Windows 11 26h1
Monthly
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged user to elevate to SYSTEM via a use-after-free condition. The flaw affects Microsoft Windows installations using the standard WinSock kernel driver and has a vendor-released patch available through Microsoft's security update guide. No public exploit has been identified at time of analysis, though afd.sys has historically been a frequent target for elevation-of-privilege exploitation.
Local privilege escalation in the Windows Hotpatch Monitoring Service enables an authenticated low-privileged attacker to gain elevated privileges through an out-of-bounds write (CWE-787) memory corruption flaw. The CVSS 7.8 (AV:L/AC:L/PR:L) reflects local attack vector with low complexity once a foothold is obtained, and no public exploit identified at time of analysis. The vulnerability was reported by Microsoft's own security team (secure@microsoft.com), suggesting internal discovery prior to disclosure.
Remote code execution in Microsoft Remote Desktop Client is possible when a user connects to an attacker-controlled or compromised RDP endpoint, where a race condition (CWE-362) can be triggered to corrupt heap memory and execute arbitrary code in the client process. The flaw is unauthenticated from the network attacker's perspective but requires user interaction to initiate the connection, and no public exploit has been identified at time of analysis.
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows unauthenticated remote attackers to read out-of-bounds memory contents over the network, potentially leaking sensitive data from the RDP service process. The vulnerability requires no authentication or user interaction and is rated CVSS 7.5 with high confidentiality impact only. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables an authorized low-privilege user to elevate to higher privileges via a use-after-free condition. The flaw carries a CVSS 7.8 (High) and no public exploit identified at time of analysis, though Microsoft has acknowledged the issue through MSRC. Successful exploitation grants full confidentiality, integrity, and availability impact on the affected host.
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to gain elevated privileges by triggering a heap-based buffer overflow (CWE-122). The CVSS 9.6 score with scope change (S:C) indicates the compromise crosses security boundaries beyond the vulnerable component itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local privilege escalation in the Windows Projected File System (ProjFS) Filter Driver allows an authenticated low-privileged user on a Windows host to escalate to higher privileges by triggering a buffer over-read in the kernel-mode driver. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 7.8 with low attack complexity and no user interaction makes it an attractive post-compromise target for endpoint operators.
Local privilege escalation in the Windows Function Discovery Service (fdwsd.dll) allows an authorized low-privileged attacker on the host to win a race condition and obtain elevated privileges. Reported by Microsoft (secure@microsoft.com) and tracked under MSRC's update guide, the issue carries a CVSS 7.0 score driven by high impact across confidentiality, integrity, and availability, though the high attack complexity reflects the timing window required. No public exploit identified at time of analysis and the flaw is not currently listed in CISA KEV.
Local privilege escalation in Windows Administrator Protection allows an authorized attacker with low-privilege access to bypass a security feature on affected Windows systems. The flaw stems from improper access control (CWE-284) in the Administrator Protection mechanism, and while no public exploit identified at time of analysis, the high CVSS 7.8 reflects the meaningful impact on confidentiality, integrity, and availability once the bypass is achieved. The issue was reported by Microsoft (secure@microsoft.com) and is tracked through MSRC rather than CISA KEV.
Local privilege escalation in the Windows Projected File System (ProjFS) Filter Driver enables an authorized low-privileged user to elevate to higher privileges through a buffer over-read condition. The flaw affects Microsoft Windows installations where the ProjFS filter driver is present, and exploitation yields high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local privilege escalation in Microsoft Windows DNS allows an authenticated low-privileged user to gain elevated privileges via a heap-based buffer overflow (CWE-122). The CVSS 7.0 score reflects high attack complexity and local-only access, and no public exploit is identified at time of analysis. The flaw was reported privately by Microsoft (MSRC) and is tracked under MSRC advisory CVE-2026-41108.
Local privilege escalation in Microsoft Kinect allows an authenticated low-privileged user to elevate to higher privileges due to improper access control (CWE-284). The vulnerability carries a CVSS 7.8 (High) rating with local attack vector and low complexity, and no public exploit identified at time of analysis. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.
Elevation of privilege in the Microsoft Windows Universal Disk Format File System (UDFS) driver allows a local authenticated attacker to escalate to SYSTEM-level privileges with high impact on confidentiality, integrity, and availability. The CVSS 7.8 vector indicates local attack with low complexity and low privileges required, and no public exploit identified at time of analysis. The vulnerability stems from a numeric truncation error (CWE-197) in kernel-mode file system code, a class historically favored by post-compromise privilege escalation chains.
Local privilege escalation in the Microsoft Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to gain SYSTEM-level code execution by triggering a heap-based buffer overflow (CWE-122). The flaw affects Windows endpoints where the UDFS kernel driver parses attacker-controlled UDF-formatted media (typically optical discs or mounted disc images). No public exploit identified at time of analysis and the issue is not currently listed on CISA KEV.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free condition in the kernel-mode driver. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but AFD.sys has a long history of being targeted for kernel EoP, making this a likely candidate for future weaponization. CVSS 7.0 reflects the high attack complexity required to reliably win the underlying race or reuse condition.
Local privilege escalation in Microsoft Windows Attestation allows an authenticated local user with low privileges to gain elevated permissions on the host through a trust boundary violation (CWE-501). The flaw is rated CVSS 7.8 with high impact across confidentiality, integrity, and availability, and there is no public exploit identified at time of analysis. The issue is tagged as Information Disclosure by the reporter, but the CVSS vector indicates full system compromise potential once exploited.
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Privilege escalation in Windows Telephony Service through heap buffer overflow affects Windows 10 1607, Windows 11 25h2, and Windows Server 2012, allowing adjacent network attackers to gain elevated system access without authentication. The vulnerability has a high CVSS score of 8.8 but currently lacks a patch, creating significant risk for exposed systems. Exploitation requires network proximity but no user interaction.
Windows Winlogon's failure to properly validate symbolic links before file access enables local privilege escalation on affected Windows Server and Windows 10/11 systems. An authenticated attacker can exploit this vulnerability to gain elevated system privileges without user interaction. No patch is currently available for this high-severity issue affecting multiple Windows versions including Server 2025 and Windows 11 26h1.
Information disclosure in Windows GDI+ affects Windows 11 (24h2, 25h2) and Windows Server 2012/2016, allowing unauthenticated attackers to read sensitive data remotely through an out-of-bounds memory access vulnerability. The flaw requires no user interaction and can be exploited over the network to compromise confidentiality without modifying system data or availability. No patch is currently available for this high-severity vulnerability.
Windows Ancillary Function Driver for WinSock in Windows Server 2025, 2022, and Windows 10 1809 contains insufficient input validation that allows authenticated local users to escalate privileges. An attacker with local access and valid credentials can exploit this vulnerability to gain elevated system permissions, though no patch is currently available. This HIGH severity vulnerability affects multiple Windows Server and client versions with no active exploit mitigation path.
Windows Ancillary Function Driver for WinSock (AFD) in Windows 11 versions 24h2 and 26h1 contains a use-after-free vulnerability (CWE-416) that allows authenticated local attackers to escalate privileges through memory corruption. An attacker with local access could exploit this flaw to gain elevated system permissions, though no official patch is currently available.
Privilege escalation in Windows Active Directory Domain Services (AD DS) across Windows 11, Windows 10, and Windows Server platforms allows authenticated network attackers to gain elevated privileges by exploiting improper validation of resource naming restrictions. An attacker with valid domain credentials can leverage this vulnerability to escalate their access level without user interaction. Currently, no patch is available, leaving all affected Windows versions vulnerable.
Windows Ancillary Function Driver for WinSock in Windows 10 (all versions) and Windows 11 contains an access control weakness that enables authenticated local attackers to escalate privileges to system level. An attacker with standard user credentials can exploit this flaw to gain elevated rights on affected systems. No patch is currently available for this vulnerability.
Windows Extensible File Allocation (exFAT) contains an out-of-bounds read vulnerability affecting Windows Server 2022, Windows 10 1607, and Windows 11 versions 23h2/25h2, enabling authenticated local users to escalate privileges with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user-level privileges to exploit, with no patch currently available. This flaw carries a CVSS score of 7.8 and affects multiple supported Windows versions across server and client platforms.
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow vulnerability exploitable by authenticated network attackers. Public exploit code exists for this vulnerability, enabling authenticated users to execute arbitrary code with high integrity and confidentiality impact. No patch is currently available, making this a critical exposure for affected Windows environments.
Privilege escalation in Windows Authentication Methods (Windows 10 22H2, Windows 11 26H1) stems from a use-after-free memory vulnerability that allows authenticated local attackers to gain elevated system privileges. The flaw requires low user privileges and manual interaction but provides complete system compromise through code execution. No patch is currently available for this high-severity vulnerability.
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]
Privilege escalation in Microsoft's Brokering File System on Windows 11 (24h2 and 25h2) stems from a use-after-free vulnerability that allows local attackers to gain elevated system privileges. An attacker with local access can exploit memory corruption to execute arbitrary code with higher privileges, potentially compromising system integrity. No patch is currently available for this vulnerability.
Local code execution in Windows System Image Manager (Windows 11 23h2, Windows Server 2019/2022) through unsafe deserialization of untrusted data. An authenticated local attacker can exploit this vulnerability to execute arbitrary code with elevated privileges. No patch is currently available.
Privilege escalation in Windows Performance Counters via null pointer dereference affects Windows Server 2019 and Windows 11 systems, enabling authenticated local attackers to gain elevated privileges. The vulnerability impacts systems where users have standard account access, allowing them to escalate to higher privilege levels on affected machines. No patch is currently available.
Privilege escalation in Windows Device Association Service (Windows 10 versions 1607, 1809, and 21H2) stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires high attack complexity and no user interaction, making it exploitable by insiders or compromised local accounts. No patch is currently available.
Privilege escalation in Windows Device Association Service across Windows 10, 11, and Server 2022 stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires local access and specific timing conditions but poses high risk due to its impact on confidentiality, integrity, and availability. No patch is currently available.
Windows SMB Server authentication bypass across multiple versions (Windows 10 1607, Windows 11 23h2, Windows Server 2012/2025) permits authenticated local users to escalate privileges with high impact to confidentiality, integrity, and availability. The vulnerability stems from improper authentication validation in the SMB service, allowing a local attacker to gain system-level access without user interaction. No patch is currently available, leaving affected systems vulnerable to privilege escalation attacks from any authenticated user.
Privilege escalation in Windows Ancillary Function Driver for WinSock affects Windows 11 24H2, Windows Server 2022, and Windows Server 2025, allowing authenticated local attackers to gain system-level access through null pointer dereference. The vulnerability requires valid user credentials and local access but no user interaction to exploit. No patch is currently available.
Privilege escalation in Windows Connected Devices Platform Service (Cdpsvc) exploits a use-after-free memory vulnerability, affecting Windows 10 22h2 and Windows 11 (25h2, 26h1). An authenticated local attacker can leverage this flaw to gain system-level privileges on vulnerable systems. No patch is currently available for this high-severity vulnerability.
Privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) across Windows 10, Windows 11, and Windows Server 2022 stems from improper permission assignments on a critical resource. A local authenticated attacker can exploit this misconfiguration to gain elevated privileges without user interaction. No patch is currently available for this vulnerability.
Windows Projected File System in Windows 11 and Server 2022 contains improper access control that enables authenticated local users to escalate privileges to system level. An attacker with valid credentials can exploit this vulnerability to gain elevated permissions without user interaction. Currently, no patch is available to address this issue.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]
Windows Kernel path traversal vulnerability in Server 2025, Server 2022, Windows 11 24h2, and Windows 10 22h2 enables authenticated local attackers to achieve full system compromise through privilege escalation. The flaw allows an authorized user to manipulate file name or path parameters, bypassing access controls and gaining kernel-level privileges. No patch is currently available.
Privilege escalation in Windows 11 (24h2, 26h1) and Windows Server 2022 (23h2) via heap overflow allows authenticated local users to gain system-level access. The vulnerability requires valid credentials but no user interaction, making it a direct path to complete system compromise. No patch is currently available.
Windows MapUrlToZone security bypass in Windows 11 24H2, Windows 10 21H2, and Windows Server 2016/2025 allows unauthenticated remote attackers to circumvent zone-based security restrictions through improper path equivalence resolution. An attacker can exploit this network-accessible vulnerability without user interaction to bypass intended access controls. No patch is currently available for this high-severity vulnerability.
Windows ReFS contains an out-of-bounds read vulnerability affecting Server 2019, 2022, 2025, and Windows 11 26h1 that enables authenticated local users to escalate privileges with high impact to confidentiality, integrity, and availability. The vulnerability requires low attack complexity and no user interaction, making it exploitable by any authenticated user on the system. No patch is currently available for this HIGH severity issue.
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability [CVSS 7.8 HIGH]
Privilege escalation in the Windows Bluetooth RFCOM Protocol Driver across Windows 11 26h1, Windows Server 2025, and Windows 10 1809 stems from improper synchronization of concurrent access to shared resources. An authenticated local attacker can exploit this race condition to gain elevated privileges on affected systems. No patch is currently available for this vulnerability.
Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Use-after-free in Windows Distributed File System (DFS) enables an authenticated network attacker to crash the DFS service, resulting in denial of file-sharing access across affected Windows client and server versions. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but constrains exploitation to low-privilege authenticated accounts under high-complexity conditions. Microsoft has released patches covering the full affected range from Windows 10 1607 through Windows Server 2025; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Information disclosure in the Windows NTFS filesystem driver allows a local low-privileged attacker to read beyond buffer boundaries and expose sensitive memory contents. Affecting virtually every supported Windows desktop and server release - from Windows 10 1607 through Windows Server 2025 and Windows 11 26H1 - the vulnerability requires only a standard local user account and no special configuration, making it a realistic threat in multi-tenant, shared, or cloud environments where local access is granted to semi-trusted users. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged user to elevate to SYSTEM via a use-after-free condition. The flaw affects Microsoft Windows installations using the standard WinSock kernel driver and has a vendor-released patch available through Microsoft's security update guide. No public exploit has been identified at time of analysis, though afd.sys has historically been a frequent target for elevation-of-privilege exploitation.
Local privilege escalation in the Windows Hotpatch Monitoring Service enables an authenticated low-privileged attacker to gain elevated privileges through an out-of-bounds write (CWE-787) memory corruption flaw. The CVSS 7.8 (AV:L/AC:L/PR:L) reflects local attack vector with low complexity once a foothold is obtained, and no public exploit identified at time of analysis. The vulnerability was reported by Microsoft's own security team (secure@microsoft.com), suggesting internal discovery prior to disclosure.
Remote code execution in Microsoft Remote Desktop Client is possible when a user connects to an attacker-controlled or compromised RDP endpoint, where a race condition (CWE-362) can be triggered to corrupt heap memory and execute arbitrary code in the client process. The flaw is unauthenticated from the network attacker's perspective but requires user interaction to initiate the connection, and no public exploit has been identified at time of analysis.
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows unauthenticated remote attackers to read out-of-bounds memory contents over the network, potentially leaking sensitive data from the RDP service process. The vulnerability requires no authentication or user interaction and is rated CVSS 7.5 with high confidentiality impact only. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables an authorized low-privilege user to elevate to higher privileges via a use-after-free condition. The flaw carries a CVSS 7.8 (High) and no public exploit identified at time of analysis, though Microsoft has acknowledged the issue through MSRC. Successful exploitation grants full confidentiality, integrity, and availability impact on the affected host.
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to gain elevated privileges by triggering a heap-based buffer overflow (CWE-122). The CVSS 9.6 score with scope change (S:C) indicates the compromise crosses security boundaries beyond the vulnerable component itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local privilege escalation in the Windows Projected File System (ProjFS) Filter Driver allows an authenticated low-privileged user on a Windows host to escalate to higher privileges by triggering a buffer over-read in the kernel-mode driver. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 7.8 with low attack complexity and no user interaction makes it an attractive post-compromise target for endpoint operators.
Local privilege escalation in the Windows Function Discovery Service (fdwsd.dll) allows an authorized low-privileged attacker on the host to win a race condition and obtain elevated privileges. Reported by Microsoft (secure@microsoft.com) and tracked under MSRC's update guide, the issue carries a CVSS 7.0 score driven by high impact across confidentiality, integrity, and availability, though the high attack complexity reflects the timing window required. No public exploit identified at time of analysis and the flaw is not currently listed in CISA KEV.
Local privilege escalation in Windows Administrator Protection allows an authorized attacker with low-privilege access to bypass a security feature on affected Windows systems. The flaw stems from improper access control (CWE-284) in the Administrator Protection mechanism, and while no public exploit identified at time of analysis, the high CVSS 7.8 reflects the meaningful impact on confidentiality, integrity, and availability once the bypass is achieved. The issue was reported by Microsoft (secure@microsoft.com) and is tracked through MSRC rather than CISA KEV.
Local privilege escalation in the Windows Projected File System (ProjFS) Filter Driver enables an authorized low-privileged user to elevate to higher privileges through a buffer over-read condition. The flaw affects Microsoft Windows installations where the ProjFS filter driver is present, and exploitation yields high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local privilege escalation in Microsoft Windows DNS allows an authenticated low-privileged user to gain elevated privileges via a heap-based buffer overflow (CWE-122). The CVSS 7.0 score reflects high attack complexity and local-only access, and no public exploit is identified at time of analysis. The flaw was reported privately by Microsoft (MSRC) and is tracked under MSRC advisory CVE-2026-41108.
Local privilege escalation in Microsoft Kinect allows an authenticated low-privileged user to elevate to higher privileges due to improper access control (CWE-284). The vulnerability carries a CVSS 7.8 (High) rating with local attack vector and low complexity, and no public exploit identified at time of analysis. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.
Elevation of privilege in the Microsoft Windows Universal Disk Format File System (UDFS) driver allows a local authenticated attacker to escalate to SYSTEM-level privileges with high impact on confidentiality, integrity, and availability. The CVSS 7.8 vector indicates local attack with low complexity and low privileges required, and no public exploit identified at time of analysis. The vulnerability stems from a numeric truncation error (CWE-197) in kernel-mode file system code, a class historically favored by post-compromise privilege escalation chains.
Local privilege escalation in the Microsoft Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to gain SYSTEM-level code execution by triggering a heap-based buffer overflow (CWE-122). The flaw affects Windows endpoints where the UDFS kernel driver parses attacker-controlled UDF-formatted media (typically optical discs or mounted disc images). No public exploit identified at time of analysis and the issue is not currently listed on CISA KEV.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free condition in the kernel-mode driver. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but AFD.sys has a long history of being targeted for kernel EoP, making this a likely candidate for future weaponization. CVSS 7.0 reflects the high attack complexity required to reliably win the underlying race or reuse condition.
Local privilege escalation in Microsoft Windows Attestation allows an authenticated local user with low privileges to gain elevated permissions on the host through a trust boundary violation (CWE-501). The flaw is rated CVSS 7.8 with high impact across confidentiality, integrity, and availability, and there is no public exploit identified at time of analysis. The issue is tagged as Information Disclosure by the reporter, but the CVSS vector indicates full system compromise potential once exploited.
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Privilege escalation in Windows Telephony Service through heap buffer overflow affects Windows 10 1607, Windows 11 25h2, and Windows Server 2012, allowing adjacent network attackers to gain elevated system access without authentication. The vulnerability has a high CVSS score of 8.8 but currently lacks a patch, creating significant risk for exposed systems. Exploitation requires network proximity but no user interaction.
Windows Winlogon's failure to properly validate symbolic links before file access enables local privilege escalation on affected Windows Server and Windows 10/11 systems. An authenticated attacker can exploit this vulnerability to gain elevated system privileges without user interaction. No patch is currently available for this high-severity issue affecting multiple Windows versions including Server 2025 and Windows 11 26h1.
Information disclosure in Windows GDI+ affects Windows 11 (24h2, 25h2) and Windows Server 2012/2016, allowing unauthenticated attackers to read sensitive data remotely through an out-of-bounds memory access vulnerability. The flaw requires no user interaction and can be exploited over the network to compromise confidentiality without modifying system data or availability. No patch is currently available for this high-severity vulnerability.
Windows Ancillary Function Driver for WinSock in Windows Server 2025, 2022, and Windows 10 1809 contains insufficient input validation that allows authenticated local users to escalate privileges. An attacker with local access and valid credentials can exploit this vulnerability to gain elevated system permissions, though no patch is currently available. This HIGH severity vulnerability affects multiple Windows Server and client versions with no active exploit mitigation path.
Windows Ancillary Function Driver for WinSock (AFD) in Windows 11 versions 24h2 and 26h1 contains a use-after-free vulnerability (CWE-416) that allows authenticated local attackers to escalate privileges through memory corruption. An attacker with local access could exploit this flaw to gain elevated system permissions, though no official patch is currently available.
Privilege escalation in Windows Active Directory Domain Services (AD DS) across Windows 11, Windows 10, and Windows Server platforms allows authenticated network attackers to gain elevated privileges by exploiting improper validation of resource naming restrictions. An attacker with valid domain credentials can leverage this vulnerability to escalate their access level without user interaction. Currently, no patch is available, leaving all affected Windows versions vulnerable.
Windows Ancillary Function Driver for WinSock in Windows 10 (all versions) and Windows 11 contains an access control weakness that enables authenticated local attackers to escalate privileges to system level. An attacker with standard user credentials can exploit this flaw to gain elevated rights on affected systems. No patch is currently available for this vulnerability.
Windows Extensible File Allocation (exFAT) contains an out-of-bounds read vulnerability affecting Windows Server 2022, Windows 10 1607, and Windows 11 versions 23h2/25h2, enabling authenticated local users to escalate privileges with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user-level privileges to exploit, with no patch currently available. This flaw carries a CVSS score of 7.8 and affects multiple supported Windows versions across server and client platforms.
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow vulnerability exploitable by authenticated network attackers. Public exploit code exists for this vulnerability, enabling authenticated users to execute arbitrary code with high integrity and confidentiality impact. No patch is currently available, making this a critical exposure for affected Windows environments.
Privilege escalation in Windows Authentication Methods (Windows 10 22H2, Windows 11 26H1) stems from a use-after-free memory vulnerability that allows authenticated local attackers to gain elevated system privileges. The flaw requires low user privileges and manual interaction but provides complete system compromise through code execution. No patch is currently available for this high-severity vulnerability.
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]
Privilege escalation in Microsoft's Brokering File System on Windows 11 (24h2 and 25h2) stems from a use-after-free vulnerability that allows local attackers to gain elevated system privileges. An attacker with local access can exploit memory corruption to execute arbitrary code with higher privileges, potentially compromising system integrity. No patch is currently available for this vulnerability.
Local code execution in Windows System Image Manager (Windows 11 23h2, Windows Server 2019/2022) through unsafe deserialization of untrusted data. An authenticated local attacker can exploit this vulnerability to execute arbitrary code with elevated privileges. No patch is currently available.
Privilege escalation in Windows Performance Counters via null pointer dereference affects Windows Server 2019 and Windows 11 systems, enabling authenticated local attackers to gain elevated privileges. The vulnerability impacts systems where users have standard account access, allowing them to escalate to higher privilege levels on affected machines. No patch is currently available.
Privilege escalation in Windows Device Association Service (Windows 10 versions 1607, 1809, and 21H2) stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires high attack complexity and no user interaction, making it exploitable by insiders or compromised local accounts. No patch is currently available.
Privilege escalation in Windows Device Association Service across Windows 10, 11, and Server 2022 stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires local access and specific timing conditions but poses high risk due to its impact on confidentiality, integrity, and availability. No patch is currently available.
Windows SMB Server authentication bypass across multiple versions (Windows 10 1607, Windows 11 23h2, Windows Server 2012/2025) permits authenticated local users to escalate privileges with high impact to confidentiality, integrity, and availability. The vulnerability stems from improper authentication validation in the SMB service, allowing a local attacker to gain system-level access without user interaction. No patch is currently available, leaving affected systems vulnerable to privilege escalation attacks from any authenticated user.
Privilege escalation in Windows Ancillary Function Driver for WinSock affects Windows 11 24H2, Windows Server 2022, and Windows Server 2025, allowing authenticated local attackers to gain system-level access through null pointer dereference. The vulnerability requires valid user credentials and local access but no user interaction to exploit. No patch is currently available.
Privilege escalation in Windows Connected Devices Platform Service (Cdpsvc) exploits a use-after-free memory vulnerability, affecting Windows 10 22h2 and Windows 11 (25h2, 26h1). An authenticated local attacker can leverage this flaw to gain system-level privileges on vulnerable systems. No patch is currently available for this high-severity vulnerability.
Privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) across Windows 10, Windows 11, and Windows Server 2022 stems from improper permission assignments on a critical resource. A local authenticated attacker can exploit this misconfiguration to gain elevated privileges without user interaction. No patch is currently available for this vulnerability.
Windows Projected File System in Windows 11 and Server 2022 contains improper access control that enables authenticated local users to escalate privileges to system level. An attacker with valid credentials can exploit this vulnerability to gain elevated permissions without user interaction. Currently, no patch is available to address this issue.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]
Windows Kernel path traversal vulnerability in Server 2025, Server 2022, Windows 11 24h2, and Windows 10 22h2 enables authenticated local attackers to achieve full system compromise through privilege escalation. The flaw allows an authorized user to manipulate file name or path parameters, bypassing access controls and gaining kernel-level privileges. No patch is currently available.
Privilege escalation in Windows 11 (24h2, 26h1) and Windows Server 2022 (23h2) via heap overflow allows authenticated local users to gain system-level access. The vulnerability requires valid credentials but no user interaction, making it a direct path to complete system compromise. No patch is currently available.
Windows MapUrlToZone security bypass in Windows 11 24H2, Windows 10 21H2, and Windows Server 2016/2025 allows unauthenticated remote attackers to circumvent zone-based security restrictions through improper path equivalence resolution. An attacker can exploit this network-accessible vulnerability without user interaction to bypass intended access controls. No patch is currently available for this high-severity vulnerability.
Windows ReFS contains an out-of-bounds read vulnerability affecting Server 2019, 2022, 2025, and Windows 11 26h1 that enables authenticated local users to escalate privileges with high impact to confidentiality, integrity, and availability. The vulnerability requires low attack complexity and no user interaction, making it exploitable by any authenticated user on the system. No patch is currently available for this HIGH severity issue.
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability [CVSS 7.8 HIGH]
Privilege escalation in the Windows Bluetooth RFCOM Protocol Driver across Windows 11 26h1, Windows Server 2025, and Windows 10 1809 stems from improper synchronization of concurrent access to shared resources. An authenticated local attacker can exploit this race condition to gain elevated privileges on affected systems. No patch is currently available for this vulnerability.
Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Use-after-free in Windows Distributed File System (DFS) enables an authenticated network attacker to crash the DFS service, resulting in denial of file-sharing access across affected Windows client and server versions. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but constrains exploitation to low-privilege authenticated accounts under high-complexity conditions. Microsoft has released patches covering the full affected range from Windows 10 1607 through Windows Server 2025; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Information disclosure in the Windows NTFS filesystem driver allows a local low-privileged attacker to read beyond buffer boundaries and expose sensitive memory contents. Affecting virtually every supported Windows desktop and server release - from Windows 10 1607 through Windows Server 2025 and Windows 11 26H1 - the vulnerability requires only a standard local user account and no special configuration, making it a realistic threat in multi-tenant, shared, or cloud environments where local access is granted to semi-trusted users. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.