Windows 11 26h1
Monthly
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.
Remote code execution in Windows iSCSI allows unauthenticated attackers to execute code over a network by exploiting a use-after-free (CWE-416) in the processing of crafted iSCSI protocol traffic. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, but the primary limiting factor is that the Microsoft iSCSI Initiator service and iSCSI Target Server role are not enabled by default, so exposure is largely confined to hosts configured for iSCSI storage such as SAN-backed servers. No public exploit identified at time of analysis, and reliable exploitation would require defeating Windows memory mitigations, raising practical difficulty beyond the AC:L rating.
Local privilege escalation in the Windows Update component affects Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) running builds prior to the vendor-patched levels. An attacker who already holds authenticated, low-privileged local code execution and can write a file into a directory that Windows Update searches ahead of its trusted location can plant a malicious binary that the service loads, yielding code execution at higher privilege with full impact to confidentiality, integrity and availability (CVSS 3.1: 7.8). The prerequisite local foothold and directory write access limit exposure, and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and the issue as non-automatable. Microsoft has released fixes in its update guide, so fully patched systems are not exploitable.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Local privilege escalation in the Windows Certificates component allows an authenticated attacker who already holds a low-privileged session on a Windows host to trigger an untrusted pointer dereference (CWE-822) and gain full control of that system, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation is strictly local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), and does not change security scope (S:U), so it is a post-compromise escalation step rather than a remote entry point; default Windows installations carrying the affected component are exposed because no non-default configuration is indicated. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so it is not confirmed actively exploited; Microsoft's update guide is the authoritative remediation reference.
Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.
Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.
Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.
Elevation of privilege in the Windows Update servicing component allows an authenticated local attacker with low-level privileges to gain full SYSTEM-level control of the host by influencing a file name or path consumed by a privileged Update operation (CWE-73). The flaw is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is not remotely reachable and requires a pre-existing local foothold, but once that foothold exists the escalation is low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact. CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch is available. Affected systems include Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2, plus Windows Server 2025 (including Server Core installations) running builds below the fixed thresholds.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a use-after-free that yields high impact to confidentiality, integrity, and availability on affected Windows 11 and Windows Server 2025 hosts. Exploitation is local only and gated by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning the attacker must already hold a low-privileged foothold on the machine and win a heap-grooming or race condition to trigger the bug reliably, so it functions as a post-compromise escalation step rather than a remote attack path. No public exploit has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but patch availability from Microsoft makes unpatched systems the primary exposure.
Local privilege escalation in the Windows Update component allows an authenticated, low-privileged user who already holds a foothold on the host to gain SYSTEM-level code execution by planting a malicious DLL or executable in a directory consulted through an untrusted search path (CWE-426). Only specific pre-patch builds are affected: Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core installations). Per the available intelligence this is not known to be actively exploited (no CISA KEV listing, SSVC exploitation value 'none') and no public exploit code has been identified at time of analysis; the EPSS signal is not provided, and the prerequisite local account and writable search-path location confine this to post-compromise escalation rather than initial access, making it a genuine but second-tier priority.
Local privilege escalation in Windows Update enables an attacker who already holds a low-privileged local session to elevate to higher privileges by injecting special command elements into data processed by the Windows Update servicing component (CWE-77 command injection). This affects multiple Windows 11 releases (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core, up to the fixed builds enumerated in Microsoft’s advisory, with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing local foothold and valid low-privileged credentials, and no public exploit has been identified at time of analysis; vendor patches are available.
Local privilege escalation in the Windows Update component allows an authenticated local user to elevate privileges on an affected, unpatched host by abusing improper link resolution before a privileged file access (CWE-59). All currently supported Windows 11 client branches are impacted - 23H2, 24H2, 25H2, 26H1 and 26H2 - along with Windows Server 2025, including the Server Core installation option. Exploitation requires the attacker to already hold a local account and the ability to place a symlink, hard link or junction in a path the Update service processes, with no user interaction and low attack complexity; no public exploit has been identified at time of analysis, and Microsoft has released fixes via its monthly update channel (MSRC advisory for CVE-2026-69673).
Local privilege elevation on supported Windows builds stems from the Windows Key Distribution Center (KDC) accepting cryptographic signatures it should have rejected, letting an attacker who already holds low-privileged credentials and local access to an affected host reach high integrity and confidentiality impact (CVSS 7.8, AV:L/PR:L/UI:N). The KDC role normally runs only on Windows Server Domain Controllers, although the vulnerable code ships across every client and server build enumerated in the EUVD data - Windows 10 1607/1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025. Microsoft has published a fix through the MSRC update guide; no public exploit code and no CISA KEV entry were identified at time of analysis, and the independent assessment rates this as a genuine but second-tier priority because exploitation requires a pre-existing foothold and validated credentials rather than a remote or unauthenticated path.
Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.
Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.
Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).
Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.
Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.
Use-after-free in the Windows Enterprise App Management component lets an attacker with valid low-level credentials on a target machine, who can reach that machine over the network, corrupt freed memory and elevate to a higher-integrity context. Exploitation is gated by three limiters recorded in the assessed vector: the attacker must already hold a valid account on the target (PR:L), a victim user must perform an interaction (UI:R), and the memory-reuse race that gives an attacker control of the freed object is non-deterministic (AC:H) - so although the attack vector is network-reachable, real-world reliability and prerequisites keep this a moderate-priority issue rather than an emergency. Microsoft has released fixes in the current Windows cumulative updates, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.
Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.
Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.
Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.
Local security feature bypass in Windows UEFI (CVE-2026-49785) allows an authenticated attacker who already holds a low-privileged account on the host to defeat a boot/UEFI-related security feature, with the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) reflecting high confidentiality, integrity and availability impact once that local foothold exists. Exploitation is not remote and requires no user interaction, but it does require pre-existing local access and an account on the system; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as "none" with automation as "no", so this is a moderate-priority local hardening issue rather than an emergency. A vendor patch is available from Microsoft via the MSRC Security Update Guide, and the affected build ranges span most supported Windows client and server releases, including Server 2012 through Server 2025.
Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.
Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.
Improper path-equivalence handling in Microsoft Windows SmartScreen allows an unauthenticated, remote attacker to bypass the reputation/Mark-of-the-Web check so that a crafted file runs without the expected SmartScreen warning, provided the victim opens it (user interaction required, CVSS 8.8). Only unpatched Windows 11 builds are affected - 24H2 before 10.0.26100.9711, 25H2 before 10.0.26200.9711, 26H1 before 10.0.28000.3231, and 26H2 before 10.0.26300.9711; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and not automatable, so urgency signals conflict between the high CVSS score and total technical impact and the absence of observed or automated exploitation. A vendor patch is available and should be applied through the normal Windows update channel.
Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.
Use-after-free in Windows Message Queuing (MSMQ) allows unauthenticated remote attackers to execute arbitrary code on systems where the optional MSMQ feature is installed and its listener is network-reachable, typically on TCP port 1801. Exploitation requires winning a memory race due to the high attack complexity (CVSS AC:H), and the feature is not enabled by default, which significantly limits real-world exposure; no public exploit identified at time of analysis.
Remote code execution in Microsoft Remote Desktop Client can be triggered when a victim connects to a malicious or compromised RDP server, exploiting a use-after-free (CWE-416) condition during processing of server responses. The vulnerability requires user interaction (UI:R) - the victim must initiate the RDP connection, for example via a malicious .rdp file or social engineering - but no authentication to the victim's system is needed (PR:N), and it is remotely exploitable with low complexity (AV:N/AC:L). CVSS 3.1 score is 8.8, reflecting high confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privileged attacker to gain elevated privileges by winning a time-of-check time-of-use race condition in the MDM component. The flaw is rated CVSS 7.0 (High) and requires local access and a narrow timing window (AC:H), with no public exploit identified at time of analysis. Affected are Windows hosts with the MDM component enabled, and successful exploitation could lead to complete compromise of confidentiality, integrity, and availability.
Local privilege escalation in the Microsoft Windows Search Component lets an authenticated, low-privileged attacker on a Windows host trigger a use-after-free (CWE-416) and gain elevated privileges, potentially SYSTEM, with high impact to confidentiality, integrity, and availability. Exploitation requires local access and a valid low-privilege account (CVSS PR:L/AV:L) and no user interaction; it cannot be triggered remotely and is therefore a post-compromise escalation step, especially risky on shared, multi-user, RDP, or terminal-server hosts. No public exploit was identified at time of analysis, and this is assessed as a credible but not emergency-tier patch priority.
Local privilege escalation in the Windows Backup Engine allows an authenticated local attacker with low privileges to abuse link resolution during backup or restore operations and gain elevated privileges on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) systems below the vendor-patched build numbers. Exploitation requires a race or specific filesystem preconditions (CVSS AC:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patches via the MSRC update guide.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an attacker who already holds authenticated, low-privilege code execution on a host to corrupt heap memory inside a highly privileged VBS component and elevate to full machine control (CVSS 7.8, C:H/I:H/A:H). Only unpatched Windows 11 24H2/25H2/26H1/26H2 builds and Windows Server 2025 (including Server Core) below the vendor's fixed build numbers are affected, and exploitation requires local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). No public exploit code has been identified at time of analysis and CISA SSVC records no known exploitation, making this a credible but not emergency-tier priority; Microsoft has released patched builds, so remediation is straightforward for managed fleets.
Code execution that crosses the guest-to-host boundary in Microsoft Windows Hyper-V can be triggered by an authenticated, low-privileged attacker who already runs code inside a guest virtual machine, letting them escape the VM and affect the host partition. The weakness is an access-control flaw in the hypervisor (CVSS 3.1 base 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so it is a local privilege and tenancy escape rather than a remotely reachable path, and a guest foothold is a hard prerequisite. No public exploit has been identified at time of analysis, but the risk is concentrated on hosts running untrusted, multi-tenant, or otherwise attacker-reachable guests.
An untrusted pointer dereference (CWE-822) in the Windows Distributed File System (DFS) component allows unauthenticated remote attackers to elevate privileges on affected, unpatched Windows and Windows Server builds, per the CVSS vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact (9.8). Every Windows 10 branch (1607 through 22H2), Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 - including Server Core installations - are listed as affected below their respective fixed builds. No public exploit code or active exploitation is confirmed at time of analysis (SSVC Exploitation: none), though EPSS is 1.15% (66th percentile), SSVC Automation: yes and Technical Impact: total, and the priority label is act_now; the practical limiting factor is network reachability of the DFS service.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Search component of Microsoft Windows allows unauthenticated remote attackers to elevate privileges, per a CVSS 3.1 score of 9.8. No public exploit code has been identified at time of analysis. However, the description's framing as privilege elevation-which typically requires a local foothold-conflicts with the network-unauthenticated vector; confirm exact preconditions via the MSRC advisory.
Spoofing in Windows Schannel allows an unauthenticated attacker positioned on the network path between a client and server to interfere with TLS session establishment, potentially bypassing authentication and compromising confidentiality and integrity. Microsoft rates this CVSS 9.0, while our independent assessment assigns a modified vector with no availability impact (A:N) and notes that exploitation requires high attack complexity (AC:H) due to the need for a man-in-the-middle position and specific handshake/timing conditions. No public exploit identified at time of analysis.
Elevation of privilege in Windows NDIS (ndis.sys) allows a local authenticated user to run processes in an elevated context by exploiting an out-of-bounds read caused by a missing buffer-length check. The vulnerability affects all Windows systems with the default NDIS driver, requiring the attacker to already have local access and the ability to execute a malicious application. No public exploit code has been identified at time of analysis, and Microsoft has released a security update to address the flaw.
Remote code execution in Windows Schannel can be triggered by unauthenticated attackers who can reach a TLS/SSL service that relies on Schannel-such as RDP with TLS, IIS HTTPS, LDAPS, or EAP/TLS endpoints-by sending crafted handshake data that causes an out-of-bounds write (CWE-787). The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, meaning no authentication or user interaction is required, but successful exploitation is constrained by high attack complexity and dependence on specific memory state, likely requiring heap grooming or repeated attempts. No public exploit identified at time of analysis, and no CISA KEV active exploitation is indicated in the provided data.
Local privilege escalation in the Windows Overlay Filter (wof.sys) driver on affected Windows systems allows an authenticated attacker with low-privileged code execution to trigger an out-of-bounds read (CWE-125) and elevate privileges to a higher integrity level. The flaw is rated CVSS 7.8 (High) and requires no user interaction (UI:N), but the attacker must already have a local foothold (PR:L, AV:L). No public exploit code or active exploitation has been identified at time of analysis; a vendor advisory is available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.
Microsoft QUIC (MsQuic) can be made to bypass a security feature over the network because a security-relevant variable is initialized to an insecure default (CWE-453), producing a CVSS 7.5 condition with no confidentiality impact, limited integrity impact and full availability impact (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H). The issue is unauthenticated and requires no user interaction, but is only reachable on hosts that actually run a network-exposed QUIC listener - HTTP/3 or SMB over QUIC - and the high attack complexity reflects a timing/transient-state prerequisite the attacker cannot directly control. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the MSRC update guide is the authoritative source for affected builds and fixes.
Remote code execution in Remote Desktop Client can be triggered when a user connects to an attacker-controlled or compromised RDP server, due to a use-after-free in the client. The attacker does not need credentials (PR:N), but the victim must initiate the outbound RDP session (UI:R), so environments that restrict outbound RDP to trusted hosts are less exposed; successful exploitation runs code in the context of the connecting user. No public exploit identified at time of analysis; this is a serious client-side vulnerability but not an emergency because the attacker cannot reach the client unsolicited.
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).
Local privilege escalation in the Windows Partition Management Driver lets an already-authorized, low-privileged user who can execute code on the host elevate privileges by triggering an out-of-bounds read against malformed partition-related structures handled by the kernel driver. Microsoft rates it CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a CWE-125 root cause, and because the driver is a standard in-box Windows component, default installations are affected with no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limiter is the prerequisite local foothold, making this a credible, patch-worthy privilege-escalation building block rather than an emergency or an initial-access vector.
Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.
Out-of-bounds read in Windows Text Shaping allows a remote, unauthenticated attacker to execute code on affected Windows systems when a victim opens or renders attacker-controlled content (UI:R), such as a document, web page, email, or font. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but with a CVSS score of 8.8 and high impact to confidentiality, integrity, and availability, it represents a credible high-priority risk that is not a top-of-queue emergency on current signals.
Local privilege escalation in the Windows VHD miniport driver allows an authenticated attacker with low privileges to execute arbitrary code in kernel mode, resulting in full system compromise. This use-after-free (CWE-416) vulnerability requires the attacker to already possess low-privileged local access and the ability to interact with the virtual disk subsystem. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data is not available; the CVSS score is 7.8.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.
Authenticated privilege escalation in Microsoft WebDAV lets a low-privileged network user bypass authorization by supplying an alternate but equivalent path representation, causing access-control checks to be evaluated against the wrong canonical path; successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing authorized account on the target plus network reach to the WebDAV service - it is not exploitable by a fully unauthenticated attacker - but needs no user interaction and has low attack complexity. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; patch availability was not specified in the provided intelligence and should be confirmed against the Microsoft MSRC advisory.
Local privilege escalation in the Windows StateRepository API allows an attacker who already has code execution as a low-privileged, authenticated user to trigger a type-confusion condition and gain higher-integrity code execution on the same machine. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw is not reachable remotely and requires no user interaction, but it cannot serve as an initial-access vector - it is a post-compromise escalation primitive that assumes a local foothold and valid credentials. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); combined with the local-only attack path, this is a credible but not emergency-tier internet-facing threat.
Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.
Use-after-free memory corruption in Windows Hyper-V allows an authenticated low-privileged attacker who already has code execution inside a guest VM to trigger memory corruption in the hypervisor and, per the assessed scope change, likely cross the guest-to-host boundary with high confidentiality, integrity, and availability impact. The CVSS:3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, so the flaw is local, low-complexity, requires low privileges, needs no user interaction, and has Changed scope; it is not a remote unauthenticated network-reachable bug. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV active-exploitation entry was provided.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.
Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated local attacker on a Windows host abuse improper access control in the driver's file-link handling to run code with elevated rights. Exploitation requires the attacker to already hold a valid low-privileged account (CVSS vector PR:L, AV:L) and to reach the container-isolation driver path; no user interaction is needed and attack complexity is low (AC:L), with high confidentiality, integrity and availability impact scored (7.8). Microsoft has published an advisory entry via the MSRC update guide, there is no indication of CISA KEV listing, and no public exploit code was identified at time of analysis - this is a patch-priority issue for Windows container hosts rather than a wormable emergency.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.
Remote code execution in Windows iSCSI allows unauthenticated attackers to execute code over a network by exploiting a use-after-free (CWE-416) in the processing of crafted iSCSI protocol traffic. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, but the primary limiting factor is that the Microsoft iSCSI Initiator service and iSCSI Target Server role are not enabled by default, so exposure is largely confined to hosts configured for iSCSI storage such as SAN-backed servers. No public exploit identified at time of analysis, and reliable exploitation would require defeating Windows memory mitigations, raising practical difficulty beyond the AC:L rating.
Local privilege escalation in the Windows Update component affects Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) running builds prior to the vendor-patched levels. An attacker who already holds authenticated, low-privileged local code execution and can write a file into a directory that Windows Update searches ahead of its trusted location can plant a malicious binary that the service loads, yielding code execution at higher privilege with full impact to confidentiality, integrity and availability (CVSS 3.1: 7.8). The prerequisite local foothold and directory write access limit exposure, and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and the issue as non-automatable. Microsoft has released fixes in its update guide, so fully patched systems are not exploitable.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Local privilege escalation in the Windows Certificates component allows an authenticated attacker who already holds a low-privileged session on a Windows host to trigger an untrusted pointer dereference (CWE-822) and gain full control of that system, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation is strictly local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), and does not change security scope (S:U), so it is a post-compromise escalation step rather than a remote entry point; default Windows installations carrying the affected component are exposed because no non-default configuration is indicated. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so it is not confirmed actively exploited; Microsoft's update guide is the authoritative remediation reference.
Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.
Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.
Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.
Elevation of privilege in the Windows Update servicing component allows an authenticated local attacker with low-level privileges to gain full SYSTEM-level control of the host by influencing a file name or path consumed by a privileged Update operation (CWE-73). The flaw is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is not remotely reachable and requires a pre-existing local foothold, but once that foothold exists the escalation is low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact. CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch is available. Affected systems include Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2, plus Windows Server 2025 (including Server Core installations) running builds below the fixed thresholds.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a use-after-free that yields high impact to confidentiality, integrity, and availability on affected Windows 11 and Windows Server 2025 hosts. Exploitation is local only and gated by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning the attacker must already hold a low-privileged foothold on the machine and win a heap-grooming or race condition to trigger the bug reliably, so it functions as a post-compromise escalation step rather than a remote attack path. No public exploit has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but patch availability from Microsoft makes unpatched systems the primary exposure.
Local privilege escalation in the Windows Update component allows an authenticated, low-privileged user who already holds a foothold on the host to gain SYSTEM-level code execution by planting a malicious DLL or executable in a directory consulted through an untrusted search path (CWE-426). Only specific pre-patch builds are affected: Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core installations). Per the available intelligence this is not known to be actively exploited (no CISA KEV listing, SSVC exploitation value 'none') and no public exploit code has been identified at time of analysis; the EPSS signal is not provided, and the prerequisite local account and writable search-path location confine this to post-compromise escalation rather than initial access, making it a genuine but second-tier priority.
Local privilege escalation in Windows Update enables an attacker who already holds a low-privileged local session to elevate to higher privileges by injecting special command elements into data processed by the Windows Update servicing component (CWE-77 command injection). This affects multiple Windows 11 releases (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core, up to the fixed builds enumerated in Microsoft’s advisory, with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing local foothold and valid low-privileged credentials, and no public exploit has been identified at time of analysis; vendor patches are available.
Local privilege escalation in the Windows Update component allows an authenticated local user to elevate privileges on an affected, unpatched host by abusing improper link resolution before a privileged file access (CWE-59). All currently supported Windows 11 client branches are impacted - 23H2, 24H2, 25H2, 26H1 and 26H2 - along with Windows Server 2025, including the Server Core installation option. Exploitation requires the attacker to already hold a local account and the ability to place a symlink, hard link or junction in a path the Update service processes, with no user interaction and low attack complexity; no public exploit has been identified at time of analysis, and Microsoft has released fixes via its monthly update channel (MSRC advisory for CVE-2026-69673).
Local privilege elevation on supported Windows builds stems from the Windows Key Distribution Center (KDC) accepting cryptographic signatures it should have rejected, letting an attacker who already holds low-privileged credentials and local access to an affected host reach high integrity and confidentiality impact (CVSS 7.8, AV:L/PR:L/UI:N). The KDC role normally runs only on Windows Server Domain Controllers, although the vulnerable code ships across every client and server build enumerated in the EUVD data - Windows 10 1607/1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025. Microsoft has published a fix through the MSRC update guide; no public exploit code and no CISA KEV entry were identified at time of analysis, and the independent assessment rates this as a genuine but second-tier priority because exploitation requires a pre-existing foothold and validated credentials rather than a remote or unauthenticated path.
Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.
Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.
Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).
Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.
Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.
Use-after-free in the Windows Enterprise App Management component lets an attacker with valid low-level credentials on a target machine, who can reach that machine over the network, corrupt freed memory and elevate to a higher-integrity context. Exploitation is gated by three limiters recorded in the assessed vector: the attacker must already hold a valid account on the target (PR:L), a victim user must perform an interaction (UI:R), and the memory-reuse race that gives an attacker control of the freed object is non-deterministic (AC:H) - so although the attack vector is network-reachable, real-world reliability and prerequisites keep this a moderate-priority issue rather than an emergency. Microsoft has released fixes in the current Windows cumulative updates, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.
Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.
Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.
Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.
Local security feature bypass in Windows UEFI (CVE-2026-49785) allows an authenticated attacker who already holds a low-privileged account on the host to defeat a boot/UEFI-related security feature, with the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) reflecting high confidentiality, integrity and availability impact once that local foothold exists. Exploitation is not remote and requires no user interaction, but it does require pre-existing local access and an account on the system; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as "none" with automation as "no", so this is a moderate-priority local hardening issue rather than an emergency. A vendor patch is available from Microsoft via the MSRC Security Update Guide, and the affected build ranges span most supported Windows client and server releases, including Server 2012 through Server 2025.
Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.
Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.
Improper path-equivalence handling in Microsoft Windows SmartScreen allows an unauthenticated, remote attacker to bypass the reputation/Mark-of-the-Web check so that a crafted file runs without the expected SmartScreen warning, provided the victim opens it (user interaction required, CVSS 8.8). Only unpatched Windows 11 builds are affected - 24H2 before 10.0.26100.9711, 25H2 before 10.0.26200.9711, 26H1 before 10.0.28000.3231, and 26H2 before 10.0.26300.9711; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and not automatable, so urgency signals conflict between the high CVSS score and total technical impact and the absence of observed or automated exploitation. A vendor patch is available and should be applied through the normal Windows update channel.
Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.
Use-after-free in Windows Message Queuing (MSMQ) allows unauthenticated remote attackers to execute arbitrary code on systems where the optional MSMQ feature is installed and its listener is network-reachable, typically on TCP port 1801. Exploitation requires winning a memory race due to the high attack complexity (CVSS AC:H), and the feature is not enabled by default, which significantly limits real-world exposure; no public exploit identified at time of analysis.
Remote code execution in Microsoft Remote Desktop Client can be triggered when a victim connects to a malicious or compromised RDP server, exploiting a use-after-free (CWE-416) condition during processing of server responses. The vulnerability requires user interaction (UI:R) - the victim must initiate the RDP connection, for example via a malicious .rdp file or social engineering - but no authentication to the victim's system is needed (PR:N), and it is remotely exploitable with low complexity (AV:N/AC:L). CVSS 3.1 score is 8.8, reflecting high confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privileged attacker to gain elevated privileges by winning a time-of-check time-of-use race condition in the MDM component. The flaw is rated CVSS 7.0 (High) and requires local access and a narrow timing window (AC:H), with no public exploit identified at time of analysis. Affected are Windows hosts with the MDM component enabled, and successful exploitation could lead to complete compromise of confidentiality, integrity, and availability.
Local privilege escalation in the Microsoft Windows Search Component lets an authenticated, low-privileged attacker on a Windows host trigger a use-after-free (CWE-416) and gain elevated privileges, potentially SYSTEM, with high impact to confidentiality, integrity, and availability. Exploitation requires local access and a valid low-privilege account (CVSS PR:L/AV:L) and no user interaction; it cannot be triggered remotely and is therefore a post-compromise escalation step, especially risky on shared, multi-user, RDP, or terminal-server hosts. No public exploit was identified at time of analysis, and this is assessed as a credible but not emergency-tier patch priority.
Local privilege escalation in the Windows Backup Engine allows an authenticated local attacker with low privileges to abuse link resolution during backup or restore operations and gain elevated privileges on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) systems below the vendor-patched build numbers. Exploitation requires a race or specific filesystem preconditions (CVSS AC:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patches via the MSRC update guide.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an attacker who already holds authenticated, low-privilege code execution on a host to corrupt heap memory inside a highly privileged VBS component and elevate to full machine control (CVSS 7.8, C:H/I:H/A:H). Only unpatched Windows 11 24H2/25H2/26H1/26H2 builds and Windows Server 2025 (including Server Core) below the vendor's fixed build numbers are affected, and exploitation requires local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). No public exploit code has been identified at time of analysis and CISA SSVC records no known exploitation, making this a credible but not emergency-tier priority; Microsoft has released patched builds, so remediation is straightforward for managed fleets.
Code execution that crosses the guest-to-host boundary in Microsoft Windows Hyper-V can be triggered by an authenticated, low-privileged attacker who already runs code inside a guest virtual machine, letting them escape the VM and affect the host partition. The weakness is an access-control flaw in the hypervisor (CVSS 3.1 base 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so it is a local privilege and tenancy escape rather than a remotely reachable path, and a guest foothold is a hard prerequisite. No public exploit has been identified at time of analysis, but the risk is concentrated on hosts running untrusted, multi-tenant, or otherwise attacker-reachable guests.
An untrusted pointer dereference (CWE-822) in the Windows Distributed File System (DFS) component allows unauthenticated remote attackers to elevate privileges on affected, unpatched Windows and Windows Server builds, per the CVSS vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact (9.8). Every Windows 10 branch (1607 through 22H2), Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 - including Server Core installations - are listed as affected below their respective fixed builds. No public exploit code or active exploitation is confirmed at time of analysis (SSVC Exploitation: none), though EPSS is 1.15% (66th percentile), SSVC Automation: yes and Technical Impact: total, and the priority label is act_now; the practical limiting factor is network reachability of the DFS service.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Search component of Microsoft Windows allows unauthenticated remote attackers to elevate privileges, per a CVSS 3.1 score of 9.8. No public exploit code has been identified at time of analysis. However, the description's framing as privilege elevation-which typically requires a local foothold-conflicts with the network-unauthenticated vector; confirm exact preconditions via the MSRC advisory.
Spoofing in Windows Schannel allows an unauthenticated attacker positioned on the network path between a client and server to interfere with TLS session establishment, potentially bypassing authentication and compromising confidentiality and integrity. Microsoft rates this CVSS 9.0, while our independent assessment assigns a modified vector with no availability impact (A:N) and notes that exploitation requires high attack complexity (AC:H) due to the need for a man-in-the-middle position and specific handshake/timing conditions. No public exploit identified at time of analysis.
Elevation of privilege in Windows NDIS (ndis.sys) allows a local authenticated user to run processes in an elevated context by exploiting an out-of-bounds read caused by a missing buffer-length check. The vulnerability affects all Windows systems with the default NDIS driver, requiring the attacker to already have local access and the ability to execute a malicious application. No public exploit code has been identified at time of analysis, and Microsoft has released a security update to address the flaw.
Remote code execution in Windows Schannel can be triggered by unauthenticated attackers who can reach a TLS/SSL service that relies on Schannel-such as RDP with TLS, IIS HTTPS, LDAPS, or EAP/TLS endpoints-by sending crafted handshake data that causes an out-of-bounds write (CWE-787). The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, meaning no authentication or user interaction is required, but successful exploitation is constrained by high attack complexity and dependence on specific memory state, likely requiring heap grooming or repeated attempts. No public exploit identified at time of analysis, and no CISA KEV active exploitation is indicated in the provided data.
Local privilege escalation in the Windows Overlay Filter (wof.sys) driver on affected Windows systems allows an authenticated attacker with low-privileged code execution to trigger an out-of-bounds read (CWE-125) and elevate privileges to a higher integrity level. The flaw is rated CVSS 7.8 (High) and requires no user interaction (UI:N), but the attacker must already have a local foothold (PR:L, AV:L). No public exploit code or active exploitation has been identified at time of analysis; a vendor advisory is available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.
Microsoft QUIC (MsQuic) can be made to bypass a security feature over the network because a security-relevant variable is initialized to an insecure default (CWE-453), producing a CVSS 7.5 condition with no confidentiality impact, limited integrity impact and full availability impact (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H). The issue is unauthenticated and requires no user interaction, but is only reachable on hosts that actually run a network-exposed QUIC listener - HTTP/3 or SMB over QUIC - and the high attack complexity reflects a timing/transient-state prerequisite the attacker cannot directly control. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the MSRC update guide is the authoritative source for affected builds and fixes.
Remote code execution in Remote Desktop Client can be triggered when a user connects to an attacker-controlled or compromised RDP server, due to a use-after-free in the client. The attacker does not need credentials (PR:N), but the victim must initiate the outbound RDP session (UI:R), so environments that restrict outbound RDP to trusted hosts are less exposed; successful exploitation runs code in the context of the connecting user. No public exploit identified at time of analysis; this is a serious client-side vulnerability but not an emergency because the attacker cannot reach the client unsolicited.
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).
Local privilege escalation in the Windows Partition Management Driver lets an already-authorized, low-privileged user who can execute code on the host elevate privileges by triggering an out-of-bounds read against malformed partition-related structures handled by the kernel driver. Microsoft rates it CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a CWE-125 root cause, and because the driver is a standard in-box Windows component, default installations are affected with no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limiter is the prerequisite local foothold, making this a credible, patch-worthy privilege-escalation building block rather than an emergency or an initial-access vector.
Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.
Out-of-bounds read in Windows Text Shaping allows a remote, unauthenticated attacker to execute code on affected Windows systems when a victim opens or renders attacker-controlled content (UI:R), such as a document, web page, email, or font. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but with a CVSS score of 8.8 and high impact to confidentiality, integrity, and availability, it represents a credible high-priority risk that is not a top-of-queue emergency on current signals.
Local privilege escalation in the Windows VHD miniport driver allows an authenticated attacker with low privileges to execute arbitrary code in kernel mode, resulting in full system compromise. This use-after-free (CWE-416) vulnerability requires the attacker to already possess low-privileged local access and the ability to interact with the virtual disk subsystem. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data is not available; the CVSS score is 7.8.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.
Authenticated privilege escalation in Microsoft WebDAV lets a low-privileged network user bypass authorization by supplying an alternate but equivalent path representation, causing access-control checks to be evaluated against the wrong canonical path; successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing authorized account on the target plus network reach to the WebDAV service - it is not exploitable by a fully unauthenticated attacker - but needs no user interaction and has low attack complexity. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; patch availability was not specified in the provided intelligence and should be confirmed against the Microsoft MSRC advisory.
Local privilege escalation in the Windows StateRepository API allows an attacker who already has code execution as a low-privileged, authenticated user to trigger a type-confusion condition and gain higher-integrity code execution on the same machine. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw is not reachable remotely and requires no user interaction, but it cannot serve as an initial-access vector - it is a post-compromise escalation primitive that assumes a local foothold and valid credentials. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); combined with the local-only attack path, this is a credible but not emergency-tier internet-facing threat.
Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.
Use-after-free memory corruption in Windows Hyper-V allows an authenticated low-privileged attacker who already has code execution inside a guest VM to trigger memory corruption in the hypervisor and, per the assessed scope change, likely cross the guest-to-host boundary with high confidentiality, integrity, and availability impact. The CVSS:3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, so the flaw is local, low-complexity, requires low privileges, needs no user interaction, and has Changed scope; it is not a remote unauthenticated network-reachable bug. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV active-exploitation entry was provided.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.
Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated local attacker on a Windows host abuse improper access control in the driver's file-link handling to run code with elevated rights. Exploitation requires the attacker to already hold a valid low-privileged account (CVSS vector PR:L, AV:L) and to reach the container-isolation driver path; no user interaction is needed and attack complexity is low (AC:L), with high confidentiality, integrity and availability impact scored (7.8). Microsoft has published an advisory entry via the MSRC update guide, there is no indication of CISA KEV listing, and no public exploit code was identified at time of analysis - this is a patch-priority issue for Windows container hosts rather than a wormable emergency.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.