Windows 11 26h1
Monthly
Local privilege escalation in the Windows Update Orchestrator Service allows an authenticated, low-privileged user on an unpatched Windows host to follow a crafted symbolic link or NTFS junction into a privileged file operation and gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable: it requires an existing local foothold and credentials (PR:L, AV:L) plus winning a timing window against the service (AC:H), and it needs no user interaction (UI:N). No public exploit has been identified at time of analysis - CISA SSVC records exploitation as 'none' and automatable as 'no' - and Microsoft has shipped fixed builds across the affected Windows 10, Windows 11, and Windows Server branches, so remediation is a straightforward update rather than an emergency containment exercise.
Local privilege escalation in the Windows Device Install Service lets an authenticated attacker holding only low-level privileges on a host raise their rights to a higher integrity level (CVSS 3.1 base 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an incorrect authorization check (CWE-863) in a service that normally runs with high privileges, so any standard user who can already execute code - or plug in or trigger a device installation - on an unpatched Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system is a potential victim; default configurations are affected and no user interaction is needed. Microsoft has published a fix, and there is no public exploit identified at time of analysis and no CISA KEV listing or SSVC exploitation signal, though the SSVC technical impact rating is "total" because successful exploitation yields high confidentiality, integrity, and availability impact within the same security scope.
Local privilege escalation in the Windows Virtual Input component allows an authenticated, low-privileged attacker to gain elevated rights on affected Windows 10, Windows 11 and Windows Server hosts. Exploitation requires an attacker to already hold a local interactive foothold on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and to trigger an improper authorization check in the component (CWE-283, Unverified Ownership); no victim interaction is required and attack complexity is low, so escalation is straightforward once local access exists. A vendor patch is available from Microsoft, no public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with the flaw judged not automatable, indicating it is not suitable for mass, scalable attacks.
Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Local privilege escalation in OpenSSH for Windows stems from a use-after-free (CWE-416) in the SSH component shipped with supported Windows builds, allowing an authenticated low-privileged user who already holds a foothold on the host to corrupt memory inside the OpenSSH process and elevate to the privileges of that process, with high impact across confidentiality, integrity and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: there is no remote or network vector, no user interaction is required, and exploitation presupposes a valid low-privilege account plus the vulnerable OpenSSH for Windows component being installed and in use on an unpatched build. No public exploit code has been identified at the time of analysis, CISA's SSVC decision framework records exploitation as none and the flaw as not automatable, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Local privilege escalation in Windows Win32K allows an attacker who already holds low-privileged, authenticated local access to trigger a use-after-free in the kernel-mode window manager driver and obtain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. The defect is a second-stage primitive rather than an initial-access flaw: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing foothold on the host plus the ability to execute code issuing Win32K syscalls, and it cannot be reached by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis, CISA's SSVC data records exploitation as "none" and automatable as "no", and Microsoft has released a vendor patch covering all listed Windows client and server builds.
Local privilege escalation in the Windows Win32 Kernel Subsystem (Win32k) allows an attacker who already holds a low-privileged, authenticated local foothold to corrupt kernel memory and elevate to higher integrity, potentially SYSTEM. The flaw is a use-after-free (CWE-416) reachable through the user-mode-to-kernel windowing/GDI path; per the assessed vector AV:L/AC:L/PR:L/UI:N, exploitation requires prior local code execution and no user interaction, so it is a post-compromise escalation primitive rather than an initial-access or remote vector. Microsoft has released vendor patches and CISA's SSVC decision data records no known exploitation and no automatable exploitation path; no public exploit code has been identified at time of analysis. Rated 7.8 (High) with total technical impact, this is a credible but not emergency-tier priority - patch on a normal cadence, prioritizing multi-user and high-value Windows 10, Windows 11, and Windows Server hosts.
Code injection in the Windows Encrypting File System (EFS) allows an authenticated attacker holding only low-level privileges (PR:L) to execute arbitrary code over the network against unpatched Windows hosts, with high impact across confidentiality, integrity, and availability (CVSS 8.8). Every supported Windows branch is in scope, including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022, and 2025 (Server Core included), and exploitation requires network reachability to the EFS component rather than any user interaction. Microsoft has published patched builds for each affected branch, and at time of analysis there is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment records exploitation as 'none' with automatable set to 'no'.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Heap-based buffer overflow in the Windows Win32K kernel-mode driver (win32kbase.sys/win32kfull.sys) lets an attacker who already holds a low-privileged local session on a Windows host corrupt kernel pool memory and elevate to SYSTEM-level privileges. The flaw is rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and affects Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations below the patched build numbers. Exploitation is not remote and requires pre-existing local access, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Microsoft has issued a fix, making this a credible, patch-worthy local privilege-escalation issue rather than an emergency on its own.
Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated low-privileged attacker to gain elevated code execution by triggering a use-after-free (CWE-416) in the service's memory handling. Affected versions include Windows 11 24H2 (10.0.26100.0 < 10.0.26100.9711), 25H2 (10.0.26200.0 < 10.0.26200.9711), 26H1 (10.0.28000.0 < 10.0.28000.3231), and 26H2 (10.0.26300.0 < 10.0.26300.9711). Exploitation requires the attacker to already possess authenticated local code execution (PR:L, AV:L) and to win a timing-dependent race (AC:H), making reliable exploitation non-trivial; no public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.
Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.
A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user who can execute code on an affected Windows 11 or Windows Server 2025 host to trigger a release-of-invalid-pointer/reference condition and elevate to higher privileges, with high confidentiality, integrity, and availability impact. The flaw affects default configurations of Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2 as well as Windows Server 2025 and Server Core below their patched builds, and it requires local access rather than remote reachability. Microsoft has released a vendor patch, no public exploit was identified at time of analysis, and CISA SSVC records exploitation as none.
Local privilege escalation in Windows Win32K allows an authenticated attacker with low-privileged access to elevate to higher integrity levels by exploiting a use-after-free (CWE-416) condition. Affected systems include a broad range of Windows 10, Windows 11, and Windows Server versions (2016 through 2025); a vendor patch is available. No public exploit code or active exploitation has been identified, and the risk is assessed as credible but not emergency-level.
Improper input validation in Microsoft Windows Hyper-V allows an authenticated but low-privileged local user to spoof trusted resources on a virtualization host, tampering with data that should be integrity-protected (CISA SSVC 'Technical Impact: total'; CVSS 8.8 HIGH). Exploitation is strictly local (AV:L) and requires a valid low-privileged account (PR:L) plus the Hyper-V role or hypervisor platform to be present, with no user interaction; CISA's SSVC records no observed exploitation and rates the flaw non-automatable, so no public exploit code has been identified at the time of analysis. Microsoft has shipped fixed builds across all affected Windows 10, Windows 11 and Windows Server 2012-through-2025 SKUs, including Server Core installations.
Local privilege escalation in Windows Overlay Filter (WOF) allows an authenticated low-privileged attacker with the ability to run code on a vulnerable Windows host to trigger a buffer over-read (CWE-126) and gain elevated privileges, potentially including SYSTEM-level access. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD/MSRC advisory, and the flaw cannot be reached remotely. This is a genuine but second-tier priority: no public exploit code has been identified, SSVC rates exploitation as none and non-automatable, and the attacker must already hold a local authenticated session, so it is primarily a post-compromise escalation risk rather than an initial-access vector.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker holding standard user rights on a host to corrupt the DWM process through a use-after-free and execute code with the elevated privileges that process enjoys. Exploitation requires prior local access at low privilege (CVSS AV:L/PR:L), needs no user interaction and no non-default configuration, because DWM is a default-enabled composition subsystem on every supported Windows 10, Windows 11, and Windows Server build listed by EUVD. Microsoft has published fixed builds and no public exploit has been identified at time of analysis, so this functions as a post-foothold escalation step rather than a remote entry point; severity is high (7.8) but it is not a remotely exploitable crisis.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
Local privilege escalation in the Windows Win32k kernel-mode driver (win32kfull.sys/win32k.sys) allows an attacker who already holds low-privileged, authenticated code execution on a host to trigger a use-after-free (CWE-416) on a freed kernel object and elevate to a higher-integrity, kernel-level context. Affected deployments are unpatched Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core) builds below the fixed build numbers published in Microsoft's update guide; CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote or network attack surface, and no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Local privilege escalation in Windows Kerberos allows an authenticated attacker who already holds low-privileged code execution on a Windows 11 26H1 host (builds 10.0.28000.0 up to but not including 10.0.28000.3231) to elevate to a higher integrity level, with high impact across confidentiality, integrity, and availability on the affected machine. The root cause is a use-after-free that must be triggered and won as a race, so the high attack complexity (AC:H) materially limits reliable exploitation; there is no remote vector and no victim user interaction is required. No public exploit identified at time of analysis, no exploitation has been observed (CISA SSVC records Exploitation: none, Automatable: no), and a vendor patch is available.
A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated low-privilege access on a Windows host to exploit a use-after-free memory-corruption condition and elevate to SYSTEM-level code execution. The flaw affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations, running builds below the vendor-supplied fixed build numbers. Exploitation is local-only (AV:L), requires an existing foothold with low privileges (PR:L), and carries high attack complexity (AC:H) because success depends on winning a non-deterministic memory-reclamation race; no user interaction by a victim is required, and no public exploit code or active in-the-wild exploitation has been identified at time of analysis (CISA SSVC Exploitation: none). Vendor patches are available from Microsoft, so the practical risk is concentrated in unpatched endpoints and multi-user systems where an attacker already has a standard account.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.
Local tampering and information compromise in Microsoft Windows Error Reporting (WER) allow an authenticated attacker who already holds a low-privileged account and code execution on a Windows host to invoke a critical WER function that performs no authentication or authorization check, yielding high confidentiality and integrity impact with no availability impact (CVSS 7.1, AV:L/PR:L/UI:N). The flaw is not reachable remotely or by unauthenticated users; the mandatory local foothold narrows realistic exploitation to local attackers or post-compromise privilege escalation, which is why the consolidation of signals points to a moderate rather than emergency priority. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixed builds covering Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025.
Local privilege escalation in Windows NTFS allows an authenticated attacker with a low-privileged local session to trigger an out-of-bounds write (CWE-787) and execute code with elevated privileges. Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis (SSVC exploitation: none, Automatable: no), and a vendor-released patch is available.
Local privilege escalation in the Windows Device Association Service lets an authenticated low-privileged user on a Windows host trigger a use-after-free (CWE-416) memory-corruption condition and execute code with elevated rights, yielding high confidentiality, integrity, and availability impact within an unchanged security scope (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025 are affected, but an attacker must already be able to run code on the machine, making this a post-compromise escalation primitive rather than a remote entry point. High attack complexity (AC:H) means reliable exploitation depends on winning a race or forcing a specific freed-memory reuse, which SSVC reflects as not automatable; no public exploit code has been identified at time of analysis and there is no KEV entry, while Microsoft has released fixed builds.
Local privilege escalation in Windows NTLM lets an attacker who already holds low-privileged, authenticated code execution on a Windows host corrupt heap memory and gain higher privileges (CVSS 7.8, CWE-122). The flaw is reachable without user interaction and on default installations, and because NTLM is a default, always-present Windows component, every client and server build listed by the vendor (Windows 10/11 and Windows Server 2016 through 2025) is affected. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment scores exploitation as none while flagging the technical impact on a successfully exploited system as total, so patching should be handled in a normal Patch Tuesday cadence rather than as an emergency.
A stack-based buffer overflow in the Windows Installer (msiexec) component allows an authenticated attacker holding a low-privileged local account to elevate privileges to SYSTEM on affected Windows hosts. The flaw is local-only (AV:L) and requires no victim interaction, but carries High attack complexity (AC:H), meaning a race condition or a specific system state must be won before the overflow can be reliably triggered, which limits practical exploitability to shared and multi-user systems such as RDS/terminal servers rather than typical single-user endpoints. No public exploit code has been identified at time of analysis and no active exploitation is confirmed (CISA SSVC exploitation: none); the high EPSS-style urgency signals are absent, and Microsoft has released a vendor patch, making this a genuine but moderate-priority issue that should be handled through normal patch cycles.
Local privilege escalation in Microsoft Windows Event Tracing (ETW) lets an authenticated attacker who already holds low-privileged local access on a target host trigger a use-after-free condition (CWE-416) and execute code in a more privileged security context, potentially reaching SYSTEM. The flaw carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is a local-only primitive that requires pre-existing low-privilege credentials, no user interaction, and is gated by High Attack Complexity because reliable exploitation hinges on winning a memory-lifecycle race rather than a deterministic trigger. All supported Windows client and server builds below the vendor-patched revision levels are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2016/2019/2022/2025 and their Server Core installations, and Microsoft has released fixes; there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC framework rates exploitation as none and the activity as not automatable, so this should be treated as a high-value post-compromise escalation primitive rather than an imminent mass-exploitation threat.
Local privilege escalation in Microsoft Windows Search (CWE-59, link following) allows an authenticated low-privileged local user to elevate to a higher-integrity context by manipulating filesystem links that the Windows Search indexing component resolves before accessing a file, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a pre-existing local foothold and the ability to create symbolic links, junctions, or hard links in a location processed by the privileged Search service; no user interaction or network access is needed, and CISA SSVC rates it as not automatable, making this a post-compromise escalation step rather than an initial-access or wormable vector. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has released vendor updates, so affected systems should be patched on the normal monthly cadence rather than treated as an emergency.
Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.
Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.
Local privilege escalation in the Windows Now Playing Session Manager (NPSM) - a default component of supported Windows 10, Windows 11, and Windows Server builds - lets an attacker who already holds authenticated, interactive local access (CVSS 3.1 AV:L/PR:L/UI:N, score 7.8) corrupt memory via a use-after-free and execute code with elevated privileges. Exploitation is not automatable and requires the victim host to already be compromised or a low-privileged local user to be present; no public exploit code was identified at time of analysis and the CISA SSVC evaluation records exploitation as none, while CISA's technical-impact assessment is total (full loss of confidentiality, integrity, and availability on the vulnerable host). The flaw is a standard local privilege-escalation primitive rather than a remote entry point, and Microsoft has published fixed builds for every affected version.
A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.
Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Bind Filter Driver (bindflt), a kernel-mode component shipped by default on supported Windows client and server editions, lets a locally authenticated user with only low privileges corrupt kernel heap memory and escalate to SYSTEM. Exploitation requires existing local access and a valid low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the bug functions as a privilege-escalation stage chained after an initial foothold rather than an independent remote entry point; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Microsoft has published fixed builds for all affected branches, so despite the lack of exploitation telemetry this is a genuine patch-priority item for Windows environments.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already holds a low-privileged foothold on an affected Windows 10, Windows 11, or Windows Server build corrupt kernel memory and elevate to SYSTEM-level privileges. The defect is a use-after-free (CWE-416) that is reachable on default installations with no user interaction, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Microsoft has shipped a vendor patch through its Security Update Guide. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no, so this should be handled as a standard monthly-patching priority rather than an emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
Local privilege escalation in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows an authenticated attacker who already holds a low-privileged foothold on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 to elevate to SYSTEM-level code execution by triggering a use-after-free (CWE-416) inside the service. Exploitation requires winning a race condition to reuse a freed memory object, which raises attack complexity and limits reliability, and there is no remote vector - this is a post-compromise escalation primitive rather than an initial-access flaw. No public exploit code has been identified and no active exploitation has been confirmed; Microsoft has released vendor patches for all affected branches.
A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Local privilege escalation in the Windows Defender Firewall Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host trigger a use-after-free condition and elevate to full SYSTEM privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). The vulnerability cannot be reached remotely or by an unauthenticated user, and exploitation is additionally bounded by the affected build ranges, so fully patched systems are not exposed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the independent assessment rates this as a credible but not emergency-level priority, making it a standard monthly-patch item rather than an out-of-band emergency.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Memory exhaustion in the Windows DHCP Client service allows an unauthenticated attacker who can deliver crafted DHCP responses to progressively degrade or deny service on Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core installations). The vulnerability is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no data exposure or code execution, and the effect builds gradually as leaked memory accumulates rather than causing an immediate crash. There is no public exploit identified at time of analysis and CISA SSVC records no observed exploitation, but the attack is rated automatable, so hosts that have not been updated past their fixed build remain a practical target for anyone positioned to answer DHCP traffic on the local segment; vendor-released patches are available.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.
Privilege escalation in the Windows Kernel lets an authenticated local attacker with low privileges trigger a timing-dependent use-after-free in kernel memory and, on success, execute code at a higher integrity level (SYSTEM) on the affected host. Only unpatched Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 builds are in scope, and the attacker must already hold a local foothold on the machine - there is no remote or network-facing path. CISA's SSVC assessment records no exploitation and no public exploit has been identified at time of analysis, but because the technical impact is rated total and a vendor patch is already shipping, the update should be treated as a routine-but-priority patch rather than an emergency.
Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.
Local privilege escalation in Windows Error Reporting (WER) allows an attacker who already holds low-privilege, authenticated access to a vulnerable Windows host to elevate to higher privileges, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use of uninitialized resource (CWE-908) inside the WER component, reachable without user interaction once the attacker can execute code or hold a session on the target; there is no remote vector, so prior local access is the key limiting factor. Unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 builds below the vendor-published fixed build numbers are affected; a vendor patch is available and no public exploit code or confirmed active exploitation has been identified at the time of analysis (CISA SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows User Profile Service (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets an attacker who already holds valid low-privileged local access redirect privileged file operations through attacker-created symbolic links, junctions, or hardlinks, yielding high-integrity file writes that can be leveraged for SYSTEM-level code execution. Affected are all currently supported Windows client and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - and default configurations are vulnerable with no special feature needing to be enabled. Vendor-released patches are available from Microsoft; no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so priority should track routine monthly patching rather than emergency response.
An out-of-bounds read in the Windows Network Policy Server (NPS) role lets unauthenticated remote attackers crash or degrade the service, producing a denial-of-service condition on hosts that expose NPS to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials, user interaction, or client-side conditions are required once NPS is reachable, and impact is confined to availability - no code execution, integrity, or confidentiality loss. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, though the flaw is rated Automatable: yes and affects a broad set of Windows client and server builds spanning Windows 10/11 and Windows Server 2012 through 2025; a vendor patch is available and should be prioritized on internet- or partner-facing RADIUS infrastructure.
Local privilege escalation in Microsoft Windows Modern Device Management (MDM) stems from a critical function that performs no authorization check (CWE-306), letting an attacker who already holds a low-privilege authenticated local account on the host elevate to higher privileges, including SYSTEM. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 (including Server Core) below their respective fixed builds. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confines this to post-compromise escalation - there is no remote network attack path and no user interaction required - and no public exploit code was identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
An out-of-bounds read in the Windows Graphics Device Interface (GDI) allows remote attackers to disclose information from process memory on affected Windows 10, Windows 11 and Windows Server builds. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, 7.5) rates it as a high-confidentiality, no-integrity, no-availability impact issue affecting the default graphics stack rather than an optional feature. Exploitation status is limited: CISA SSVC records no known exploitation, no public exploit code has been identified at time of analysis, EPSS is 0.94% (60th percentile), and Microsoft has released fixed builds for every affected branch, so the priority signals point to a moderate, non-emergency remediation within the current patch cycle.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.
Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in Microsoft's BitLocker drive-encryption component allows an attacker who already holds authenticated code execution on a Windows 11 or Windows Server host to corrupt memory inside a privileged Windows process and reach SYSTEM-level rights. The defect is a double free (CWE-415) rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it grants full confidentiality, integrity, and availability impact but only from an existing local foothold. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the issue as non-automatable with no observed exploitation; Microsoft has published a fixed build, so this is a credible but not emergency-level priority for organizations that have already applied the update.
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in Windows Core Messaging lets an authenticated attacker who already holds low-privilege code execution on a host escalate to a higher-integrity, potentially SYSTEM-level context. The underlying defect is an untrusted pointer dereference (CWE-822) reached through a crafted program that calls into the Core Messaging user-mode code path; attack complexity is low and no user interaction is required, but the attacker must first be logged on locally (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), making this an EoP primitive usable only after an initial foothold, not a remote or unauthenticated vector. Per available intelligence there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), though SSVC rates the technical impact as total and fully patched systems are not exploitable. All supported Windows client and server builds below the vendor-patched build numbers - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - are affected.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows an attacker who already holds authenticated low-privilege access on an affected host to escalate to a higher-integrity context. Exploitation is only possible where a ReFS volume has the optional Data Deduplication feature installed and the deduplication service is running - a non-default storage configuration typical of file and storage servers rather than standard desktops - and affected builds are limited to Windows Server 2025 below 10.0.26100.33650, Windows 11 23H2/24H2/25H2/26H2 below their respective patched builds, and Windows 11 26H1 below 10.0.28000.3231. Microsoft has released a fix, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, so this is a moderate-priority local escalation rather than a broadly exploitable, wormable issue.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.
Local privilege escalation in the Windows Update Orchestrator Service allows an authenticated, low-privileged user on an unpatched Windows host to follow a crafted symbolic link or NTFS junction into a privileged file operation and gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable: it requires an existing local foothold and credentials (PR:L, AV:L) plus winning a timing window against the service (AC:H), and it needs no user interaction (UI:N). No public exploit has been identified at time of analysis - CISA SSVC records exploitation as 'none' and automatable as 'no' - and Microsoft has shipped fixed builds across the affected Windows 10, Windows 11, and Windows Server branches, so remediation is a straightforward update rather than an emergency containment exercise.
Local privilege escalation in the Windows Device Install Service lets an authenticated attacker holding only low-level privileges on a host raise their rights to a higher integrity level (CVSS 3.1 base 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an incorrect authorization check (CWE-863) in a service that normally runs with high privileges, so any standard user who can already execute code - or plug in or trigger a device installation - on an unpatched Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system is a potential victim; default configurations are affected and no user interaction is needed. Microsoft has published a fix, and there is no public exploit identified at time of analysis and no CISA KEV listing or SSVC exploitation signal, though the SSVC technical impact rating is "total" because successful exploitation yields high confidentiality, integrity, and availability impact within the same security scope.
Local privilege escalation in the Windows Virtual Input component allows an authenticated, low-privileged attacker to gain elevated rights on affected Windows 10, Windows 11 and Windows Server hosts. Exploitation requires an attacker to already hold a local interactive foothold on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and to trigger an improper authorization check in the component (CWE-283, Unverified Ownership); no victim interaction is required and attack complexity is low, so escalation is straightforward once local access exists. A vendor patch is available from Microsoft, no public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with the flaw judged not automatable, indicating it is not suitable for mass, scalable attacks.
Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.
Heap-based buffer overflow in the Windows SMB Client lets remote attackers elevate privileges on affected Windows hosts by compelling the target's SMB client to connect to an attacker-controlled server. The vulnerability carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), though it is a client-side direction flaw: the attacker must induce an outbound SMB connection rather than reach a listening service, and the sources do not describe the trigger, so the true degree of coercion or user interaction is unverified. CISA SSVC rates exploitation as 'none' with Automatable 'no' and total technical impact, EPSS is modest at 0.77% (55th percentile), and no public exploit code has been identified at time of analysis; Microsoft has released fixes.
Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Local privilege escalation in OpenSSH for Windows stems from a use-after-free (CWE-416) in the SSH component shipped with supported Windows builds, allowing an authenticated low-privileged user who already holds a foothold on the host to corrupt memory inside the OpenSSH process and elevate to the privileges of that process, with high impact across confidentiality, integrity and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: there is no remote or network vector, no user interaction is required, and exploitation presupposes a valid low-privilege account plus the vulnerable OpenSSH for Windows component being installed and in use on an unpatched build. No public exploit code has been identified at the time of analysis, CISA's SSVC decision framework records exploitation as none and the flaw as not automatable, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Local privilege escalation in Windows Win32K allows an attacker who already holds low-privileged, authenticated local access to trigger a use-after-free in the kernel-mode window manager driver and obtain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. The defect is a second-stage primitive rather than an initial-access flaw: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing foothold on the host plus the ability to execute code issuing Win32K syscalls, and it cannot be reached by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis, CISA's SSVC data records exploitation as "none" and automatable as "no", and Microsoft has released a vendor patch covering all listed Windows client and server builds.
Local privilege escalation in the Windows Win32 Kernel Subsystem (Win32k) allows an attacker who already holds a low-privileged, authenticated local foothold to corrupt kernel memory and elevate to higher integrity, potentially SYSTEM. The flaw is a use-after-free (CWE-416) reachable through the user-mode-to-kernel windowing/GDI path; per the assessed vector AV:L/AC:L/PR:L/UI:N, exploitation requires prior local code execution and no user interaction, so it is a post-compromise escalation primitive rather than an initial-access or remote vector. Microsoft has released vendor patches and CISA's SSVC decision data records no known exploitation and no automatable exploitation path; no public exploit code has been identified at time of analysis. Rated 7.8 (High) with total technical impact, this is a credible but not emergency-tier priority - patch on a normal cadence, prioritizing multi-user and high-value Windows 10, Windows 11, and Windows Server hosts.
Code injection in the Windows Encrypting File System (EFS) allows an authenticated attacker holding only low-level privileges (PR:L) to execute arbitrary code over the network against unpatched Windows hosts, with high impact across confidentiality, integrity, and availability (CVSS 8.8). Every supported Windows branch is in scope, including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022, and 2025 (Server Core included), and exploitation requires network reachability to the EFS component rather than any user interaction. Microsoft has published patched builds for each affected branch, and at time of analysis there is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment records exploitation as 'none' with automatable set to 'no'.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Heap-based buffer overflow in the Windows Win32K kernel-mode driver (win32kbase.sys/win32kfull.sys) lets an attacker who already holds a low-privileged local session on a Windows host corrupt kernel pool memory and elevate to SYSTEM-level privileges. The flaw is rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and affects Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations below the patched build numbers. Exploitation is not remote and requires pre-existing local access, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Microsoft has issued a fix, making this a credible, patch-worthy local privilege-escalation issue rather than an emergency on its own.
Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated low-privileged attacker to gain elevated code execution by triggering a use-after-free (CWE-416) in the service's memory handling. Affected versions include Windows 11 24H2 (10.0.26100.0 < 10.0.26100.9711), 25H2 (10.0.26200.0 < 10.0.26200.9711), 26H1 (10.0.28000.0 < 10.0.28000.3231), and 26H2 (10.0.26300.0 < 10.0.26300.9711). Exploitation requires the attacker to already possess authenticated local code execution (PR:L, AV:L) and to win a timing-dependent race (AC:H), making reliable exploitation non-trivial; no public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.
Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.
A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user who can execute code on an affected Windows 11 or Windows Server 2025 host to trigger a release-of-invalid-pointer/reference condition and elevate to higher privileges, with high confidentiality, integrity, and availability impact. The flaw affects default configurations of Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2 as well as Windows Server 2025 and Server Core below their patched builds, and it requires local access rather than remote reachability. Microsoft has released a vendor patch, no public exploit was identified at time of analysis, and CISA SSVC records exploitation as none.
Local privilege escalation in Windows Win32K allows an authenticated attacker with low-privileged access to elevate to higher integrity levels by exploiting a use-after-free (CWE-416) condition. Affected systems include a broad range of Windows 10, Windows 11, and Windows Server versions (2016 through 2025); a vendor patch is available. No public exploit code or active exploitation has been identified, and the risk is assessed as credible but not emergency-level.
Improper input validation in Microsoft Windows Hyper-V allows an authenticated but low-privileged local user to spoof trusted resources on a virtualization host, tampering with data that should be integrity-protected (CISA SSVC 'Technical Impact: total'; CVSS 8.8 HIGH). Exploitation is strictly local (AV:L) and requires a valid low-privileged account (PR:L) plus the Hyper-V role or hypervisor platform to be present, with no user interaction; CISA's SSVC records no observed exploitation and rates the flaw non-automatable, so no public exploit code has been identified at the time of analysis. Microsoft has shipped fixed builds across all affected Windows 10, Windows 11 and Windows Server 2012-through-2025 SKUs, including Server Core installations.
Local privilege escalation in Windows Overlay Filter (WOF) allows an authenticated low-privileged attacker with the ability to run code on a vulnerable Windows host to trigger a buffer over-read (CWE-126) and gain elevated privileges, potentially including SYSTEM-level access. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD/MSRC advisory, and the flaw cannot be reached remotely. This is a genuine but second-tier priority: no public exploit code has been identified, SSVC rates exploitation as none and non-automatable, and the attacker must already hold a local authenticated session, so it is primarily a post-compromise escalation risk rather than an initial-access vector.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker holding standard user rights on a host to corrupt the DWM process through a use-after-free and execute code with the elevated privileges that process enjoys. Exploitation requires prior local access at low privilege (CVSS AV:L/PR:L), needs no user interaction and no non-default configuration, because DWM is a default-enabled composition subsystem on every supported Windows 10, Windows 11, and Windows Server build listed by EUVD. Microsoft has published fixed builds and no public exploit has been identified at time of analysis, so this functions as a post-foothold escalation step rather than a remote entry point; severity is high (7.8) but it is not a remotely exploitable crisis.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
Local privilege escalation in the Windows Win32k kernel-mode driver (win32kfull.sys/win32k.sys) allows an attacker who already holds low-privileged, authenticated code execution on a host to trigger a use-after-free (CWE-416) on a freed kernel object and elevate to a higher-integrity, kernel-level context. Affected deployments are unpatched Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core) builds below the fixed build numbers published in Microsoft's update guide; CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote or network attack surface, and no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Local privilege escalation in Windows Kerberos allows an authenticated attacker who already holds low-privileged code execution on a Windows 11 26H1 host (builds 10.0.28000.0 up to but not including 10.0.28000.3231) to elevate to a higher integrity level, with high impact across confidentiality, integrity, and availability on the affected machine. The root cause is a use-after-free that must be triggered and won as a race, so the high attack complexity (AC:H) materially limits reliable exploitation; there is no remote vector and no victim user interaction is required. No public exploit identified at time of analysis, no exploitation has been observed (CISA SSVC records Exploitation: none, Automatable: no), and a vendor patch is available.
A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated low-privilege access on a Windows host to exploit a use-after-free memory-corruption condition and elevate to SYSTEM-level code execution. The flaw affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations, running builds below the vendor-supplied fixed build numbers. Exploitation is local-only (AV:L), requires an existing foothold with low privileges (PR:L), and carries high attack complexity (AC:H) because success depends on winning a non-deterministic memory-reclamation race; no user interaction by a victim is required, and no public exploit code or active in-the-wild exploitation has been identified at time of analysis (CISA SSVC Exploitation: none). Vendor patches are available from Microsoft, so the practical risk is concentrated in unpatched endpoints and multi-user systems where an attacker already has a standard account.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.
Local tampering and information compromise in Microsoft Windows Error Reporting (WER) allow an authenticated attacker who already holds a low-privileged account and code execution on a Windows host to invoke a critical WER function that performs no authentication or authorization check, yielding high confidentiality and integrity impact with no availability impact (CVSS 7.1, AV:L/PR:L/UI:N). The flaw is not reachable remotely or by unauthenticated users; the mandatory local foothold narrows realistic exploitation to local attackers or post-compromise privilege escalation, which is why the consolidation of signals points to a moderate rather than emergency priority. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixed builds covering Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025.
Local privilege escalation in Windows NTFS allows an authenticated attacker with a low-privileged local session to trigger an out-of-bounds write (CWE-787) and execute code with elevated privileges. Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis (SSVC exploitation: none, Automatable: no), and a vendor-released patch is available.
Local privilege escalation in the Windows Device Association Service lets an authenticated low-privileged user on a Windows host trigger a use-after-free (CWE-416) memory-corruption condition and execute code with elevated rights, yielding high confidentiality, integrity, and availability impact within an unchanged security scope (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025 are affected, but an attacker must already be able to run code on the machine, making this a post-compromise escalation primitive rather than a remote entry point. High attack complexity (AC:H) means reliable exploitation depends on winning a race or forcing a specific freed-memory reuse, which SSVC reflects as not automatable; no public exploit code has been identified at time of analysis and there is no KEV entry, while Microsoft has released fixed builds.
Local privilege escalation in Windows NTLM lets an attacker who already holds low-privileged, authenticated code execution on a Windows host corrupt heap memory and gain higher privileges (CVSS 7.8, CWE-122). The flaw is reachable without user interaction and on default installations, and because NTLM is a default, always-present Windows component, every client and server build listed by the vendor (Windows 10/11 and Windows Server 2016 through 2025) is affected. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment scores exploitation as none while flagging the technical impact on a successfully exploited system as total, so patching should be handled in a normal Patch Tuesday cadence rather than as an emergency.
A stack-based buffer overflow in the Windows Installer (msiexec) component allows an authenticated attacker holding a low-privileged local account to elevate privileges to SYSTEM on affected Windows hosts. The flaw is local-only (AV:L) and requires no victim interaction, but carries High attack complexity (AC:H), meaning a race condition or a specific system state must be won before the overflow can be reliably triggered, which limits practical exploitability to shared and multi-user systems such as RDS/terminal servers rather than typical single-user endpoints. No public exploit code has been identified at time of analysis and no active exploitation is confirmed (CISA SSVC exploitation: none); the high EPSS-style urgency signals are absent, and Microsoft has released a vendor patch, making this a genuine but moderate-priority issue that should be handled through normal patch cycles.
Local privilege escalation in Microsoft Windows Event Tracing (ETW) lets an authenticated attacker who already holds low-privileged local access on a target host trigger a use-after-free condition (CWE-416) and execute code in a more privileged security context, potentially reaching SYSTEM. The flaw carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is a local-only primitive that requires pre-existing low-privilege credentials, no user interaction, and is gated by High Attack Complexity because reliable exploitation hinges on winning a memory-lifecycle race rather than a deterministic trigger. All supported Windows client and server builds below the vendor-patched revision levels are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2016/2019/2022/2025 and their Server Core installations, and Microsoft has released fixes; there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC framework rates exploitation as none and the activity as not automatable, so this should be treated as a high-value post-compromise escalation primitive rather than an imminent mass-exploitation threat.
Local privilege escalation in Microsoft Windows Search (CWE-59, link following) allows an authenticated low-privileged local user to elevate to a higher-integrity context by manipulating filesystem links that the Windows Search indexing component resolves before accessing a file, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a pre-existing local foothold and the ability to create symbolic links, junctions, or hard links in a location processed by the privileged Search service; no user interaction or network access is needed, and CISA SSVC rates it as not automatable, making this a post-compromise escalation step rather than an initial-access or wormable vector. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has released vendor updates, so affected systems should be patched on the normal monthly cadence rather than treated as an emergency.
Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.
Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.
Local privilege escalation in the Windows Now Playing Session Manager (NPSM) - a default component of supported Windows 10, Windows 11, and Windows Server builds - lets an attacker who already holds authenticated, interactive local access (CVSS 3.1 AV:L/PR:L/UI:N, score 7.8) corrupt memory via a use-after-free and execute code with elevated privileges. Exploitation is not automatable and requires the victim host to already be compromised or a low-privileged local user to be present; no public exploit code was identified at time of analysis and the CISA SSVC evaluation records exploitation as none, while CISA's technical-impact assessment is total (full loss of confidentiality, integrity, and availability on the vulnerable host). The flaw is a standard local privilege-escalation primitive rather than a remote entry point, and Microsoft has published fixed builds for every affected version.
A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.
Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Bind Filter Driver (bindflt), a kernel-mode component shipped by default on supported Windows client and server editions, lets a locally authenticated user with only low privileges corrupt kernel heap memory and escalate to SYSTEM. Exploitation requires existing local access and a valid low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the bug functions as a privilege-escalation stage chained after an initial foothold rather than an independent remote entry point; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Microsoft has published fixed builds for all affected branches, so despite the lack of exploitation telemetry this is a genuine patch-priority item for Windows environments.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already holds a low-privileged foothold on an affected Windows 10, Windows 11, or Windows Server build corrupt kernel memory and elevate to SYSTEM-level privileges. The defect is a use-after-free (CWE-416) that is reachable on default installations with no user interaction, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Microsoft has shipped a vendor patch through its Security Update Guide. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no, so this should be handled as a standard monthly-patching priority rather than an emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
Local privilege escalation in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows an authenticated attacker who already holds a low-privileged foothold on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 to elevate to SYSTEM-level code execution by triggering a use-after-free (CWE-416) inside the service. Exploitation requires winning a race condition to reuse a freed memory object, which raises attack complexity and limits reliability, and there is no remote vector - this is a post-compromise escalation primitive rather than an initial-access flaw. No public exploit code has been identified and no active exploitation has been confirmed; Microsoft has released vendor patches for all affected branches.
A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Local privilege escalation in the Windows Defender Firewall Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host trigger a use-after-free condition and elevate to full SYSTEM privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). The vulnerability cannot be reached remotely or by an unauthenticated user, and exploitation is additionally bounded by the affected build ranges, so fully patched systems are not exposed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the independent assessment rates this as a credible but not emergency-level priority, making it a standard monthly-patch item rather than an out-of-band emergency.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Memory exhaustion in the Windows DHCP Client service allows an unauthenticated attacker who can deliver crafted DHCP responses to progressively degrade or deny service on Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core installations). The vulnerability is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no data exposure or code execution, and the effect builds gradually as leaked memory accumulates rather than causing an immediate crash. There is no public exploit identified at time of analysis and CISA SSVC records no observed exploitation, but the attack is rated automatable, so hosts that have not been updated past their fixed build remain a practical target for anyone positioned to answer DHCP traffic on the local segment; vendor-released patches are available.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.
Privilege escalation in the Windows Kernel lets an authenticated local attacker with low privileges trigger a timing-dependent use-after-free in kernel memory and, on success, execute code at a higher integrity level (SYSTEM) on the affected host. Only unpatched Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 builds are in scope, and the attacker must already hold a local foothold on the machine - there is no remote or network-facing path. CISA's SSVC assessment records no exploitation and no public exploit has been identified at time of analysis, but because the technical impact is rated total and a vendor patch is already shipping, the update should be treated as a routine-but-priority patch rather than an emergency.
Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.
Local privilege escalation in Windows Error Reporting (WER) allows an attacker who already holds low-privilege, authenticated access to a vulnerable Windows host to elevate to higher privileges, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use of uninitialized resource (CWE-908) inside the WER component, reachable without user interaction once the attacker can execute code or hold a session on the target; there is no remote vector, so prior local access is the key limiting factor. Unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 builds below the vendor-published fixed build numbers are affected; a vendor patch is available and no public exploit code or confirmed active exploitation has been identified at the time of analysis (CISA SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows User Profile Service (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets an attacker who already holds valid low-privileged local access redirect privileged file operations through attacker-created symbolic links, junctions, or hardlinks, yielding high-integrity file writes that can be leveraged for SYSTEM-level code execution. Affected are all currently supported Windows client and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - and default configurations are vulnerable with no special feature needing to be enabled. Vendor-released patches are available from Microsoft; no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so priority should track routine monthly patching rather than emergency response.
An out-of-bounds read in the Windows Network Policy Server (NPS) role lets unauthenticated remote attackers crash or degrade the service, producing a denial-of-service condition on hosts that expose NPS to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials, user interaction, or client-side conditions are required once NPS is reachable, and impact is confined to availability - no code execution, integrity, or confidentiality loss. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, though the flaw is rated Automatable: yes and affects a broad set of Windows client and server builds spanning Windows 10/11 and Windows Server 2012 through 2025; a vendor patch is available and should be prioritized on internet- or partner-facing RADIUS infrastructure.
Local privilege escalation in Microsoft Windows Modern Device Management (MDM) stems from a critical function that performs no authorization check (CWE-306), letting an attacker who already holds a low-privilege authenticated local account on the host elevate to higher privileges, including SYSTEM. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 (including Server Core) below their respective fixed builds. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confines this to post-compromise escalation - there is no remote network attack path and no user interaction required - and no public exploit code was identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
An out-of-bounds read in the Windows Graphics Device Interface (GDI) allows remote attackers to disclose information from process memory on affected Windows 10, Windows 11 and Windows Server builds. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, 7.5) rates it as a high-confidentiality, no-integrity, no-availability impact issue affecting the default graphics stack rather than an optional feature. Exploitation status is limited: CISA SSVC records no known exploitation, no public exploit code has been identified at time of analysis, EPSS is 0.94% (60th percentile), and Microsoft has released fixed builds for every affected branch, so the priority signals point to a moderate, non-emergency remediation within the current patch cycle.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.
Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in Microsoft's BitLocker drive-encryption component allows an attacker who already holds authenticated code execution on a Windows 11 or Windows Server host to corrupt memory inside a privileged Windows process and reach SYSTEM-level rights. The defect is a double free (CWE-415) rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it grants full confidentiality, integrity, and availability impact but only from an existing local foothold. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the issue as non-automatable with no observed exploitation; Microsoft has published a fixed build, so this is a credible but not emergency-level priority for organizations that have already applied the update.
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in Windows Core Messaging lets an authenticated attacker who already holds low-privilege code execution on a host escalate to a higher-integrity, potentially SYSTEM-level context. The underlying defect is an untrusted pointer dereference (CWE-822) reached through a crafted program that calls into the Core Messaging user-mode code path; attack complexity is low and no user interaction is required, but the attacker must first be logged on locally (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), making this an EoP primitive usable only after an initial foothold, not a remote or unauthenticated vector. Per available intelligence there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), though SSVC rates the technical impact as total and fully patched systems are not exploitable. All supported Windows client and server builds below the vendor-patched build numbers - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - are affected.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows an attacker who already holds authenticated low-privilege access on an affected host to escalate to a higher-integrity context. Exploitation is only possible where a ReFS volume has the optional Data Deduplication feature installed and the deduplication service is running - a non-default storage configuration typical of file and storage servers rather than standard desktops - and affected builds are limited to Windows Server 2025 below 10.0.26100.33650, Windows 11 23H2/24H2/25H2/26H2 below their respective patched builds, and Windows 11 26H1 below 10.0.28000.3231. Microsoft has released a fix, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, so this is a moderate-priority local escalation rather than a broadly exploitable, wormable issue.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.