Windows 11 26H2
Monthly
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Local privilege escalation in the Windows AppX Deployment Extensions component allows an authenticated, low-privileged attacker who already has code execution or interactive access on a host to elevate to a higher-integrity context, including SYSTEM, because a required authorization check is missing (CWE-862). The flaw carries a CVSS 3.1 base score of 8.8 from the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - the Scope:Changed rating reflects that a successful exploit crosses a privilege boundary, granting high confidentiality, integrity, and availability impact. Every supported Windows client and server release is exposed, and because the component ships in default Windows installations, no unusual configuration is required once the attacker has a foothold; there is no KEV listing and no public exploit identified at time of analysis, though the low attack complexity and absence of user interaction make it an attractive post-compromise escalation primitive. Microsoft has released fixed builds, so this is a genuine prioritization candidate for patch cycles rather than an unmitigable emergency, but the hard prerequisite of existing local access is the main constraint on real-world risk.
Code execution in the Windows Overlay Filter (WOF) driver lets a locally authenticated attacker trigger an out-of-bounds memory read and, per Microsoft's severity rating, achieve code execution with high confidentiality, integrity and availability impact on unpatched machines. The flaw (CVE-2026-69942, CWE-126, CVSS 7.8 / AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing local foothold and low-privileged credentials, so it is a post-compromise privilege-escalation issue rather than an initial access vector, affecting Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core) below their fixed build levels. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis; Microsoft has released a fix, so exposure is confined to systems that have not yet installed the current cumulative update.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Spaceport.sys Storage Spaces kernel driver allows an authenticated attacker who already has the ability to execute code as a low-privileged user on an affected host to gain full SYSTEM-level privileges. An integer overflow/wraparound in the driver's handling of size or index values lets a crafted request corrupt kernel memory, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All unpatched Windows 11 releases from 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) installations with the driver loaded at defaults are in scope, but exploitation is not automatable per SSVC, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds authorized access to the DNS service (CVSS PR:L) disclose memory contents over the network, with no user interaction required (UI:N) and low attack complexity (AC:L). Impact is strictly confidentiality (C:H/I:N/A:N) - there is no code execution, data modification, or denial of service, and only Windows and Windows Server builds with the DNS Server role enabled are exposed. This is a genuine but moderate-priority issue rather than a top-tier emergency: CISA SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.
An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Local tampering in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated attacker redirect file operations to an attacker-chosen destination. A low-privileged user who can create or control a symbolic link, junction, or reparse point that unionfs.sys resolves during a file operation can exploit improper link resolution (CWE-59) to modify or overwrite files the driver handles, affecting Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and 2025 builds prior to their patched levels. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning local authenticated access is a prerequisite and only integrity is impacted; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so real-world urgency is low.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Information disclosure in the Microsoft Windows Storage component lets an authenticated local attacker read sensitive data that the service places in a file or directory reachable by lower-privileged users (CWE-538). Exploitation requires a valid low-privileged interactive session on an unpatched host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely or by an unauthenticated user, and the impact is confidentiality-only (C:H, I:N, A:N) with a base score of 5.5. Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity hardening item rather than an urgent remote threat.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.
An out-of-bounds read in the Remote Desktop Display Driver component of Microsoft Windows lets an authenticated, low-privileged local attacker disclose potentially sensitive memory contents on the affected host. Exploitation requires the attacker to already hold a local foothold on the machine (AV:L, PR:L) and to execute code that reaches the driver; no user interaction is needed (UI:N), and the impact is limited to confidentiality (C:H, I:N, A:N) with no code execution or system compromise by itself. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and CISA's SSVC framework rates it non-automatable with only partial technical impact, so real-world urgency is LOW despite the high confidentiality rating.
Improper access control in the Windows Routing and Remote Access Service (RRAS) allows an authenticated local attacker holding only low-level privileges to tamper with service state or configuration on affected Windows 10, Windows 11, and Windows Server builds. Exploitation is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requires the optional RRAS role to be installed and enabled, and impacts integrity only - confidentiality and availability are unaffected, which is consistent with the moderate 5.5 base score. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), and vendor-released patches are available for every affected build branch.
Missing authorization in the Windows Overlay Filter (WOF) allows an authenticated local attacker to tamper with protected file/overlay data on affected Windows 10, Windows 11, and Windows Server 2016-2025 systems, producing an integrity-only impact (CVSS 5.5, CWE-862). The assessed vector (AV:L/PR:L/UI:N, C:N/I:H/A:N) means exploitation is neither remote nor unauthenticated: an attacker must already hold low-privileged local execution on the host, which confines real-world exposure to post-compromise and malicious-insider scenarios rather than a pre-auth or network attack. CISA SSVC records exploitation as "none" and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft, and this is a moderate-severity, low-urgency issue rather than an emergency.
An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.
Local tampering of network list data in the Windows Network List Service allows an authenticated low-privileged attacker to modify network profiles and settings, resulting in partial integrity impact while confidentiality and availability remain unaffected. Affected versions span Windows 10, Windows 11, and numerous Windows Server releases, with vendor patches available. No public exploit identified at time of analysis, and given the required local access and lack of remote vector, the risk is assessed as a moderate, low-priority integrity issue.
Information disclosure in Windows Kernel-Mode Drivers lets an authenticated local attacker read uninitialized kernel memory and leak residual kernel data on affected Windows 10, Windows 11, and Windows Server builds (Windows Server 2012 R2 through 2025). Exploitation requires a pre-existing standard local account and the ability to invoke the vulnerable driver code path; it is not remotely triggerable, needs no user interaction, and provides no code execution or system modification, so realistic value is as a kernel-memory-leak primitive inside a larger exploit chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA SSVC rates the issue non-automatable, consistent with its low-to-moderate priority despite the CVSS 5.5 Medium score.
Local integrity tampering in the Windows Update Stack allows an authenticated low-privilege attacker who already holds a session on an affected Windows host to modify update-related configuration or state that should be protected, producing a high integrity impact with no confidentiality or availability effect. The flaw (CWE-15, external control of a system or configuration setting) touches a broad set of Windows 10, Windows 11, and Windows Server branches from 1809/21H2 through 26H1/26H2 and Server 2019/2022/2025. Vendor patches are available, no public exploit code or active exploitation has been identified, and CISA's SSVC assessment records exploitation as none with the issue rated non-automatable, so real-world risk is largely confined to insiders or post-compromise tampering rather than scalable remote attacks.
Information disclosure in Windows Health and Optimized Experiences Service on Windows 11 allows a locally authenticated low-privileged attacker to read sensitive data from the service because a critical function lacks proper authentication (CWE-306). The issue is local-only, requires an existing low-privileged session, and has low attack complexity but no user interaction; it does not permit privilege escalation or modification, and no public exploit has been identified at time of analysis. Microsoft has released a vendor patch, and this is a moderate, low-priority issue rather than an urgent threat.
Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.
An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.
Missing authorization checks in the Windows WebDAV component allow an attacker who already holds valid low-privilege credentials to bypass a security feature over the network, affecting only integrity (no confidentiality or availability impact). Microsoft rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning exploitation is straightforward once an authenticated foothold exists but does not permit data theft or denial of service. Vendor fixes are available; at time of analysis there was no public exploit code and no confirmed active exploitation (not in CISA KEV).
Local information disclosure in Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets anyone who already holds a local user session read private personal information they should not be able to access, yielding a HIGH confidentiality impact (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. The flaw is not remotely reachable and requires no authentication or user interaction beyond the local foothold, so the practical exposure is limited to hosts where an attacker has already gained local code execution on an unpatched build. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC reports Exploitation: none, Automatable: no), and the moderate score plus the local-only vector point to LOW real-world urgency even though the data disclosed is sensitive.
Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.
Out-of-bounds read in the Windows Wi-Fi Driver (CWE-125) allows an attacker who already sits on the same wireless network or local Layer-2/broadcast segment as the target - and who already holds low-level privileges on that adjacent segment - to read beyond the bounds of a kernel buffer and disclose information from the affected Windows system. The issue affects a broad range of supported builds, from Windows 10 1607 through Windows 11 26H2 and the corresponding Windows Server 2016/2019/2022/2025 releases, all of which are fixed by the current cumulative updates. Impact is limited to confidentiality (CVSS:3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7); there is no integrity or availability impact, no code execution or privilege escalation, no public exploit code identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, making this a moderate, patch-routinely item rather than an emergency.
An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.
Local information disclosure in the Windows Bind Filter (bindflt.sys) driver allows an authenticated local attacker with low privileges to read files outside their intended boundary on unpatched Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is a CWE-552 improperly-restricted file/directory access issue in the kernel-mode driver that underpins filesystem bind/redirection mounts. Vendor-released patches are available with fixed builds listed in the EUVD ranges, and no public exploit identified at time of analysis; the SSVC assessment shows exploitation none and not automatable, so risk is moderate and limited to hosts where an attacker already holds a local, authenticated foothold.
Security feature bypass in Windows PowerShell allows an unauthenticated attacker to defeat a security check, but the victim must actively run or open attacker-supplied content (UI:R), so it is not a hands-off remote exploit. Impact is integrity-only (C:N/I:H/A:N, CVSS 6.5); Microsoft has released patches, CISA SSVC rates exploitation as none and automatable as no, and no public exploit code was identified at time of analysis.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.
Local information disclosure in the Windows Sysmain service allows an authenticated attacker with low-level local privileges to access sensitive system information on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation requires existing local access and valid credentials (CVSS PR:L), with no user interaction needed, and is limited to confidentiality impact; no public exploit identified at time of analysis, and CISA SSVC records no exploitation. Microsoft has released vendor patches for the affected builds via its MSRC advisory.
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Local privilege escalation in the Windows AppX Deployment Extensions component allows an authenticated, low-privileged attacker who already has code execution or interactive access on a host to elevate to a higher-integrity context, including SYSTEM, because a required authorization check is missing (CWE-862). The flaw carries a CVSS 3.1 base score of 8.8 from the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - the Scope:Changed rating reflects that a successful exploit crosses a privilege boundary, granting high confidentiality, integrity, and availability impact. Every supported Windows client and server release is exposed, and because the component ships in default Windows installations, no unusual configuration is required once the attacker has a foothold; there is no KEV listing and no public exploit identified at time of analysis, though the low attack complexity and absence of user interaction make it an attractive post-compromise escalation primitive. Microsoft has released fixed builds, so this is a genuine prioritization candidate for patch cycles rather than an unmitigable emergency, but the hard prerequisite of existing local access is the main constraint on real-world risk.
Code execution in the Windows Overlay Filter (WOF) driver lets a locally authenticated attacker trigger an out-of-bounds memory read and, per Microsoft's severity rating, achieve code execution with high confidentiality, integrity and availability impact on unpatched machines. The flaw (CVE-2026-69942, CWE-126, CVSS 7.8 / AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing local foothold and low-privileged credentials, so it is a post-compromise privilege-escalation issue rather than an initial access vector, affecting Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core) below their fixed build levels. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis; Microsoft has released a fix, so exposure is confined to systems that have not yet installed the current cumulative update.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Spaceport.sys Storage Spaces kernel driver allows an authenticated attacker who already has the ability to execute code as a low-privileged user on an affected host to gain full SYSTEM-level privileges. An integer overflow/wraparound in the driver's handling of size or index values lets a crafted request corrupt kernel memory, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All unpatched Windows 11 releases from 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) installations with the driver loaded at defaults are in scope, but exploitation is not automatable per SSVC, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds authorized access to the DNS service (CVSS PR:L) disclose memory contents over the network, with no user interaction required (UI:N) and low attack complexity (AC:L). Impact is strictly confidentiality (C:H/I:N/A:N) - there is no code execution, data modification, or denial of service, and only Windows and Windows Server builds with the DNS Server role enabled are exposed. This is a genuine but moderate-priority issue rather than a top-tier emergency: CISA SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.
An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Local tampering in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated attacker redirect file operations to an attacker-chosen destination. A low-privileged user who can create or control a symbolic link, junction, or reparse point that unionfs.sys resolves during a file operation can exploit improper link resolution (CWE-59) to modify or overwrite files the driver handles, affecting Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and 2025 builds prior to their patched levels. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning local authenticated access is a prerequisite and only integrity is impacted; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so real-world urgency is low.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Information disclosure in the Microsoft Windows Storage component lets an authenticated local attacker read sensitive data that the service places in a file or directory reachable by lower-privileged users (CWE-538). Exploitation requires a valid low-privileged interactive session on an unpatched host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely or by an unauthenticated user, and the impact is confidentiality-only (C:H, I:N, A:N) with a base score of 5.5. Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity hardening item rather than an urgent remote threat.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.
An out-of-bounds read in the Remote Desktop Display Driver component of Microsoft Windows lets an authenticated, low-privileged local attacker disclose potentially sensitive memory contents on the affected host. Exploitation requires the attacker to already hold a local foothold on the machine (AV:L, PR:L) and to execute code that reaches the driver; no user interaction is needed (UI:N), and the impact is limited to confidentiality (C:H, I:N, A:N) with no code execution or system compromise by itself. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and CISA's SSVC framework rates it non-automatable with only partial technical impact, so real-world urgency is LOW despite the high confidentiality rating.
Improper access control in the Windows Routing and Remote Access Service (RRAS) allows an authenticated local attacker holding only low-level privileges to tamper with service state or configuration on affected Windows 10, Windows 11, and Windows Server builds. Exploitation is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requires the optional RRAS role to be installed and enabled, and impacts integrity only - confidentiality and availability are unaffected, which is consistent with the moderate 5.5 base score. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), and vendor-released patches are available for every affected build branch.
Missing authorization in the Windows Overlay Filter (WOF) allows an authenticated local attacker to tamper with protected file/overlay data on affected Windows 10, Windows 11, and Windows Server 2016-2025 systems, producing an integrity-only impact (CVSS 5.5, CWE-862). The assessed vector (AV:L/PR:L/UI:N, C:N/I:H/A:N) means exploitation is neither remote nor unauthenticated: an attacker must already hold low-privileged local execution on the host, which confines real-world exposure to post-compromise and malicious-insider scenarios rather than a pre-auth or network attack. CISA SSVC records exploitation as "none" and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft, and this is a moderate-severity, low-urgency issue rather than an emergency.
An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.
Local tampering of network list data in the Windows Network List Service allows an authenticated low-privileged attacker to modify network profiles and settings, resulting in partial integrity impact while confidentiality and availability remain unaffected. Affected versions span Windows 10, Windows 11, and numerous Windows Server releases, with vendor patches available. No public exploit identified at time of analysis, and given the required local access and lack of remote vector, the risk is assessed as a moderate, low-priority integrity issue.
Information disclosure in Windows Kernel-Mode Drivers lets an authenticated local attacker read uninitialized kernel memory and leak residual kernel data on affected Windows 10, Windows 11, and Windows Server builds (Windows Server 2012 R2 through 2025). Exploitation requires a pre-existing standard local account and the ability to invoke the vulnerable driver code path; it is not remotely triggerable, needs no user interaction, and provides no code execution or system modification, so realistic value is as a kernel-memory-leak primitive inside a larger exploit chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA SSVC rates the issue non-automatable, consistent with its low-to-moderate priority despite the CVSS 5.5 Medium score.
Local integrity tampering in the Windows Update Stack allows an authenticated low-privilege attacker who already holds a session on an affected Windows host to modify update-related configuration or state that should be protected, producing a high integrity impact with no confidentiality or availability effect. The flaw (CWE-15, external control of a system or configuration setting) touches a broad set of Windows 10, Windows 11, and Windows Server branches from 1809/21H2 through 26H1/26H2 and Server 2019/2022/2025. Vendor patches are available, no public exploit code or active exploitation has been identified, and CISA's SSVC assessment records exploitation as none with the issue rated non-automatable, so real-world risk is largely confined to insiders or post-compromise tampering rather than scalable remote attacks.
Information disclosure in Windows Health and Optimized Experiences Service on Windows 11 allows a locally authenticated low-privileged attacker to read sensitive data from the service because a critical function lacks proper authentication (CWE-306). The issue is local-only, requires an existing low-privileged session, and has low attack complexity but no user interaction; it does not permit privilege escalation or modification, and no public exploit has been identified at time of analysis. Microsoft has released a vendor patch, and this is a moderate, low-priority issue rather than an urgent threat.
Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.
An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.
Missing authorization checks in the Windows WebDAV component allow an attacker who already holds valid low-privilege credentials to bypass a security feature over the network, affecting only integrity (no confidentiality or availability impact). Microsoft rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning exploitation is straightforward once an authenticated foothold exists but does not permit data theft or denial of service. Vendor fixes are available; at time of analysis there was no public exploit code and no confirmed active exploitation (not in CISA KEV).
Local information disclosure in Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets anyone who already holds a local user session read private personal information they should not be able to access, yielding a HIGH confidentiality impact (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. The flaw is not remotely reachable and requires no authentication or user interaction beyond the local foothold, so the practical exposure is limited to hosts where an attacker has already gained local code execution on an unpatched build. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC reports Exploitation: none, Automatable: no), and the moderate score plus the local-only vector point to LOW real-world urgency even though the data disclosed is sensitive.
Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.
Out-of-bounds read in the Windows Wi-Fi Driver (CWE-125) allows an attacker who already sits on the same wireless network or local Layer-2/broadcast segment as the target - and who already holds low-level privileges on that adjacent segment - to read beyond the bounds of a kernel buffer and disclose information from the affected Windows system. The issue affects a broad range of supported builds, from Windows 10 1607 through Windows 11 26H2 and the corresponding Windows Server 2016/2019/2022/2025 releases, all of which are fixed by the current cumulative updates. Impact is limited to confidentiality (CVSS:3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7); there is no integrity or availability impact, no code execution or privilege escalation, no public exploit code identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, making this a moderate, patch-routinely item rather than an emergency.
An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.
Local information disclosure in the Windows Bind Filter (bindflt.sys) driver allows an authenticated local attacker with low privileges to read files outside their intended boundary on unpatched Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is a CWE-552 improperly-restricted file/directory access issue in the kernel-mode driver that underpins filesystem bind/redirection mounts. Vendor-released patches are available with fixed builds listed in the EUVD ranges, and no public exploit identified at time of analysis; the SSVC assessment shows exploitation none and not automatable, so risk is moderate and limited to hosts where an attacker already holds a local, authenticated foothold.
Security feature bypass in Windows PowerShell allows an unauthenticated attacker to defeat a security check, but the victim must actively run or open attacker-supplied content (UI:R), so it is not a hands-off remote exploit. Impact is integrity-only (C:N/I:H/A:N, CVSS 6.5); Microsoft has released patches, CISA SSVC rates exploitation as none and automatable as no, and no public exploit code was identified at time of analysis.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.
Local information disclosure in the Windows Sysmain service allows an authenticated attacker with low-level local privileges to access sensitive system information on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation requires existing local access and valid credentials (CVSS PR:L), with no user interaction needed, and is limited to confidentiality impact; no public exploit identified at time of analysis, and CISA SSVC records no exploitation. Microsoft has released vendor patches for the affected builds via its MSRC advisory.
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Code execution in the Windows Overlay Filter (WOF) driver of unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 allows an unauthenticated attacker to gain full control of confidentiality, integrity, and availability on the affected host, but only if they already hold physical, hands-on access to the device (CVSS AV:P), which caps the base score at 6.8. The root cause is a heap-based buffer overflow (CWE-122) that is reachable with low attack complexity, no privileges (PR:N), and no user interaction (UI:N), so the decisive limiting factor is the physical-access prerequisite rather than any technical barrier. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC Exploitation=none, Automatable=no), and a vendor patch is available, so remote, wormable, or mass-scale abuse is not feasible.