Windows 11 26h1
Monthly
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) stems from a use-after-free memory-safety flaw (CWE-416) that an attacker with low-privileged local access can trigger to gain SYSTEM-level code execution. Real-world exposure is narrow: RRAS is not installed or running by default, so only hosts configured as VPN, NAT, or routing gateways are realistic targets, and exploitation depends on winning a timing race (CVSS AV:L/AC:H/PR:L, high attack complexity), which CISA SSVC assesses as not automatable with no observed exploitation. Microsoft has released a vendor patch, and no public exploit identified at time of analysis - this is a moderate-priority, not emergency, vulnerability whose practical risk sits below what the 7.0 base score alone suggests.
Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
Denial of service in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to crash the service by sending crafted network traffic that triggers a null pointer dereference, taking down routing, VPN, NAT, and dial-up functions on the host. Per the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), exploitation requires no credentials and no user interaction, and the impact is confined to availability with no confidentiality or integrity effect. The practical limitation is deployment: RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or NAT/dial-up endpoints with a reachable listener are exposed; CISA's SSVC assessment rates exploitation as 'none' and no public exploit has been identified at time of analysis, though the attack is automatable and a vendor patch is available.
Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Local privilege escalation in the Windows Telephony Server (TAPI) allows an authenticated, low-privileged local user to gain elevated rights - potentially SYSTEM - by triggering a use-after-free in the telephony stack. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the EUVD data below the vendor's patched build levels are affected, and because the vulnerable component is present by default, exposure is broad even though the attack is not remote. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier priority: it only becomes dangerous after an attacker has already obtained a foothold on the host and can interact with the TAPI service.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.
Local privilege escalation in the Windows Update Orchestrator Service on unpatched Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets a local, low-privileged attacker who can already run code on the host win a heap race condition and elevate to SYSTEM. The defect is a use-after-free (CWE-416) with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and CISA's SSVC assessment records Exploitation=none and Automatable=no, meaning the race is unreliable and must be won manually rather than triggered by a repeatable exploit chain. There is no public exploit code identified at time of analysis, so this is a moderate-priority patch-and-move-on item rather than an emergency, though the vendor has made a fix available.
Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.
An out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows a network-positioned attacker to corrupt memory in a high-privilege system process and execute arbitrary code, with the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicating a low-privilege authenticated attacker, no user interaction, and full confidentiality, integrity, and availability impact. The affected surface spans essentially the entire supported Windows fleet, from Windows Server 2012/2012 R2 and Windows 10 1607 through Windows 11 26H2 and Windows Server 2025, so unpatched domain controllers and member servers are the highest-value targets. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none and the flaw as non-automatable, meaning exploitation is not trivial to script at scale; Microsoft has released fixed builds for all affected branches.
Link-following flaw in Windows Registry allows an authenticated local attacker with low-privileged code execution to elevate privileges by manipulating symbolic links, junctions, or Registry link objects that a higher-privileged Windows process resolves. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed versions listed in the vendor advisory. No public exploit identified at time of analysis, and this is assessed as a credible but not emergency-level priority; vendor patches are available and should be applied.
Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Local privilege escalation in Microsoft Windows DirectComposition lets an authenticated attacker who already holds low-privileged code execution on a host trigger a use-after-free in the desktop composition engine and gain code execution at a higher integrity level. Affected are supported Windows client and server builds prior to the fixed builds listed in the vendor advisory, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022 and Windows Server 2025 (including Server Core). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment marks the issue as non-automatable, making this a genuine but non-emergency patching priority rather than a drop-everything emergency.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.
Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.
Memory corruption in Microsoft XML (MSXML) allows an unauthenticated remote attacker to execute arbitrary code in the context of whatever process parses attacker-supplied XML, with high impact to confidentiality, integrity, and availability (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are supported Windows client and server editions - including Server Core installs - running builds older than the fixed levels catalogued in EUVD-2026-99433 and the MSRC advisory, from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025. Microsoft has shipped vendor fixes, and there is no public exploit identified at time of analysis: CISA's SSVC entry records exploitation as 'none' and marks the flaw as not automatable, though the HIGH attack complexity reflects that a reliable use-after-free requires precise heap grooming and, in practice, an XML-rendering or XML-consuming path must be reached.
Local privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged, authenticated session on a vulnerable host gain full SYSTEM-level control by triggering a use-after-free (CWE-416) in kernel memory handling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unpatched population covers Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 and Windows Server 2022/2025, with fixes recorded in EUVD-2026-100051 that raise builds such as Windows 11 24H2 to 10.0.26100.9711, Server 2025 to 10.0.26100.33650 and Windows 10 to 10.0.19044.7807. Patch available per vendor advisory; no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with automatability as no, although technical impact is rated total.
Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.
Local privilege escalation in the Windows RPC Runtime lets an attacker who already holds a low-privileged local account on a Windows host free an invalid pointer or reference (CWE-763) inside the RPC code path and turn that memory-management error into SYSTEM-level code execution on the same machine (CVSS 7.0, AV:L/PR:L/UI:N/S:U). Exploitation is gated by high attack complexity (AC:H), which is consistent with a race/timing-dependent condition rather than a reliable one-shot primitive, and it cannot be reached remotely or by an unauthenticated user. No public exploit code or confirmed active exploitation has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes through its monthly update channel, so this is a genuine but non-urgent patching priority concentrated on multi-user, RDP and jump hosts where untrusted standard users can log on locally.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to corrupt kernel memory and elevate to SYSTEM. The flaw is a use-after-free (CWE-416) requiring a race-condition-style trigger, reflected in the CVSS vector AV:L/AC:H/PR:L/UI:N (7.0 High) and the CISA SSVC assessment of Exploitation: none and Automatable: no - there is no remote path, no user interaction, and no public exploit identified at time of analysis. It was not added to CISA KEV, and vendor-supplied patches are available; affected builds are specific Windows 11 23H2 through 26H2 releases and Windows Server 2025 (including Server Core) below the fixed build numbers, while patched builds are not exploitable. Independent assessment rates this as a genuine but not emergency-grade priority best handled through routine monthly patching.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Windows CD-ROM Driver (cdrom.sys) contains a buffer over-read (CWE-126) that can disclose kernel memory and, per the vendor's threat model, be exploited by an unauthenticated remote attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds. Our independent assessment keeps AV:N/PR:N/UI:N but raises attack complexity to High and reduces integrity/availability impact to Low, because exploitation requires reaching the driver's input-handling path and the over-read primitive mainly yields disclosure rather than guaranteed code execution; CISA SSVC records no observed exploitation, no public exploit identified at time of analysis, and EPSS is low at 0.89% (58th percentile). Microsoft has released fixed builds, so affected systems should be patched per the MSRC advisory.
Local privilege escalation in the Windows Update Orchestrator Service (UsoSvc) on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a standard, low-privileged local account to trigger a use-after-free in the service and elevate to the service's high-privilege (LocalSystem) context. There is no remote or unauthenticated path: the CVSS vector (AV:L/PR:L) confirms the attacker must already be logged on locally with low privileges, and the high attack complexity (AC:H) reflects that success depends on winning a timing-dependent memory-reuse race, which usually requires repeated attempts rather than a single deterministic trigger. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none), and vendor patches are available, so this is a genuine but second-tier priority concentrated on shared, multi-user, or terminal-server hosts where untrusted users hold standard accounts.
Local privilege escalation in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds code execution as any logged-on user to raise privileges to kernel/SYSTEM level. The defect is a use-after-free (CWE-416) in a subsystem present in default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025, requiring no user interaction once a local foothold exists, though it cannot be triggered remotely and grants no initial access on its own. Microsoft has released vendor patches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.
Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.
Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.
Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.
Remote code execution may be possible in the Windows Event Logging Service on affected Windows 11 and Windows Server builds, where an unauthenticated network attacker can trigger an out-of-bounds read under specific memory-layout or timing conditions (CVSS 8.1, AC:H). Windows 11 23H2 through 26H2 and Windows Server 2022/2025 are affected below vendor-fixed build revisions, and a vendor patch is available. No public exploit was identified at time of analysis; CISA SSVC reports Exploitation=none and Automatable=no, and EPSS is 0.57% (46th percentile), so risk is serious but not emergency-level.
Denial of service in the Windows WLAN Service affects Windows 11 builds 23H2 through 26H2 and Windows Server 2025, where an integer underflow in the wireless networking component can be triggered by an unauthenticated attacker to exhaust or crash the service. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), no credentials or user interaction are required and the sole impact is loss of availability, with the practical gating factor being reachability of the WLAN stack rather than direct internet exposure; no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none, and vendor patches are available. CISA's SSVC also flags the issue as Automatable: yes with partial technical impact, making it a moderate-priority patching item for wireless-capable endpoints and servers.
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
Local privilege escalation in the Windows Bind Filter Driver (bflt.sys), a core kernel-mode component, allows an authenticated low-privileged attacker with existing code execution on a target host to escalate to SYSTEM-level privileges through a use-after-free condition (CWE-416). Exploitation is not trivial: the flaw is a race condition requiring precisely timed reclamation of a freed kernel object, reflected in the high attack-complexity rating of the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 7.0), and the attacker must already hold local access (AV:L, PR:L) - this is a post-compromise escalation primitive, not a remote entry vector. No public exploit code was identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but second-tier priority relative to actively exploited kernel flaws; it nonetheless affects default installations of Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core) until patched.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).
Local privilege escalation in Microsoft Windows is possible because the COM+ Event System Service dereferences an untrusted pointer (CWE-822), allowing an authenticated attacker who already holds a low-privileged foothold on the host to elevate to SYSTEM. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds listed below the fixed build numbers (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), with a CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and total technical impact per the CISA SSVC assessment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the practical risk is bounded by the requirement for pre-existing interactive local access rather than any remote vector.
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
An out-of-bounds read in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to cause a denial of service on affected hosts, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting availability-only impact. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 are affected, but exploitation is only reachable on hosts that actually expose an IKE/IPsec listener on UDP 500/4500 to the attacker's network - typically VPN gateways, IKEv2 remote-access servers, or hosts under domain IPsec policy. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and Microsoft has released vendor patches listed in the MSRC update guide.
Privilege escalation in the Windows TCP/IP stack allows a locally authenticated, low-privileged user to trigger a kernel double free and, by winning the subsequent memory-reclamation race, gain code execution at higher (SYSTEM-level) integrity on unpatched Windows 10, Windows 11 and Windows Server builds. Exploitation demands an existing local foothold with at least low privileges and precise timing to line up kernel pool state, which is reflected in the high attack complexity component of the CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector; it cannot be triggered remotely or anonymously. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches. With a CVSS base score of 7.0 and a CISA SSVC assessment of total technical impact but no exploitation and no automatable path, this is a genuine but moderate-priority elevation-of-privilege flaw rather than an emergency, and matters most where low-privileged local access is common (RDP hosts, VDI, multi-user terminal servers).
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege escalation in the Windows Error Reporting (WER) component of supported Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-level authenticated local access to elevate to a more privileged context on the same host. The flaw is a weak-authentication defect (CWE-1390) in WER that is locally exploitable with low complexity, no user interaction, and no special preconditions beyond an existing foothold, which is what drives the 7.8 base score. Microsoft has published a fix through its regular update channel (MSRC update guide), and at time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, so this is a patch-now hardening item rather than an urgent emergency-mitigation case.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authorized attacker with a low-privileged local account to reach SYSTEM-level code execution by winning a time-of-check/time-of-use race (CWE-367) that triggers a use-after-free in kernel mode. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 running builds below the patched revisions; the assessed CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor patches are available from Microsoft, and no public exploit identified at time of analysis (CISA SSVC reports Exploitation: none, and the CVE is not linked to KEV), so risk is concentrated in post-compromise escalation on shared or multi-user hosts rather than remote mass exploitation.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) lets an attacker who already holds low-privileged, authenticated code execution on a host read out-of-bounds kernel memory and chain that primitive into full SYSTEM-level control. All supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below their respective fixed build numbers are affected; the driver ships by default, so no optional feature must be enabled. There is no public exploit identified at time of analysis (CISA SSVC records Exploitation as 'none' and Automatable as 'no'), and this is not a KEV-listed, actively exploited issue - but the reported CVSS of 7.8 with high confidentiality, integrity and availability impact makes it a credible, moderate-priority escalation target once an attacker has a local foothold. A vendor-released patch is available.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated attacker with low-level privileges (PR:L) on an affected Windows 11 host to corrupt heap memory and elevate to SYSTEM-level or otherwise higher-integrity execution. The flaw is a CWE-122 heap-based buffer overflow (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) triggered by malformed input delivered to the MIDI service interface; it is local-only, requires an existing foothold, and involves no victim user interaction. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is a credible but not emergency-tier vulnerability - patch when convenient within normal monthly cycles rather than on an emergency basis. Affected builds are Windows 11 24H2, 25H2, 26H2, and 26H1 below their respective patched builds (10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231).
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
Elevation of privilege in Microsoft Windows Error Reporting lets a locally authenticated, low-privileged attacker escalate to full SYSTEM-level compromise on affected Windows 11 and Windows Server 2025 hosts. The defect is an untrusted pointer dereference (CWE-822) reached when low-privileged code invokes or interacts with the Error Reporting component, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8) reflects total confidentiality, integrity, and availability impact once triggered. The local-only vector means the flaw cannot be launched remotely and cannot serve as an initial-access vector, and no public exploit has been identified at time of analysis; Microsoft has released fixes for all affected builds.
The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows unauthenticated remote attackers to execute code on affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems, provided they can trick a user into opening, mounting, or processing malicious partition or disk data (UI:R). Vendor patches are available, and no public exploit or confirmed active exploitation has been identified at time of analysis; this is a high-priority patching item but not an emergency.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) stems from a use-after-free memory-safety flaw (CWE-416) that an attacker with low-privileged local access can trigger to gain SYSTEM-level code execution. Real-world exposure is narrow: RRAS is not installed or running by default, so only hosts configured as VPN, NAT, or routing gateways are realistic targets, and exploitation depends on winning a timing race (CVSS AV:L/AC:H/PR:L, high attack complexity), which CISA SSVC assesses as not automatable with no observed exploitation. Microsoft has released a vendor patch, and no public exploit identified at time of analysis - this is a moderate-priority, not emergency, vulnerability whose practical risk sits below what the 7.0 base score alone suggests.
Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
Denial of service in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to crash the service by sending crafted network traffic that triggers a null pointer dereference, taking down routing, VPN, NAT, and dial-up functions on the host. Per the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), exploitation requires no credentials and no user interaction, and the impact is confined to availability with no confidentiality or integrity effect. The practical limitation is deployment: RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or NAT/dial-up endpoints with a reachable listener are exposed; CISA's SSVC assessment rates exploitation as 'none' and no public exploit has been identified at time of analysis, though the attack is automatable and a vendor patch is available.
Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Local privilege escalation in the Windows Telephony Server (TAPI) allows an authenticated, low-privileged local user to gain elevated rights - potentially SYSTEM - by triggering a use-after-free in the telephony stack. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the EUVD data below the vendor's patched build levels are affected, and because the vulnerable component is present by default, exposure is broad even though the attack is not remote. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier priority: it only becomes dangerous after an attacker has already obtained a foothold on the host and can interact with the TAPI service.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.
Local privilege escalation in the Windows Update Orchestrator Service on unpatched Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets a local, low-privileged attacker who can already run code on the host win a heap race condition and elevate to SYSTEM. The defect is a use-after-free (CWE-416) with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and CISA's SSVC assessment records Exploitation=none and Automatable=no, meaning the race is unreliable and must be won manually rather than triggered by a repeatable exploit chain. There is no public exploit code identified at time of analysis, so this is a moderate-priority patch-and-move-on item rather than an emergency, though the vendor has made a fix available.
Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.
An out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows a network-positioned attacker to corrupt memory in a high-privilege system process and execute arbitrary code, with the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicating a low-privilege authenticated attacker, no user interaction, and full confidentiality, integrity, and availability impact. The affected surface spans essentially the entire supported Windows fleet, from Windows Server 2012/2012 R2 and Windows 10 1607 through Windows 11 26H2 and Windows Server 2025, so unpatched domain controllers and member servers are the highest-value targets. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none and the flaw as non-automatable, meaning exploitation is not trivial to script at scale; Microsoft has released fixed builds for all affected branches.
Link-following flaw in Windows Registry allows an authenticated local attacker with low-privileged code execution to elevate privileges by manipulating symbolic links, junctions, or Registry link objects that a higher-privileged Windows process resolves. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed versions listed in the vendor advisory. No public exploit identified at time of analysis, and this is assessed as a credible but not emergency-level priority; vendor patches are available and should be applied.
Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Local privilege escalation in Microsoft Windows DirectComposition lets an authenticated attacker who already holds low-privileged code execution on a host trigger a use-after-free in the desktop composition engine and gain code execution at a higher integrity level. Affected are supported Windows client and server builds prior to the fixed builds listed in the vendor advisory, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022 and Windows Server 2025 (including Server Core). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment marks the issue as non-automatable, making this a genuine but non-emergency patching priority rather than a drop-everything emergency.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.
Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.
Memory corruption in Microsoft XML (MSXML) allows an unauthenticated remote attacker to execute arbitrary code in the context of whatever process parses attacker-supplied XML, with high impact to confidentiality, integrity, and availability (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are supported Windows client and server editions - including Server Core installs - running builds older than the fixed levels catalogued in EUVD-2026-99433 and the MSRC advisory, from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025. Microsoft has shipped vendor fixes, and there is no public exploit identified at time of analysis: CISA's SSVC entry records exploitation as 'none' and marks the flaw as not automatable, though the HIGH attack complexity reflects that a reliable use-after-free requires precise heap grooming and, in practice, an XML-rendering or XML-consuming path must be reached.
Local privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged, authenticated session on a vulnerable host gain full SYSTEM-level control by triggering a use-after-free (CWE-416) in kernel memory handling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unpatched population covers Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 and Windows Server 2022/2025, with fixes recorded in EUVD-2026-100051 that raise builds such as Windows 11 24H2 to 10.0.26100.9711, Server 2025 to 10.0.26100.33650 and Windows 10 to 10.0.19044.7807. Patch available per vendor advisory; no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with automatability as no, although technical impact is rated total.
Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.
Local privilege escalation in the Windows RPC Runtime lets an attacker who already holds a low-privileged local account on a Windows host free an invalid pointer or reference (CWE-763) inside the RPC code path and turn that memory-management error into SYSTEM-level code execution on the same machine (CVSS 7.0, AV:L/PR:L/UI:N/S:U). Exploitation is gated by high attack complexity (AC:H), which is consistent with a race/timing-dependent condition rather than a reliable one-shot primitive, and it cannot be reached remotely or by an unauthenticated user. No public exploit code or confirmed active exploitation has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes through its monthly update channel, so this is a genuine but non-urgent patching priority concentrated on multi-user, RDP and jump hosts where untrusted standard users can log on locally.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to corrupt kernel memory and elevate to SYSTEM. The flaw is a use-after-free (CWE-416) requiring a race-condition-style trigger, reflected in the CVSS vector AV:L/AC:H/PR:L/UI:N (7.0 High) and the CISA SSVC assessment of Exploitation: none and Automatable: no - there is no remote path, no user interaction, and no public exploit identified at time of analysis. It was not added to CISA KEV, and vendor-supplied patches are available; affected builds are specific Windows 11 23H2 through 26H2 releases and Windows Server 2025 (including Server Core) below the fixed build numbers, while patched builds are not exploitable. Independent assessment rates this as a genuine but not emergency-grade priority best handled through routine monthly patching.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Windows CD-ROM Driver (cdrom.sys) contains a buffer over-read (CWE-126) that can disclose kernel memory and, per the vendor's threat model, be exploited by an unauthenticated remote attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds. Our independent assessment keeps AV:N/PR:N/UI:N but raises attack complexity to High and reduces integrity/availability impact to Low, because exploitation requires reaching the driver's input-handling path and the over-read primitive mainly yields disclosure rather than guaranteed code execution; CISA SSVC records no observed exploitation, no public exploit identified at time of analysis, and EPSS is low at 0.89% (58th percentile). Microsoft has released fixed builds, so affected systems should be patched per the MSRC advisory.
Local privilege escalation in the Windows Update Orchestrator Service (UsoSvc) on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a standard, low-privileged local account to trigger a use-after-free in the service and elevate to the service's high-privilege (LocalSystem) context. There is no remote or unauthenticated path: the CVSS vector (AV:L/PR:L) confirms the attacker must already be logged on locally with low privileges, and the high attack complexity (AC:H) reflects that success depends on winning a timing-dependent memory-reuse race, which usually requires repeated attempts rather than a single deterministic trigger. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none), and vendor patches are available, so this is a genuine but second-tier priority concentrated on shared, multi-user, or terminal-server hosts where untrusted users hold standard accounts.
Local privilege escalation in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds code execution as any logged-on user to raise privileges to kernel/SYSTEM level. The defect is a use-after-free (CWE-416) in a subsystem present in default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025, requiring no user interaction once a local foothold exists, though it cannot be triggered remotely and grants no initial access on its own. Microsoft has released vendor patches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.
Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.
Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.
Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.
Remote code execution may be possible in the Windows Event Logging Service on affected Windows 11 and Windows Server builds, where an unauthenticated network attacker can trigger an out-of-bounds read under specific memory-layout or timing conditions (CVSS 8.1, AC:H). Windows 11 23H2 through 26H2 and Windows Server 2022/2025 are affected below vendor-fixed build revisions, and a vendor patch is available. No public exploit was identified at time of analysis; CISA SSVC reports Exploitation=none and Automatable=no, and EPSS is 0.57% (46th percentile), so risk is serious but not emergency-level.
Denial of service in the Windows WLAN Service affects Windows 11 builds 23H2 through 26H2 and Windows Server 2025, where an integer underflow in the wireless networking component can be triggered by an unauthenticated attacker to exhaust or crash the service. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), no credentials or user interaction are required and the sole impact is loss of availability, with the practical gating factor being reachability of the WLAN stack rather than direct internet exposure; no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none, and vendor patches are available. CISA's SSVC also flags the issue as Automatable: yes with partial technical impact, making it a moderate-priority patching item for wireless-capable endpoints and servers.
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
Local privilege escalation in the Windows Bind Filter Driver (bflt.sys), a core kernel-mode component, allows an authenticated low-privileged attacker with existing code execution on a target host to escalate to SYSTEM-level privileges through a use-after-free condition (CWE-416). Exploitation is not trivial: the flaw is a race condition requiring precisely timed reclamation of a freed kernel object, reflected in the high attack-complexity rating of the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 7.0), and the attacker must already hold local access (AV:L, PR:L) - this is a post-compromise escalation primitive, not a remote entry vector. No public exploit code was identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but second-tier priority relative to actively exploited kernel flaws; it nonetheless affects default installations of Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core) until patched.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).
Local privilege escalation in Microsoft Windows is possible because the COM+ Event System Service dereferences an untrusted pointer (CWE-822), allowing an authenticated attacker who already holds a low-privileged foothold on the host to elevate to SYSTEM. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds listed below the fixed build numbers (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), with a CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and total technical impact per the CISA SSVC assessment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the practical risk is bounded by the requirement for pre-existing interactive local access rather than any remote vector.
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
An out-of-bounds read in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to cause a denial of service on affected hosts, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting availability-only impact. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 are affected, but exploitation is only reachable on hosts that actually expose an IKE/IPsec listener on UDP 500/4500 to the attacker's network - typically VPN gateways, IKEv2 remote-access servers, or hosts under domain IPsec policy. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and Microsoft has released vendor patches listed in the MSRC update guide.
Privilege escalation in the Windows TCP/IP stack allows a locally authenticated, low-privileged user to trigger a kernel double free and, by winning the subsequent memory-reclamation race, gain code execution at higher (SYSTEM-level) integrity on unpatched Windows 10, Windows 11 and Windows Server builds. Exploitation demands an existing local foothold with at least low privileges and precise timing to line up kernel pool state, which is reflected in the high attack complexity component of the CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector; it cannot be triggered remotely or anonymously. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches. With a CVSS base score of 7.0 and a CISA SSVC assessment of total technical impact but no exploitation and no automatable path, this is a genuine but moderate-priority elevation-of-privilege flaw rather than an emergency, and matters most where low-privileged local access is common (RDP hosts, VDI, multi-user terminal servers).
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege escalation in the Windows Error Reporting (WER) component of supported Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-level authenticated local access to elevate to a more privileged context on the same host. The flaw is a weak-authentication defect (CWE-1390) in WER that is locally exploitable with low complexity, no user interaction, and no special preconditions beyond an existing foothold, which is what drives the 7.8 base score. Microsoft has published a fix through its regular update channel (MSRC update guide), and at time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, so this is a patch-now hardening item rather than an urgent emergency-mitigation case.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authorized attacker with a low-privileged local account to reach SYSTEM-level code execution by winning a time-of-check/time-of-use race (CWE-367) that triggers a use-after-free in kernel mode. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 running builds below the patched revisions; the assessed CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor patches are available from Microsoft, and no public exploit identified at time of analysis (CISA SSVC reports Exploitation: none, and the CVE is not linked to KEV), so risk is concentrated in post-compromise escalation on shared or multi-user hosts rather than remote mass exploitation.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) lets an attacker who already holds low-privileged, authenticated code execution on a host read out-of-bounds kernel memory and chain that primitive into full SYSTEM-level control. All supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below their respective fixed build numbers are affected; the driver ships by default, so no optional feature must be enabled. There is no public exploit identified at time of analysis (CISA SSVC records Exploitation as 'none' and Automatable as 'no'), and this is not a KEV-listed, actively exploited issue - but the reported CVSS of 7.8 with high confidentiality, integrity and availability impact makes it a credible, moderate-priority escalation target once an attacker has a local foothold. A vendor-released patch is available.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated attacker with low-level privileges (PR:L) on an affected Windows 11 host to corrupt heap memory and elevate to SYSTEM-level or otherwise higher-integrity execution. The flaw is a CWE-122 heap-based buffer overflow (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) triggered by malformed input delivered to the MIDI service interface; it is local-only, requires an existing foothold, and involves no victim user interaction. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is a credible but not emergency-tier vulnerability - patch when convenient within normal monthly cycles rather than on an emergency basis. Affected builds are Windows 11 24H2, 25H2, 26H2, and 26H1 below their respective patched builds (10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231).
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
Elevation of privilege in Microsoft Windows Error Reporting lets a locally authenticated, low-privileged attacker escalate to full SYSTEM-level compromise on affected Windows 11 and Windows Server 2025 hosts. The defect is an untrusted pointer dereference (CWE-822) reached when low-privileged code invokes or interacts with the Error Reporting component, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8) reflects total confidentiality, integrity, and availability impact once triggered. The local-only vector means the flaw cannot be launched remotely and cannot serve as an initial-access vector, and no public exploit has been identified at time of analysis; Microsoft has released fixes for all affected builds.
The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows unauthenticated remote attackers to execute code on affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems, provided they can trick a user into opening, mounting, or processing malicious partition or disk data (UI:R). Vendor patches are available, and no public exploit or confirmed active exploitation has been identified at time of analysis; this is a high-priority patching item but not an emergency.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.