Windows 11 26h1
Monthly
Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Geotag Broker component of Microsoft Windows lets an authenticated low-privileged user already running code on a host elevate to a higher-integrity context, with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating high impact to confidentiality, integrity and availability and no user interaction required. Affected systems are unpatched Windows 10, Windows 11 and Windows Server builds below the fixed build numbers published by the vendor, including Server Core installations; exploitation requires local interactive or code-execution access (PR:L, AV:L), so risk is concentrated on multi-user hosts such as RDP/terminal servers, shared workstations and systems where untrusted users can run code. There is no public exploit identified at time of analysis and no CISA KEV listing, and Microsoft has released a vendor patch - this is a patch-priority issue rather than a remotely exploitable emergency.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.
Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Local privilege escalation in Windows Kernel-Mode Drivers lets an attacker who already holds low-privileged, authenticated access to a Windows host (CVSS PR:L, AV:L) exploit improper access control (CWE-862) to gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact. Affected builds span Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core installations); no user interaction is required, but there is no remote or network attack path, so the flaw is a post-compromise escalation primitive rather than an initial access vector. There is no public exploit identified at time of analysis and CISA's SSVC evaluation records exploitation as 'none' with automatable 'no', though technical impact is rated total; EPSS and KEV data were not provided, and a vendor patch is available per Microsoft's advisory.
Local privilege escalation in the Windows NTFS file-system driver (CVE-2026-83567) allows an authenticated attacker who can already execute code on a Windows host to trigger an out-of-bounds read, which Microsoft scores as a full compromise of confidentiality and integrity (CVSS 7.8, C:H/I:H/A:H). Affected builds span essentially the entire supported Windows estate - Windows 10 1607 through 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - all in default configuration. This is a genuine but not emergency-priority vulnerability: no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has published vendor patches, so the practical risk is bounded by the requirement for pre-existing local authenticated access and the absence of a remote vector.
Local privilege escalation in the Windows Win32K ICOMP subsystem allows an authenticated attacker holding only low-privilege local code execution to elevate to kernel/SYSTEM context by triggering a use-after-free (CWE-416) in a Win32K object-lifetime code path. The flaw is confined to local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and requires winning a timing-dependent race, so it cannot be used for initial access or remote compromise and is only meaningful as a post-exploitation escalation step. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; Microsoft has released a vendor patch.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.
Heap-based buffer overflow (CWE-122) in the Windows Image Acquisition (WIA) component affects Windows 11 24H2, 25H2, 26H1 and 26H2 (x64 and arm64) plus Windows Server 2025, including Server Core installations, on builds earlier than the fixed versions. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which describes a network-reachable, unauthenticated attacker with no user interaction required and high confidentiality, integrity and availability impact; however, the supplied sources do not state how the heap overflow is triggered or whether a specific WIA service exposure must be reachable, so the precise network precondition is not confirmed. Exploitation status is none per SSVC and there is no KEV entry, EPSS is 0.84% (57th percentile), and no public exploit code or PoC reference appears in the input; the vuln.today decision label is act_now despite the low exploitation likelihood, and the vendor has released patches.
Spoofing and authentication bypass in the Microsoft Windows IKE Extension allow an unauthenticated remote attacker to subvert a security decision made during Internet Key Exchange negotiation, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1). All supported Windows client and server branches that carry the IKE Extension are affected, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, with Server Core installations included. Exploitation is conditional rather than trivial: the CVSS vector is AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are required, but the target host must actually have IKE/IPsec configured and actively negotiating and the attacker must hold a network position capable of influencing the handshake (a man-in-the-middle vantage or race-window dependency). CISA's SSVC assessment rates Exploitation as none and Automatable as no while assigning total technical impact, and no public exploit code or in-the-wild activity has been identified - no public exploit identified at time of analysis. Vendor patches are published by Microsoft (EUVD-2026-99912 / CVE-2026-83522) and should be treated as a priority for any estate that runs IPsec.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
A heap-based buffer overflow in the Windows RPC Runtime lets an authenticated local attacker with standard user rights elevate to higher privileges on affected Windows 11 hosts. The flaw is only reachable by code already executing on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and the vulnerable component is core, always-present Windows infrastructure, so no special configuration or user interaction is needed once a foothold exists. Microsoft has released fixes in its update guide (MSRC advisory for CVE-2026-83518), and there is no public exploit identified at time of analysis (SSVC exploitation: none, CISA KEV not listed); this makes it a patch-priority item for fleets still running unpatched Windows 11 builds rather than an emergency.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Remote, unauthenticated denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows any network-reachable attacker to crash the process that handles logon, credential validation and authentication for the host. Affected builds span Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core installations); patched builds at or above the vendor-listed build numbers are not exploitable. The impact is availability-only - no code execution, no data disclosure and no integrity impact - so real-world exposure is mainly a concern where authentication ports are reachable and where a host reboot or loss of authentication services is operationally disruptive; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
Information disclosure in the Microsoft Windows RPC Runtime lets an unauthenticated remote attacker read data that should never leave the host, because the service can return the contents of an uninitialized resource to a caller. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the prerequisites: network reach to a Windows RPC endpoint, no credentials, no user interaction, and impact limited to confidentiality. Affected systems span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. No public exploit has been identified at time of analysis and CISA SSVC records exploitation as none; EPSS is 0.94% (60th percentile), so this is a real but non-emergency priority to be addressed in the current patch cycle rather than an emergency.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Setup Files Cleanup component allows an attacker who already holds low-privileged, authenticated access to a vulnerable Windows host to win a time-of-check time-of-use race and gain SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, with CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote vector and no user interaction required, but exploitation demands an existing foothold plus a reliably won race, which CISA's SSVC assessment marks as not automatable and with no observed exploitation; no public exploit code has been identified at time of analysis and Patch is available from the vendor.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in Microsoft Windows NTFS stems from an out-of-bounds read (CWE-125) that an authenticated attacker who already holds a low-privileged foothold on the host can trigger to reach high-integrity code execution and to read beyond the bounds of a kernel buffer (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw touches the default Windows filesystem, so unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025 and their Server Core installations are all in scope, but the local attack vector (no remote, unauthenticated reach) confines it to post-compromise escalation rather than an initial access path. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and Microsoft has released vendor patches.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation exists in Microsoft's Windows Setup Files Cleanup component, where a time-of-check time-of-use race condition lets an authenticated, low-privileged user on the host escalate to higher (typically SYSTEM-level) privileges. The issue affects a broad range of Windows client and server releases, from Windows 10 version 1607 and Server 2016 through Windows 11 version 26H2/26H1 and Windows Server 2025. Exploitation requires prior local access and a low-privileged account (CVSS PR:L) and depends on winning a timing-dependent race, which makes it high-complexity (AC:H) and non-deterministic rather than a reliable, automatable attack - there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, though the technical impact is rated total. Vendor patches are available.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated low-privileged local user to gain SYSTEM-level rights on unpatched hosts, with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity and availability within the affected machine. Exploitation is not remotely reachable - it requires an existing foothold on the host as an unprivileged user - and there is no public exploit code and no confirmed active exploitation (no CISA KEV listing; SSVC exploitation: none, automatable: no). Microsoft has released vendor patches covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so risk is concentrated in fleets still running builds below the fixed levels listed in the EUVD record.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authorized attacker who already holds a foothold on a Windows host to run code at higher integrity by triggering a use-after-free memory corruption condition (CWE-416). Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local authenticated access and a hard-to-win timing or object-lifecycle state (AC:H) that the attacker does not fully control, but yields total loss of confidentiality, integrity and availability once achieved. Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds are affected; Microsoft has shipped fixed builds, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.
Local privilege escalation in the Windows Application Compatibility Cache (ShimCache) allows an attacker who already holds low-privileged local code execution to elevate to higher integrity on unpatched Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 systems. The defect is a use-after-free (CWE-416) that must be won in a narrow race window, and the assessed vector (AV:L/AC:H/PR:L/UI:N) reflects a post-compromise escalation path rather than a remote entry point, which is why SSVC records Exploitation: none, Automatable: no, and our assessment treats this as a genuine but moderate-priority local privilege escalation rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and no CISA KEV entry exists, though the CVSS base score of 7.0 is driven by total confidentiality, integrity, and availability impact once the elevation succeeds.
Use-after-free in the Windows Program Compatibility Assistant Service (PcaSvc) allows an attacker who already holds a low-privileged, authenticated local session to escalate privileges to a higher-integrity context on the same host, achieving total compromise of confidentiality, integrity, and availability (CVSS 7.0, C:H/I:H/A:H). The flaw is a memory-corruption race that the attacker must win to reliably corrupt freed memory, so the high attack-complexity rating limits repeatability, and exploitation requires prior local code execution - remote, unauthenticated attackers are not in scope (AV:L/AC:H/PR:L/UI:N). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2025 builds are affected; no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records exploitation as 'none' with the vulnerability not automatable. This is a genuine but moderate-priority elevation-of-privilege issue rather than a top-tier emergency, and vendor patches are available.
Local privilege elevation in the Windows Security Center component allows an attacker who already holds a low-privileged local account to gain higher privileges (high confidentiality, integrity and availability impact) by exploiting a race condition during concurrent execution of a shared resource. Only Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) installations are in scope, and because the attack requires an existing foothold plus a reliably won timing window (CVSS AV:L/AC:H/PR:L), it is not remotely reachable and is not automatable. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (11th percentile), which places this in a this-week remediation cadence rather than an emergency one.
Windows Credential Guard does not enforce authentication on a critical function, letting a local, already-authenticated low-privileged user on an affected Windows host perform spoofing (CVSS 7.8, CWE-306). Exploitation is strictly local and requires prior account access to the machine, so exposure is concentrated on multi-user, shared, or already-compromised endpoints running Credential Guard rather than internet-facing systems; the specific function or configuration state involved is not described in the available sources. Microsoft has released fixed builds for Windows 10, Windows 11 and Windows Server, and no public exploit or CISA KEV entry is associated with the CVE at time of analysis; EPSS is 0.30% (22nd percentile), consistent with a moderate, this-week priority rather than emergency response.
Local privilege escalation in Microsoft Windows Schannel allows an authenticated attacker who already holds low-privileged code execution on a host to leverage a null pointer dereference in the TLS/SSL security provider into full compromise of the machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds span Windows Server 2012 and 2012 R2 through Windows Server 2025, plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) below the fixed build numbers published by the vendor; because Schannel is present by default in all supported releases, there is no feature toggle that removes the exposure. No public exploit identified at time of analysis, and the local-only vector combined with the prerequisite of an existing foothold makes this a genuine patch-priority item rather than an emergency - though multi-user, terminal-services, and server hosts where untrusted parties can run code warrant scheduling priority.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Code execution risk in the Windows CD-ROM Driver arises when the driver processes attacker-controlled disc-image or CD-ROM data, leading to an untrusted pointer dereference (CWE-822) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixed builds for every listed branch, and the available data shows no public exploit or observed in-the-wild exploitation, with EPSS at 0.84% (57th percentile); the vendor vector is 9.8, but the independent assessment rates AC:H because the network delivery path to the driver is not described and SSVC marks exploitation as none and automatable as no. The priority label is act_now, and the technical impact is total.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an authenticated attacker who can already execute code as a low-privileged user on the host to corrupt kernel memory and escalate to SYSTEM privileges. The flaw is a use-after-free reachable through the driver with no user interaction required (CVSS 7.8, AV:L/PR:L/UI:N, S:U, C:H/I:H/A:H), and it affects unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds as well as Windows Server 2025 (including Server Core) builds below the fixed build numbers. Microsoft has published a vendor patch; there is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit identified at time of analysis, so this is a post-compromise escalation step rather than a remote entry point.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated attacker who already holds low-privileged code execution on an affected host to gain full control of the system (CVSS 7.0, C:H/I:H/A:H) by triggering a use-after-free in kernel memory. Exploitation is constrained by high attack complexity (AC:H), since the attacker must reliably win a timing/race window and groom kernel heap state; there is no remote or unauthenticated vector. Affected are unpatched Windows 11 24H2, 25H2, 26H1, and 26H2 builds and Windows Server 2025 builds below the fixed versions, and no public exploit or confirmed active exploitation was identified at time of analysis; Microsoft has released a patch.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.
Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.
Heap-based buffer overflow in the Windows WebDAV component allows remote attackers to elevate privileges and potentially achieve full compromise of confidentiality, integrity and availability (CVSS 9.8). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based with no authentication and no user interaction required, and the affected scope covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, below the per-branch fixed builds published by Microsoft. The signals are strongly mixed: there is no CISA KEV entry and SSVC records Exploitation: none with Automatable: no, so no public exploit has been identified at time of analysis, and EPSS is modest at 0.84% (57th percentile); nevertheless technical impact is rated total and the vuln.today decision label is act_now with a vendor-released patch available. Whether exploitation requires an enabled, reachable WebDAV listener rather than a client-side connect-back is not described in the available sources.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.
Local code execution in Microsoft Windows HTTP.sys affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, including Server Core installations. An attacker who already holds a valid low-privilege authenticated session on the host (CVSS vector AV:L/PR:L/UI:N) can trigger an out-of-bounds read in the HTTP kernel driver with no user interaction, delivering high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixes; multi-user hosts such as RDP/terminal servers, where untrusted users hold local accounts, carry the highest realistic exposure.
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.
Remote code execution against domain controllers running Active Directory Domain Services is achievable by an unauthenticated network attacker (CVSS 3.1: AV:N/PR:N/UI:N) who successfully bypasses an incorrect authorization check, yielding full confidentiality, integrity, and availability impact for a base score of 8.1. The practical constraint is the High attack-complexity rating: exploiting the flawed authorization decision requires an attacker-influenced condition such as a timing window, race, or particular directory state rather than a single deterministic request against a default configuration, and only hosts serving the AD DS role - not member servers or ordinary clients - are the realistic target. At time of analysis no public exploit identified and no confirmed active exploitation (no CISA KEV listing); vendor patch available, with EUVD-listed fixed build levels published.
Local privilege escalation in the Windows Desktop Window Manager (dwm.exe) allows an attacker who already holds an authenticated low-privilege account on the target host to exploit an out-of-bounds read and gain elevated (SYSTEM-level) code execution. All supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions are affected up to their respective fixed builds, and the prerequisite is purely local code execution with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). No public exploit code or confirmed active exploitation has been identified at the time of analysis and CISA SSVC rates exploitation as none and not automatable, so this is a routine patch-priority item rather than an emergency - but the vendor update should be applied promptly on multi-user, RDP-accessible, and privileged-administration endpoints where a local foothold is easiest to obtain.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Local privilege escalation in the Windows StateRepository API allows an authenticated, low-privileged attacker who already has code execution on a Windows 11 host to gain SYSTEM-level rights, because the API's access controls lack sufficient granularity to separate callers by privilege. Affected builds are Windows 11 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H1 below 10.0.28000.3231, and 26H2 below 10.0.26300.9711. The flaw is not remotely reachable (AV:L, PR:L, UI:N) and CISA's SSVC framework rates it non-automatable with exploitation observed as none, so it functions as a post-compromise escalation step rather than an initial-access vector; no public exploit identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Security Center lets an attacker who already holds a foothold on a Windows host with low-level privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) abuse an improperly restricted communication channel to obtain high confidentiality and integrity impact on the same machine. Only hosts that have not yet applied the current cumulative builds are affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019 including Server Core installations. The high attack complexity indicates a non-trivial precondition - most consistent with a race or transient-state condition that must be won to redirect or spoof the endpoint - so reliability is limited; prior local access and valid credentials are mandatory and no public exploit identified at time of analysis, with no CISA KEV listing.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.
Windows PowerShell on supported Windows client and server editions fails to enforce a protection mechanism, letting a locally authenticated low-privileged attacker bypass a security feature and operate outside the intended security boundary, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, scope-changed). Exploitation requires a pre-existing local foothold and the ability to run PowerShell on the host - there is no remote or unauthenticated path, and CISA's SSVC assessment rates exploitation as 'none' with Automatable=no, meaning the issue is not wormable or easily mass-scanned. There is no public exploit identified at time of analysis, though the technical impact is rated total once the prerequisite access is obtained; Microsoft has released fixes and the MSRC update guide is the authoritative remediation source.
Local privilege escalation in Microsoft's Windows Backup Engine (CWE-41, path equivalence mis-resolution) allows an authenticated, low-privileged attacker with local access to a Windows host to gain elevated privileges by manipulating a path that the Backup Engine resolves to an equivalent but attacker-controlled location; exploitation requires no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). The attack surface is confined to hosts where an attacker already holds an unprivileged foothold, making multi-user systems, shared workstations, and terminal/RDP-style environments the realistic risk scenario rather than remote perimeter exposure. Microsoft has published fixed builds through the MSRC update guide, and no public exploit identified at time of analysis - no confirmed actively exploited (CISA KEV) status and no publicly available exploit code exists, so this is a credible but not emergency-tier patch-cycle priority.
Local privilege escalation in the Windows Search component affects every pre-patch build of supported Windows client and server editions, letting an attacker who already holds low-privileged local access execute code at a higher integrity level by exploiting a numeric truncation error in the search/indexing code path. Rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires local authenticated access (PR:L, AV:L) but no victim interaction (UI:N) and has low attack complexity, making it a post-compromise escalation primitive rather than a remote or initial-access vector. CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft.
Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.
Local privilege escalation in Microsoft Windows NTFS lets an authenticated attacker who already has low-privileged code execution on the host escalate to kernel/SYSTEM level by driving the filesystem driver into an untrusted pointer dereference (CWE-822). The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects every listed Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025 build below its patched revision, since NTFS is the default Windows filesystem and no non-default configuration is required. There is no public exploit identified at time of analysis and CISA SSVC rates Exploitation=none and Automatable=no; Microsoft has shipped vendor patches, making this a credible but not emergency-level priority.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10, Windows 11 and Windows Server 2012 through 2025 hosts on which the RRAS role is installed, with the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating a network-reachable attacker who already holds a low-privilege authenticated position, requires no user interaction, and can achieve full confidentiality, integrity and availability impact. The defect is a double free (CWE-415) memory-corruption condition in the service, which Microsoft has addressed in its monthly update with fixed builds published for each supported branch. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and real-world exposure is materially narrowed because RRAS is not enabled by default on standard Windows installations.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
Local privilege escalation in Windows Direct Composition (the dcomp/DWM compositing subsystem) lets an attacker who already holds low-privileged code execution on a target box corrupt freed memory and elevate to a higher-integrity context, including SYSTEM. Every supported Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2022/2025 build ships the affected component by default, but the CVSS vector (AV:L/PR:L/UI:N) confirms exploitation requires an existing local foothold and no user interaction, making this a post-compromise escalation primitive rather than an initial access vector. With a base score of 7.8 and high confidentiality, integrity and availability impact, it is a credible but not emergency-tier priority: vendor patches are available, and no public exploit identified at time of analysis.
A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.
Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Geotag Broker component of Microsoft Windows lets an authenticated low-privileged user already running code on a host elevate to a higher-integrity context, with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating high impact to confidentiality, integrity and availability and no user interaction required. Affected systems are unpatched Windows 10, Windows 11 and Windows Server builds below the fixed build numbers published by the vendor, including Server Core installations; exploitation requires local interactive or code-execution access (PR:L, AV:L), so risk is concentrated on multi-user hosts such as RDP/terminal servers, shared workstations and systems where untrusted users can run code. There is no public exploit identified at time of analysis and no CISA KEV listing, and Microsoft has released a vendor patch - this is a patch-priority issue rather than a remotely exploitable emergency.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.
Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Local privilege escalation in Windows Kernel-Mode Drivers lets an attacker who already holds low-privileged, authenticated access to a Windows host (CVSS PR:L, AV:L) exploit improper access control (CWE-862) to gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact. Affected builds span Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core installations); no user interaction is required, but there is no remote or network attack path, so the flaw is a post-compromise escalation primitive rather than an initial access vector. There is no public exploit identified at time of analysis and CISA's SSVC evaluation records exploitation as 'none' with automatable 'no', though technical impact is rated total; EPSS and KEV data were not provided, and a vendor patch is available per Microsoft's advisory.
Local privilege escalation in the Windows NTFS file-system driver (CVE-2026-83567) allows an authenticated attacker who can already execute code on a Windows host to trigger an out-of-bounds read, which Microsoft scores as a full compromise of confidentiality and integrity (CVSS 7.8, C:H/I:H/A:H). Affected builds span essentially the entire supported Windows estate - Windows 10 1607 through 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - all in default configuration. This is a genuine but not emergency-priority vulnerability: no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has published vendor patches, so the practical risk is bounded by the requirement for pre-existing local authenticated access and the absence of a remote vector.
Local privilege escalation in the Windows Win32K ICOMP subsystem allows an authenticated attacker holding only low-privilege local code execution to elevate to kernel/SYSTEM context by triggering a use-after-free (CWE-416) in a Win32K object-lifetime code path. The flaw is confined to local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and requires winning a timing-dependent race, so it cannot be used for initial access or remote compromise and is only meaningful as a post-exploitation escalation step. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; Microsoft has released a vendor patch.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.
Heap-based buffer overflow (CWE-122) in the Windows Image Acquisition (WIA) component affects Windows 11 24H2, 25H2, 26H1 and 26H2 (x64 and arm64) plus Windows Server 2025, including Server Core installations, on builds earlier than the fixed versions. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which describes a network-reachable, unauthenticated attacker with no user interaction required and high confidentiality, integrity and availability impact; however, the supplied sources do not state how the heap overflow is triggered or whether a specific WIA service exposure must be reachable, so the precise network precondition is not confirmed. Exploitation status is none per SSVC and there is no KEV entry, EPSS is 0.84% (57th percentile), and no public exploit code or PoC reference appears in the input; the vuln.today decision label is act_now despite the low exploitation likelihood, and the vendor has released patches.
Spoofing and authentication bypass in the Microsoft Windows IKE Extension allow an unauthenticated remote attacker to subvert a security decision made during Internet Key Exchange negotiation, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1). All supported Windows client and server branches that carry the IKE Extension are affected, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, with Server Core installations included. Exploitation is conditional rather than trivial: the CVSS vector is AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are required, but the target host must actually have IKE/IPsec configured and actively negotiating and the attacker must hold a network position capable of influencing the handshake (a man-in-the-middle vantage or race-window dependency). CISA's SSVC assessment rates Exploitation as none and Automatable as no while assigning total technical impact, and no public exploit code or in-the-wild activity has been identified - no public exploit identified at time of analysis. Vendor patches are published by Microsoft (EUVD-2026-99912 / CVE-2026-83522) and should be treated as a priority for any estate that runs IPsec.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
A heap-based buffer overflow in the Windows RPC Runtime lets an authenticated local attacker with standard user rights elevate to higher privileges on affected Windows 11 hosts. The flaw is only reachable by code already executing on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and the vulnerable component is core, always-present Windows infrastructure, so no special configuration or user interaction is needed once a foothold exists. Microsoft has released fixes in its update guide (MSRC advisory for CVE-2026-83518), and there is no public exploit identified at time of analysis (SSVC exploitation: none, CISA KEV not listed); this makes it a patch-priority item for fleets still running unpatched Windows 11 builds rather than an emergency.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Remote, unauthenticated denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows any network-reachable attacker to crash the process that handles logon, credential validation and authentication for the host. Affected builds span Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core installations); patched builds at or above the vendor-listed build numbers are not exploitable. The impact is availability-only - no code execution, no data disclosure and no integrity impact - so real-world exposure is mainly a concern where authentication ports are reachable and where a host reboot or loss of authentication services is operationally disruptive; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
Information disclosure in the Microsoft Windows RPC Runtime lets an unauthenticated remote attacker read data that should never leave the host, because the service can return the contents of an uninitialized resource to a caller. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the prerequisites: network reach to a Windows RPC endpoint, no credentials, no user interaction, and impact limited to confidentiality. Affected systems span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. No public exploit has been identified at time of analysis and CISA SSVC records exploitation as none; EPSS is 0.94% (60th percentile), so this is a real but non-emergency priority to be addressed in the current patch cycle rather than an emergency.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Setup Files Cleanup component allows an attacker who already holds low-privileged, authenticated access to a vulnerable Windows host to win a time-of-check time-of-use race and gain SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, with CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote vector and no user interaction required, but exploitation demands an existing foothold plus a reliably won race, which CISA's SSVC assessment marks as not automatable and with no observed exploitation; no public exploit code has been identified at time of analysis and Patch is available from the vendor.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in Microsoft Windows NTFS stems from an out-of-bounds read (CWE-125) that an authenticated attacker who already holds a low-privileged foothold on the host can trigger to reach high-integrity code execution and to read beyond the bounds of a kernel buffer (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw touches the default Windows filesystem, so unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025 and their Server Core installations are all in scope, but the local attack vector (no remote, unauthenticated reach) confines it to post-compromise escalation rather than an initial access path. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and Microsoft has released vendor patches.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation exists in Microsoft's Windows Setup Files Cleanup component, where a time-of-check time-of-use race condition lets an authenticated, low-privileged user on the host escalate to higher (typically SYSTEM-level) privileges. The issue affects a broad range of Windows client and server releases, from Windows 10 version 1607 and Server 2016 through Windows 11 version 26H2/26H1 and Windows Server 2025. Exploitation requires prior local access and a low-privileged account (CVSS PR:L) and depends on winning a timing-dependent race, which makes it high-complexity (AC:H) and non-deterministic rather than a reliable, automatable attack - there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, though the technical impact is rated total. Vendor patches are available.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated low-privileged local user to gain SYSTEM-level rights on unpatched hosts, with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity and availability within the affected machine. Exploitation is not remotely reachable - it requires an existing foothold on the host as an unprivileged user - and there is no public exploit code and no confirmed active exploitation (no CISA KEV listing; SSVC exploitation: none, automatable: no). Microsoft has released vendor patches covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so risk is concentrated in fleets still running builds below the fixed levels listed in the EUVD record.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authorized attacker who already holds a foothold on a Windows host to run code at higher integrity by triggering a use-after-free memory corruption condition (CWE-416). Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local authenticated access and a hard-to-win timing or object-lifecycle state (AC:H) that the attacker does not fully control, but yields total loss of confidentiality, integrity and availability once achieved. Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds are affected; Microsoft has shipped fixed builds, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.
Local privilege escalation in the Windows Application Compatibility Cache (ShimCache) allows an attacker who already holds low-privileged local code execution to elevate to higher integrity on unpatched Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 systems. The defect is a use-after-free (CWE-416) that must be won in a narrow race window, and the assessed vector (AV:L/AC:H/PR:L/UI:N) reflects a post-compromise escalation path rather than a remote entry point, which is why SSVC records Exploitation: none, Automatable: no, and our assessment treats this as a genuine but moderate-priority local privilege escalation rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and no CISA KEV entry exists, though the CVSS base score of 7.0 is driven by total confidentiality, integrity, and availability impact once the elevation succeeds.
Use-after-free in the Windows Program Compatibility Assistant Service (PcaSvc) allows an attacker who already holds a low-privileged, authenticated local session to escalate privileges to a higher-integrity context on the same host, achieving total compromise of confidentiality, integrity, and availability (CVSS 7.0, C:H/I:H/A:H). The flaw is a memory-corruption race that the attacker must win to reliably corrupt freed memory, so the high attack-complexity rating limits repeatability, and exploitation requires prior local code execution - remote, unauthenticated attackers are not in scope (AV:L/AC:H/PR:L/UI:N). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2025 builds are affected; no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records exploitation as 'none' with the vulnerability not automatable. This is a genuine but moderate-priority elevation-of-privilege issue rather than a top-tier emergency, and vendor patches are available.
Local privilege elevation in the Windows Security Center component allows an attacker who already holds a low-privileged local account to gain higher privileges (high confidentiality, integrity and availability impact) by exploiting a race condition during concurrent execution of a shared resource. Only Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) installations are in scope, and because the attack requires an existing foothold plus a reliably won timing window (CVSS AV:L/AC:H/PR:L), it is not remotely reachable and is not automatable. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (11th percentile), which places this in a this-week remediation cadence rather than an emergency one.
Windows Credential Guard does not enforce authentication on a critical function, letting a local, already-authenticated low-privileged user on an affected Windows host perform spoofing (CVSS 7.8, CWE-306). Exploitation is strictly local and requires prior account access to the machine, so exposure is concentrated on multi-user, shared, or already-compromised endpoints running Credential Guard rather than internet-facing systems; the specific function or configuration state involved is not described in the available sources. Microsoft has released fixed builds for Windows 10, Windows 11 and Windows Server, and no public exploit or CISA KEV entry is associated with the CVE at time of analysis; EPSS is 0.30% (22nd percentile), consistent with a moderate, this-week priority rather than emergency response.
Local privilege escalation in Microsoft Windows Schannel allows an authenticated attacker who already holds low-privileged code execution on a host to leverage a null pointer dereference in the TLS/SSL security provider into full compromise of the machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds span Windows Server 2012 and 2012 R2 through Windows Server 2025, plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) below the fixed build numbers published by the vendor; because Schannel is present by default in all supported releases, there is no feature toggle that removes the exposure. No public exploit identified at time of analysis, and the local-only vector combined with the prerequisite of an existing foothold makes this a genuine patch-priority item rather than an emergency - though multi-user, terminal-services, and server hosts where untrusted parties can run code warrant scheduling priority.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Code execution risk in the Windows CD-ROM Driver arises when the driver processes attacker-controlled disc-image or CD-ROM data, leading to an untrusted pointer dereference (CWE-822) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixed builds for every listed branch, and the available data shows no public exploit or observed in-the-wild exploitation, with EPSS at 0.84% (57th percentile); the vendor vector is 9.8, but the independent assessment rates AC:H because the network delivery path to the driver is not described and SSVC marks exploitation as none and automatable as no. The priority label is act_now, and the technical impact is total.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an authenticated attacker who can already execute code as a low-privileged user on the host to corrupt kernel memory and escalate to SYSTEM privileges. The flaw is a use-after-free reachable through the driver with no user interaction required (CVSS 7.8, AV:L/PR:L/UI:N, S:U, C:H/I:H/A:H), and it affects unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds as well as Windows Server 2025 (including Server Core) builds below the fixed build numbers. Microsoft has published a vendor patch; there is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit identified at time of analysis, so this is a post-compromise escalation step rather than a remote entry point.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated attacker who already holds low-privileged code execution on an affected host to gain full control of the system (CVSS 7.0, C:H/I:H/A:H) by triggering a use-after-free in kernel memory. Exploitation is constrained by high attack complexity (AC:H), since the attacker must reliably win a timing/race window and groom kernel heap state; there is no remote or unauthenticated vector. Affected are unpatched Windows 11 24H2, 25H2, 26H1, and 26H2 builds and Windows Server 2025 builds below the fixed versions, and no public exploit or confirmed active exploitation was identified at time of analysis; Microsoft has released a patch.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.
Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.
Heap-based buffer overflow in the Windows WebDAV component allows remote attackers to elevate privileges and potentially achieve full compromise of confidentiality, integrity and availability (CVSS 9.8). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based with no authentication and no user interaction required, and the affected scope covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, below the per-branch fixed builds published by Microsoft. The signals are strongly mixed: there is no CISA KEV entry and SSVC records Exploitation: none with Automatable: no, so no public exploit has been identified at time of analysis, and EPSS is modest at 0.84% (57th percentile); nevertheless technical impact is rated total and the vuln.today decision label is act_now with a vendor-released patch available. Whether exploitation requires an enabled, reachable WebDAV listener rather than a client-side connect-back is not described in the available sources.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.
Local code execution in Microsoft Windows HTTP.sys affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, including Server Core installations. An attacker who already holds a valid low-privilege authenticated session on the host (CVSS vector AV:L/PR:L/UI:N) can trigger an out-of-bounds read in the HTTP kernel driver with no user interaction, delivering high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixes; multi-user hosts such as RDP/terminal servers, where untrusted users hold local accounts, carry the highest realistic exposure.
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.
Remote code execution against domain controllers running Active Directory Domain Services is achievable by an unauthenticated network attacker (CVSS 3.1: AV:N/PR:N/UI:N) who successfully bypasses an incorrect authorization check, yielding full confidentiality, integrity, and availability impact for a base score of 8.1. The practical constraint is the High attack-complexity rating: exploiting the flawed authorization decision requires an attacker-influenced condition such as a timing window, race, or particular directory state rather than a single deterministic request against a default configuration, and only hosts serving the AD DS role - not member servers or ordinary clients - are the realistic target. At time of analysis no public exploit identified and no confirmed active exploitation (no CISA KEV listing); vendor patch available, with EUVD-listed fixed build levels published.
Local privilege escalation in the Windows Desktop Window Manager (dwm.exe) allows an attacker who already holds an authenticated low-privilege account on the target host to exploit an out-of-bounds read and gain elevated (SYSTEM-level) code execution. All supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions are affected up to their respective fixed builds, and the prerequisite is purely local code execution with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). No public exploit code or confirmed active exploitation has been identified at the time of analysis and CISA SSVC rates exploitation as none and not automatable, so this is a routine patch-priority item rather than an emergency - but the vendor update should be applied promptly on multi-user, RDP-accessible, and privileged-administration endpoints where a local foothold is easiest to obtain.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Local privilege escalation in the Windows StateRepository API allows an authenticated, low-privileged attacker who already has code execution on a Windows 11 host to gain SYSTEM-level rights, because the API's access controls lack sufficient granularity to separate callers by privilege. Affected builds are Windows 11 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H1 below 10.0.28000.3231, and 26H2 below 10.0.26300.9711. The flaw is not remotely reachable (AV:L, PR:L, UI:N) and CISA's SSVC framework rates it non-automatable with exploitation observed as none, so it functions as a post-compromise escalation step rather than an initial-access vector; no public exploit identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Security Center lets an attacker who already holds a foothold on a Windows host with low-level privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) abuse an improperly restricted communication channel to obtain high confidentiality and integrity impact on the same machine. Only hosts that have not yet applied the current cumulative builds are affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019 including Server Core installations. The high attack complexity indicates a non-trivial precondition - most consistent with a race or transient-state condition that must be won to redirect or spoof the endpoint - so reliability is limited; prior local access and valid credentials are mandatory and no public exploit identified at time of analysis, with no CISA KEV listing.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.
Windows PowerShell on supported Windows client and server editions fails to enforce a protection mechanism, letting a locally authenticated low-privileged attacker bypass a security feature and operate outside the intended security boundary, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, scope-changed). Exploitation requires a pre-existing local foothold and the ability to run PowerShell on the host - there is no remote or unauthenticated path, and CISA's SSVC assessment rates exploitation as 'none' with Automatable=no, meaning the issue is not wormable or easily mass-scanned. There is no public exploit identified at time of analysis, though the technical impact is rated total once the prerequisite access is obtained; Microsoft has released fixes and the MSRC update guide is the authoritative remediation source.
Local privilege escalation in Microsoft's Windows Backup Engine (CWE-41, path equivalence mis-resolution) allows an authenticated, low-privileged attacker with local access to a Windows host to gain elevated privileges by manipulating a path that the Backup Engine resolves to an equivalent but attacker-controlled location; exploitation requires no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). The attack surface is confined to hosts where an attacker already holds an unprivileged foothold, making multi-user systems, shared workstations, and terminal/RDP-style environments the realistic risk scenario rather than remote perimeter exposure. Microsoft has published fixed builds through the MSRC update guide, and no public exploit identified at time of analysis - no confirmed actively exploited (CISA KEV) status and no publicly available exploit code exists, so this is a credible but not emergency-tier patch-cycle priority.
Local privilege escalation in the Windows Search component affects every pre-patch build of supported Windows client and server editions, letting an attacker who already holds low-privileged local access execute code at a higher integrity level by exploiting a numeric truncation error in the search/indexing code path. Rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires local authenticated access (PR:L, AV:L) but no victim interaction (UI:N) and has low attack complexity, making it a post-compromise escalation primitive rather than a remote or initial-access vector. CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft.
Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.
Local privilege escalation in Microsoft Windows NTFS lets an authenticated attacker who already has low-privileged code execution on the host escalate to kernel/SYSTEM level by driving the filesystem driver into an untrusted pointer dereference (CWE-822). The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects every listed Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025 build below its patched revision, since NTFS is the default Windows filesystem and no non-default configuration is required. There is no public exploit identified at time of analysis and CISA SSVC rates Exploitation=none and Automatable=no; Microsoft has shipped vendor patches, making this a credible but not emergency-level priority.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10, Windows 11 and Windows Server 2012 through 2025 hosts on which the RRAS role is installed, with the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating a network-reachable attacker who already holds a low-privilege authenticated position, requires no user interaction, and can achieve full confidentiality, integrity and availability impact. The defect is a double free (CWE-415) memory-corruption condition in the service, which Microsoft has addressed in its monthly update with fixed builds published for each supported branch. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and real-world exposure is materially narrowed because RRAS is not enabled by default on standard Windows installations.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
Local privilege escalation in Windows Direct Composition (the dcomp/DWM compositing subsystem) lets an attacker who already holds low-privileged code execution on a target box corrupt freed memory and elevate to a higher-integrity context, including SYSTEM. Every supported Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2022/2025 build ships the affected component by default, but the CVSS vector (AV:L/PR:L/UI:N) confirms exploitation requires an existing local foothold and no user interaction, making this a post-compromise escalation primitive rather than an initial access vector. With a base score of 7.8 and high confidentiality, integrity and availability impact, it is a credible but not emergency-tier priority: vendor patches are available, and no public exploit identified at time of analysis.
A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.