA's SSVC assessment rates it non-automatable with exploitation observed as none, and no public exploit code has been identified at time of analysis. All supported Windows 10, Windows 11 and Windows Server branches up to the January-class build cutoffs listed in the advisory are affected, and a vendor patch is available.
Local privilege escalation in the Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privilege attacker with an existing foothold on the host to trigger a use-after-free in the queue manager and elevate to SYSTEM (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, requires MSMQ - an optional Windows component that is not installed or running by default - and provides no path to initial access, so the realistically exposed population is limited to hosts where MSMQ is enabled and to attackers who have already obtained a local account. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a vendor patch; the risk is credible but not a drop-everything emergency.
Local privilege escalation in the Windows Win32k kernel subsystem allows an attacker who already holds a low-privileged local account on an affected Windows 11 or Windows Server build to trigger an out-of-bounds kernel read that Microsoft rates as elevation of privilege with High confidentiality, integrity, and availability impact. Exploitation requires local authenticated access (AV:L, PR:L) and no user interaction (UI:N), but the High attack complexity (AC:H) indicates success likely depends on winning a race or arranging a specific kernel memory state, so it is not reliably repeatable. There is no public exploit identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the CVSS 7.8 (High) score reflects severe technical impact rather than an imminent, easily triggered attack.
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
Privilege escalation in the Windows DWM Core Library lets a locally authenticated attacker with only low-level privileges raise their rights on an affected host by triggering a use-after-free (CWE-416) in the Desktop Window Manager's core component. Successful exploitation is constrained by high attack complexity (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), meaning it depends on winning a race/timing window and arranging a specific memory layout, so it is expected to be unreliable per attempt rather than a guaranteed escalation. This is a post-access escalation path rather than a remote entry point: the attacker must already hold a standard/interactive foothold on an unpatched build, and no user interaction is required. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.
Local privilege escalation in Windows SmartScreen allows an authenticated attacker holding only standard-user rights to trigger a use-after-free in the reputation-checking component and escalate to a high-integrity context on an unpatched host. The flaw is rated CVSS 7.8 (HIGH) with full confidentiality, integrity, and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is exploitable locally without user interaction but requires an existing low-privileged session, so it functions as a post-compromise escalation step rather than a remote initial-access vector. Affected builds span Windows 11 23H2 through 26H2 and Windows Server 2025; Microsoft has published vendor patches that raise the OS build above the vulnerable thresholds, and no public exploit code was identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a Windows 11 version 26H1 host (builds from 10.0.28000.0 up to, but not including, 10.0.28000.3231) to raise their privileges to kernel/SYSTEM level. The defect is a release of an invalid pointer or reference (CWE-763), which under the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H requires no user interaction and no non-default configuration, so any standard interactive or service account able to run code can attempt it. Successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; Microsoft has published a vendor fix through the MSRC update guide, making this a patch-priority item rather than an emergency one, with the mandatory prior local foothold being the primary limiting factor.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) allows an authenticated, low-privileged attacker who already has code execution on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to SYSTEM-level privileges by planting a symbolic link, junction, or hardlink at a path the service later resolves during a privileged file operation. The issue is a classic link-following flaw (CWE-59) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and no user interaction, and the affected service runs by default on all listed builds, so multi-user and shared hosts are the realistic exposure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); vendor patches are available, making this a credible operational priority but not an emergency.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker who already holds a low-privilege foothold on a Windows host to leverage an externally-controlled format string and reach full SYSTEM-level code execution. Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the only meaningful barrier is the local, authenticated prerequisite: it is not remotely reachable and requires no user interaction. Our independent assessment rates this a credible but not top-tier priority, and no public exploit code has been identified at time of analysis; the vendor has released a patch.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on a vulnerable build to trigger an out-of-bounds read that the vendor rates as full-impact (C:H/I:H/A:H) on confidentiality, integrity, and availability. Only pre-patch builds of Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), are affected; patched builds are not exploitable, so this functions as a post-compromise escalation step rather than an initial access vector. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS 7.8 (HIGH) score and the low-privilege local prerequisite make it a realistic follow-on step after a workstation or server foothold, and Microsoft has released fixes.
A use-after-free in the Windows Kernel lets an authenticated, low-privileged local attacker escalate to kernel-level (SYSTEM) privileges on affected Windows 11 and Windows Server 2025 builds. Exploitation requires an existing local foothold on the host and cannot be triggered remotely, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no user interaction is required and attack complexity is low (CVSS 7.8, AV:L/PR:L/UI:N). Microsoft has released fixes that raise the kernel build numbers listed in the advisory, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in the Windows Modern Device Management (MDM) component allows an authenticated low-privileged user who already has code execution on a Windows host to gain SYSTEM-level privileges by triggering a use-after-free in the MDM code path. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning it is not remotely reachable, requires no victim interaction, and depends on the attacker already holding a local foothold; successful exploitation also requires winning the heap-reuse race to reclaim the freed object. Consistent with our independent assessment this is a moderate-priority local escalation issue, and no public exploit identified at time of analysis; Microsoft has released patches through its update guide.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
Local privilege escalation in the Microsoft Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged authenticated session on a Windows host to elevate to SYSTEM-level privileges by triggering a double-free memory corruption in the service. The flaw (CWE-415, CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affects the full range of supported Windows 10, Windows 11, and Windows Server releases enumerated in the EUVD data, including Server 2012 through Server 2025. Microsoft has published a vendor patch (MSRC update guide for CVE-2026-85829); CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so this is a post-access escalation risk rather than a wormable or remote-entry issue.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
Local privilege escalation in Windows Composite Image File System (CimFS) affects Windows 11 24H2, 25H2, 26H1, and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core). An authenticated attacker who already has local access and standard user privileges (CVSS PR:L) and the ability to execute code that interacts with the CimFS driver can trigger a use-after-free (CWE-416) for high confidentiality, integrity, and availability impact inside the OS, though High attack complexity (AC:H) makes reliable exploitation dependent on winning a memory-reclamation race. Patch available per vendor advisory; no public exploit identified at time of analysis, and this is a medium-to-high priority local privilege escalation rather than a drop-everything emergency.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem lets an attacker who already holds low-privileged code execution on a host escalate to full kernel-level (SYSTEM) privileges on unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and on Windows Server 2025, including Server Core installs. The underlying defect is a use-after-free (CWE-416) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the access vector is strictly local and the attacker must already be an authenticated user on the machine, so this is a post-foothold escalation rather than a remotely reachable bug, and no user interaction is needed. At time of analysis there is no public exploit code and no public exploit identified at time of analysis, and Microsoft has published vendor patches; exploitation would require reliably winning the object-reuse condition in kernel memory, and a failed attempt is likely to crash the host rather than succeed silently.
Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Local privilege elevation in Microsoft Hyper-V allows a low-privileged, authenticated attacker on a Hyper-V-enabled Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read and gain elevated privileges. The CVSS 8.8 score reflects local access, no user interaction, scope change, and high confidentiality, integrity, and availability impact, but exploitation requires an existing local foothold and active Hyper-V. No public exploit has been identified at time of analysis, EPSS is 0.33%, and CISA SSVC records exploitation as none and automatable as no.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Performance Monitor (CWE-94 code injection) lets an attacker who already holds authenticated low-privileged access to a Windows host run code in a higher-privileged context, yielding full confidentiality, integrity and availability impact on that machine at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds include Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through Server 2025 (Server Core variants included) below their respective fixed build numbers. The attack is local-only and requires no victim interaction, so it is a post-compromise escalation path rather than an initial-access vector; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, though CISA rates the technical impact as total. Vendor patches are available from Microsoft via the MSRC update guide.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows Phone Service on Windows 11 (23H2 through 26H2) and Windows Server 2022 lets an authenticated, low-privileged user on the machine win a race condition in a shared resource and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable and requires a pre-existing local account, and the AC:H rating reflects that a narrow, non-deterministic synchronization window must be won reliably - typically over many repeated attempts - so this is a patch-cycle item rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no). Vendor patches are available per the MSRC advisory.
Local privilege escalation in the Windows Volume Manager Extension Driver (volmgrx) lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger an out-of-bounds read and escalate to full control of the machine, carrying a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected driver ships by default across an unusually wide range of releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, and Microsoft has published fixes through its MSRC Update Guide. Exploitation requires a pre-existing local foothold and cannot be triggered remotely, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates it Exploitation: none and Automatable: no, making this a moderate post-compromise hardening priority rather than an emergency.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.
An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.
Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.
A local privilege-escalation flaw in the Windows Hyper-V hypervisor's file-access path (CWE-59, improper link resolution) allows an attacker who already holds authenticated low-privileged code execution on a Hyper-V-enabled host to have a privileged operation follow an attacker-planted symbolic link, junction, or hard link, resulting in full loss of confidentiality and integrity (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H). Impact is limited to systems where the Hyper-V role is actually installed or enabled, since non-virtualization Windows installs do not expose the vulnerable component; exploitation is not remote and requires a pre-existing foothold. No public exploit was identified at time of analysis and CISA SSVC rates the issue as not automatable, though a vendor patch is available per Microsoft's advisory. Because the escalation yields SYSTEM-level access on virtualization hosts, the effective blast radius is high wherever Hyper-V underpins tenant or workload isolation.
Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.