Windows 11 Version 26H1
Monthly
Local privilege escalation to code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) that an authenticated local attacker can trigger to run arbitrary code with elevated privileges. The flaw was reported by Microsoft and spans a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and reliable memory-corruption primitive in a core kernel-mode driver make it a strong candidate for patch-Tuesday prioritization.
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap memory (CWE-122) to gain SYSTEM-level control across virtually all supported Windows client and server builds. Publicly available exploit code exists, though CISA SSVC assessed exploitation status as none and EPSS is modest (0.37%, 29th percentile), indicating a serious but not yet mass-exploited weakness. A vendor patch is available via Microsoft's update guide, making prompt patching the clear priority.
Local privilege escalation in the Windows Print Spooler Components affects Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019/2022/2025, where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt heap memory in a Spooler component and gain SYSTEM-level privileges. Exploitation requires low-privilege local access (CVSS AV:L/PR:L) with no user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Privilege escalation in the Windows Netlogon service allows an authenticated network attacker to gain elevated privileges by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server builds, from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025, and was reported by Microsoft. There is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as none, with a low EPSS of 0.62%.
Privilege elevation via a use-after-free in the Microsoft Windows DNS component lets a network-based, unauthenticated attacker corrupt memory and potentially gain higher privileges on affected Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 systems. Microsoft rates it CVSS 9.8, and the SSVC assessment lists total technical impact but notes no observed exploitation and that it is not automatable. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.67% (48th percentile).
Elevation of privilege in the Windows Runtime (WinRT) component affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user run code at higher privilege. Microsoft has released a patch and reported the issue; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Given the CVSS 7.8 (Important) rating and full C/I/A impact, this is a standard local privilege-escalation risk suited for regular patch prioritization rather than emergency response.
Remote code execution in the Windows Event Logging Service affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025), where insufficient granularity of access controls (CWE-1220) lets an authenticated attacker with low privileges execute code over the network with high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds. There is no public exploit identified at time of analysis and CISA has not listed it in KEV, with a low EPSS score of 0.61%.
Local privilege escalation in the Windows Graphics Kernel component allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All currently supported Windows client and server builds are affected - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit identified at time of analysis; Microsoft has released a patch, and the CVSS 7.8 (Important) rating reflects high impact but a local-access, low-privilege prerequisite.
Local privilege escalation in the Microsoft Windows Kernel lets an already-authenticated attacker corrupt heap memory to gain SYSTEM-level control across Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025. The CVSS 7.8 (AV:L/PR:L) rating reflects that low-privileged code execution is a prerequisite; there is no public exploit identified at time of analysis, but Microsoft has released a patch. This is a classic post-exploitation escalation primitive rather than an initial-access vector.
Local privilege escalation to code execution in the Windows NTFS driver affects a broad range of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker who can trigger the vulnerable NTFS code path can corrupt heap memory (CWE-122) to run arbitrary code, gaining high confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and the low EPSS score (0.31%, 23rd percentile) together with CISA SSVC 'Exploitation: none' indicates no observed exploitation, though the total technical impact keeps it patch-worthy.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated attacker who already has low-privileged code execution on a host elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption. It affects a broad range of supported Windows client and server builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven publicly despite the reliably-exploitable nature of kernel UAF flaws.
Local privilege escalation in the Microsoft Windows Kernel (CWE-122 heap-based buffer overflow) allows an authenticated local attacker to gain SYSTEM-level control across a broad range of currently supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Exploitation grants total confidentiality, integrity, and availability impact (CVSS 3.1 7.8, C:H/I:H/A:H). There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and the EPSS score is low at 0.32% (24th percentile), indicating no evidence of active or imminent mass exploitation despite the critical technical impact.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated low-privileged user exploit a use-after-free (CWE-416) memory corruption flaw to elevate to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server builds. Reported by Microsoft and rated CVSS 7.8, it is not currently in CISA KEV and has no public exploit identified at time of analysis; the EPSS score is low at 0.26% (17th percentile). A vendor patch is available via the MSRC update guide.
Information disclosure in the Windows Network Policy Server (NPS) SNMP component allows a remote, unauthenticated attacker to read out-of-bounds memory over the network and disclose sensitive process data. The flaw affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. It was reported by Microsoft, a vendor patch is available, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Local privilege escalation in the Windows Backup Engine affects a broad range of Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) builds, where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt memory and gain SYSTEM-level control. Microsoft rates it 7.8 (AV:L/PR:L) with total confidentiality, integrity, and availability impact, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.25% (16th percentile).
Denial of service in the Windows Domain Controller role on Windows Server 2025 (including Server Core) and Windows 11 24H2/25H2/26H1 lets a remote, unauthenticated attacker crash or hang authentication services by triggering an untrusted pointer dereference over the network. Because the CVSS vector is PR:N/UI:N with A:H and no confidentiality or integrity impact, a single crafted network exchange can disrupt directory and logon services domain-wide without credentials. No public exploit identified at time of analysis, and it is not on CISA KEV; Microsoft has released a patch.
Local privilege escalation in the Windows Wireless Wide Area Network (WWAN) Service affects all supported Windows 10, Windows 11, and Windows Server builds (2019 through 2025), where a race condition (CWE-362) in access to a shared resource lets an already-authenticated local user win a timing window to gain higher privileges. Microsoft rates it CVSS 7.0 with total technical impact (SSVC), but exploitation requires high attack complexity and there is no public exploit identified at time of analysis. EPSS is low (0.16%, 5th percentile), consistent with the difficulty of reliably winning the race.
Remote information disclosure in the Microsoft Windows Kernel (CWE-125 out-of-bounds read) lets an unauthenticated attacker read kernel memory over a network, per the CVSS AV:N/PR:N vector, affecting a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The flaw carries high confidentiality impact (C:H) with a minor availability side effect and no integrity impact, scoring CVSS 8.2. No public exploit is identified at time of analysis and it is not in CISA KEV, but the network-reachable, no-authentication, no-interaction profile makes it a notable patch priority.
Local privilege escalation in Microsoft Windows (Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an already-authenticated local user run code at elevated privilege. The CVSS 3.1 base score is 7.8 with a scope-changed vector, and Microsoft has shipped a fix via MSRC. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Local privilege escalation in the Windows Brokering File System affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local user corrupt memory to elevate to higher privileges (typically SYSTEM). Microsoft has released a patch and rates it 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Windows Media component of Microsoft Windows (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025) allows a remote, unauthenticated attacker to read sensitive information over a network. CVSS 3.1 scores this 7.5 (C:H/I:N/A:N), reflecting a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, and SSVC rates exploitation as none with partial technical impact; EPSS is a modest 0.58% (44th percentile).
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by sending crafted network input that overflows a stack buffer (CWE-121). Because AD FS commonly fronts single sign-on for Microsoft 365, Azure AD, and federated web applications, an outage cascades into loss of authentication for every relying-party application. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; a Microsoft patch is available, and the CVSS 3.1 score is 7.5 (availability-only impact).
Remote code execution in Microsoft's Remote Desktop Client (the RDP client, mstsc.exe, shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) allows an unauthorized attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Exploitation requires the victim to connect to an attacker-controlled or compromised RDP endpoint (UI:R), after which the malicious server can corrupt client-side memory to achieve full code execution. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local code execution in Microsoft Windows' Resilient File System (ReFS) driver lets an unauthorized attacker run arbitrary code by inducing a victim to mount or open a maliciously crafted ReFS volume (CVE-2026-50362). The flaw affects the ReFS component shipped across Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025, carries CVSS 7.8, and requires user interaction (UI:R) with no prior authentication (PR:N). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary code over the network by corrupting heap memory. The flaw (CWE-122) carries a CVSS 9.8 and affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit is identified at time of analysis, but the network-reachable, no-interaction, no-privilege profile of prior MSMQ bugs (e.g. the 'QueueJumper' class) makes this a top-priority patch. Microsoft has released a fix.
Local privilege escalation to code execution in the Windows NTFS driver (CVE-2026-50417) allows an authenticated attacker with low privileges to corrupt heap memory and run arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. The flaw is a heap-based buffer overflow (CWE-122) reported by Microsoft, with CVSS 7.8 (High) reflecting local vector, low complexity, and full confidentiality/integrity/availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local code execution in Microsoft Windows NTFS (New Technology File System) driver arises from a heap-based buffer overflow (CWE-122) that an attacker can trigger by inducing a user to interact with a specially crafted NTFS volume or file. Affecting a broad range of Windows client and server builds from Windows Server 2012/2012 R2 through Windows 11 26H1 and Windows Server 2025, successful exploitation yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Microsoft has issued a fix.
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated low-privileged user to elevate to higher (likely SYSTEM-level) privileges by triggering an out-of-bounds read condition. The flaw affects a broad range of currently supported Windows client and server builds, from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2022/2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server allows an authenticated attacker to run arbitrary code with elevated (SYSTEM-level) privileges by triggering a use-after-free memory-corruption condition (CWE-416). Microsoft has released a patch, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 score of 7.8 (High) with a fully local vector reflects meaningful post-compromise impact but requires the attacker to already have a foothold on the host.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an already-authenticated local attacker to gain elevated (SYSTEM-level) privileges across a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Reported internally by Microsoft with a patch available, the flaw carries CVSS 7.8 with full confidentiality, integrity, and availability impact but no confirmed active exploitation; no public exploit identified at time of analysis.
Remote code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. A use-after-free (CWE-416) in the queue manager lets a remote, unauthenticated attacker who can reach the MSMQ service execute arbitrary code with total impact to confidentiality, integrity, and availability. Microsoft has released patches; there is no public exploit identified at time of analysis and the EPSS probability is modest at 0.52%.
Local integrity and availability tampering in the Microsoft Windows DNS component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker with low privileges can abuse improper access control to modify DNS data or disrupt the service. Microsoft self-reported the issue and has released a patch. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, so exploitation would currently require local access on an already-compromised or shared host.
Local privilege escalation in Microsoft Windows Resilient File System (ReFS) lets an authenticated local attacker gain elevated (SYSTEM-level) privileges by triggering an untrusted pointer dereference in the ReFS driver. It affects a broad range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently patch-and-move rather than emergency.
Local privilege escalation in the Windows Overlay Filter (WOF) driver affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low privileges can trigger a buffer over-read (CWE-126) in the filter to elevate to higher privileges, gaining full confidentiality, integrity, and availability impact on the host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Windows NTFS file-system driver lets an authenticated low-privileged user gain elevated (likely SYSTEM) privileges by exploiting an incorrect conversion between numeric types (CWE-681). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Microsoft reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Brokering File System component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory corruption (CWE-416) lets an already-authenticated local user elevate to higher privileges. Microsoft rates it CVSS 7.8 with full confidentiality, integrity, and availability impact, and has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) lets an already-authenticated, low-privileged user gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2012 through 2025 builds. The root cause is a missing authentication check on a critical RRAS function (CWE-306), enabling an authorized attacker to bypass expected authorization and fully compromise confidentiality, integrity, and availability of the host. There is no public exploit identified at time of analysis, EPSS probability is low (0.22%), and CISA SSVC rates current exploitation as none, but the total technical impact and Microsoft-supplied patch make prompt patching worthwhile.
Local privilege escalation in the Windows Sensor Data Service allows an authenticated low-privileged user to gain full SYSTEM-level control on affected Windows 10, Windows 11, and Windows Server (2019-2025) systems. The flaw stems from incorrect access to an indexable resource (a range/bounds error, CWE-118) and yields high confidentiality, integrity, and availability impact per the CVSS 7.8 vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack) lets an already-authenticated user run arbitrary code with SYSTEM-level rights by triggering a CWE-843 type-confusion condition. The flaw affects a broad range of currently-supported Windows client and server builds, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Windows NTFS file-system driver lets an already-authenticated low-privileged user read memory outside allocated bounds (CWE-125) to gain elevated privileges. It affects a broad Windows fleet spanning Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Content Delivery Manager component lets an authenticated low-privileged user elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of client and server builds (Windows 10 1809 through Windows 11 26H1, plus Server 2019 and Server 2025), and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets a locally authenticated attacker elevate to higher privileges. Per the CVSS vector an already-authorized low-privileged user (PR:L) can execute the attack without user interaction, gaining full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as none, though a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Runtime affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) in the improperly synchronized handling of a shared resource lets an already-authenticated attacker win a timing window to gain higher privileges. Microsoft reported and patched the issue; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 8.8 with scope-changed impact reflects that a low-privileged local user could reach full SYSTEM-level control of confidentiality, integrity, and availability.
Elevation of privilege in the Microsoft Windows RPC API lets an unauthenticated attacker on an adjacent network gain higher privileges by exploiting an improper authentication weakness (CWE-287), provided a user is lured into an interaction. The flaw spans a broad range of client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. No public exploit identified at time of analysis; the issue was reported by Microsoft, which has released a fix.
Local privilege escalation in Windows User Interface Core (UI Core) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a relative path traversal flaw lets an already-authenticated low-privileged user escalate to higher privileges on the local machine. The CVSS 3.1 score of 7.8 reflects full confidentiality, integrity, and availability impact once triggered, though attack requires local access and existing low-level privileges. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Projected File System (ProjFS) driver lets an authenticated low-privileged attacker abuse a symbolic-link/junction race (CWE-59 link following) to redirect a privileged file operation and gain SYSTEM-level rights across Windows 10 (1809-22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in Windows Remote Desktop Services (RDS) lets an authenticated, low-privileged attacker elevate to higher privileges across a network by triggering a use-after-free (CWE-416) memory-corruption condition in the RDS component. The flaw spans a broad range of supported Windows client and server releases (Windows 10/11 and Windows Server 2012 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer overflow that lets an attacker run arbitrary code with the privileges of the affected process. The flaw affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft (the reporter) has shipped a patch; there is no public exploit identified at time of analysis, and the CVSS vector requires local access plus user interaction, so it is a privilege-escalation/code-execution primitive rather than a remotely-wormable bug.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker can exploit a use-after-free (CWE-416) memory-corruption condition to elevate privileges to SYSTEM. The flaw was reported by Microsoft, which has released a patch, and carries a CVSS 7.8 rating driven entirely by high confidentiality, integrity, and availability impact once local access is obtained. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in the Windows DirectX graphics component (CVE-2026-50382) lets an already-authenticated user run arbitrary code and, because the CVSS scope is Changed, break out of the calling security context to compromise the wider system. It affects a broad range of Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Microsoft has issued a patch; there is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Local privilege escalation in the Windows OLE (Object Linking and Embedding) component allows an already-authenticated, low-privileged user on affected Windows and Windows Server builds to elevate to higher privileges through an improper authorization check (CWE-285). Microsoft has released a patch, and no public exploit has been identified at time of analysis. Impact is high across confidentiality, integrity, and availability, though exploitation requires prior local code execution.
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows a remote, unauthenticated attacker to read out-of-bounds memory over the network, potentially leaking sensitive process data such as memory addresses that defeat ASLR, session state, or credential fragments. The flaw (CWE-126, buffer over-read) affects a broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11 including 26H1. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none; EPSS estimates a modest 0.67% (48th percentile) probability of exploitation.
Local privilege elevation in the Windows Graphics Device Interface (GDI) component allows an already-authenticated, low-privileged user to run code at a higher privilege level by triggering a stack-based buffer overflow (CWE-121). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local code execution in the Microsoft Windows NTFS file-system driver lets an attacker run arbitrary code by triggering a heap-based buffer overflow (CWE-122) when Windows parses crafted file-system metadata. The flaw spans a broad range of supported releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. It carries a CVSS 7.8 (Important) rating, requires user interaction, has a vendor patch available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Filtering Platform (WFP) lets an authenticated low-privileged user gain higher privileges on affected Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rooted in insufficient access-control granularity (CWE-1220), a local attacker with a valid session can manipulate WFP to reach SYSTEM-level access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft rates the confidentiality, integrity, and availability impact as High.
Local privilege escalation in the Microsoft Windows Kernel lets an already-authenticated attacker win a use-after-free race (CWE-416) to gain SYSTEM-level control, affecting a broad range of client and server builds from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch and there is no public exploit identified at time of analysis. The moderate 7.0 score reflects high attack complexity (a timing-dependent race) offset by full confidentiality, integrity and availability impact once triggered.
Local privilege escalation in the Microsoft Windows RPC Runtime lets an already-authenticated low-privileged user gain SYSTEM-level control due to improper authorization (CWE-285). Affecting a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Server 2025, the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Key Guard affects all supported Windows 10, Windows 11, and Windows Server releases (Server 2019 through 2025), where a race condition in the synchronization of a shared resource lets an already-authenticated local user win a timing window to elevate to higher privileges. Microsoft has released patches and rates it Important (CVSS 7.0); there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, though the technical impact is rated total. EPSS is low at 0.24% (16th percentile), consistent with a high-complexity local flaw rather than a widely-scanned remote target.
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM-level privileges across a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw stems from improper access control (CWE-284) in kernel-mode code and requires local low-privileged access with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack complexity and SYSTEM-level impact make it a standard patch-Tuesday priority.
Local privilege escalation in the Windows Group Policy component allows an already-authenticated user to elevate to higher privileges (up to SYSTEM) on affected Windows 10, Windows 11, and Windows Server 2012-2025 systems. The flaw stems from improper privilege management (CWE-269) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 and full confidentiality, integrity, and availability impact, it is a strong candidate for the monthly patch cycle on endpoints and domain-joined servers.
Local privilege escalation in Microsoft Windows Media (the Windows Media component/codec subsystem) allows an already-authenticated local attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an already-authenticated local attacker to win a race condition and gain higher privileges. The flaw was reported by Microsoft, which has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high CVSS complexity (AC:H) reflects that the attacker must reliably win a timing window, tempering real-world exploitability despite the full compromise of confidentiality, integrity, and availability once triggered.
Elevation of privilege in Microsoft Windows Runtime (WinRT) lets a remote, unauthenticated attacker win a timing window in a shared-resource race condition and gain higher privileges across a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1 and Windows Server 2019/2022/2025). Microsoft-reported and patched, the flaw carries CVSS 8.1, driven by full confidentiality, integrity, and availability impact but tempered by high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Windows Kernel allows a remote, unauthenticated attacker to read out-of-bounds memory and leak sensitive data across all currently supported Windows client and server builds (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025). The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, high confidentiality impact only). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege, no-interaction profile makes it a broadly applicable patch-now item.
Elevation of privilege in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an authorized attacker to win a race condition and gain higher privileges over a network. The CVSS 3.1 base score is 7.5 with full confidentiality, integrity, and availability impact, though the high attack complexity reflects the timing precision needed to exploit the flaw. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Elevation of privilege in Microsoft's Windows Media component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) lets an already-authenticated attacker win a timing window to gain higher privileges over the network. Microsoft (the reporter) has shipped fixes and rates impact as total loss of confidentiality, integrity, and availability, though there is no public exploit identified at time of analysis and CISA's SSVC marks exploitation status as none. EPSS is low (0.47%, 38th percentile), consistent with a patched, non-trivial-to-exploit flaw rather than an imminent mass-exploitation threat.
Elevation of privilege in the Windows Media component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated attacker to win a race condition and gain higher privileges over a network, with total loss of confidentiality, integrity, and availability. The flaw was reported by Microsoft and a patch is available; SSVC currently rates exploitation as none and no public exploit identified at time of analysis. Note a data conflict: the description characterizes this as network privilege escalation while vendor tags label it 'Information Disclosure' - verify intended impact with the MSRC advisory.
Local privilege escalation in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated low-privileged user to run code with elevated (typically SYSTEM) rights by triggering a heap-based buffer overflow. Microsoft, the reporting party, has released a patch through its Update Guide. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, so there is no evidence of active exploitation, though EIP-class memory-corruption bugs in core OS components are attractive follow-on targets after initial access.
Local privilege escalation in Microsoft Windows via the LUAFV (LUA File Virtualization, luafv.sys) driver allows an already-authenticated low-privileged user to win a timing race and elevate to SYSTEM/administrator on affected Windows client and server builds. The flaw stems from improper synchronization around a shared resource (CWE-362) and carries a CVSS 7.0 (AV:L/AC:H/PR:L) reflecting a local, high-complexity attack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Runtime (WinRT) affects a broad range of supported Windows client and server releases, from Windows 10 1809 and Windows Server 2019 through Windows 11 26H1 and Windows Server 2025. An authorized local attacker who can execute low-privilege code can trigger a use-after-free (CWE-416) memory-corruption condition to elevate privileges, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch.
Local privilege escalation in Microsoft Windows Runtime (WinRT) affects a broad range of Windows client and server builds, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. An authorized local attacker who can run low-privileged code can trigger a use-after-free memory-corruption condition to elevate to higher privileges, with high confidentiality, integrity, and availability impact implying a path to SYSTEM. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch is available.
Local code execution in the Microsoft Windows NTFS driver stems from an out-of-bounds read (CWE-125) that an attacker can leverage to run arbitrary code on affected systems, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Exploitation requires local access and user interaction (AV:L/UI:R), typically opening or mounting a maliciously crafted file or volume, but no prior authentication (PR:N). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows DirectX graphics kernel subsystem allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition across Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. The CVSS 3.1 vector (7.8, AV:L/PR:L) confirms local access and low existing privileges are required with no user interaction, yielding full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Search component lets an already-authenticated low-privilege user gain SYSTEM-level rights through improper access control (CWE-284). It affects all currently supported Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Media component across Windows 10, Windows 11, and Windows Server (2016 through 2025) allows an authenticated low-privileged attacker to elevate to SYSTEM by exploiting a use-after-free memory corruption flaw. Microsoft has released patches and reports no public exploit identified at time of analysis; EPSS is low at 0.25% and CISA SSVC records exploitation status as 'none', though technical impact is rated total. Given the ubiquity of the Windows Media stack, this is a routine but broadly applicable Patch-Tuesday-class local EoP.
Local privilege elevation in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated local attacker to win a race condition and gain higher privileges on the host. The flaw is a concurrency/synchronization defect (CWE-362) reported by Microsoft itself; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is rated high-complexity because the attacker must reliably win a timing window, which tempers the otherwise high confidentiality, integrity, and availability impact.
Privilege escalation in Microsoft Windows Runtime (WinRT) lets an authenticated attacker who can reach an affected host over the network exploit a use-after-free memory corruption to gain higher privileges, with total confidentiality, integrity, and availability impact per CVSS 8.8. Affected platforms include Windows 11 (24H2, 25H2, 26H1), Windows Server 2025, and its Server Core installation. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.48%, 38th percentile), but the technical impact is rated total and a vendor patch is available.
Local privilege escalation in Microsoft Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated, low-privileged attacker win a race condition (CWE-362) over an improperly synchronized shared resource to elevate privileges. Reported by Microsoft itself, the flaw carries a CVSS 7.0 and per SSVC has total technical impact but is not automatable and shows no observed exploitation; no public exploit is identified at time of analysis. EPSS is low at 0.24% (16th percentile), consistent with the high attack complexity of reliably timing the race.
Local privilege elevation in the Windows Brokering File System (bfs.sys/brokering component) lets an authenticated low-privileged user corrupt kernel memory via a double free (CWE-415) to gain SYSTEM-level privileges on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A Microsoft-released patch is available. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Local privilege escalation in the Windows DirectX graphics component affects a broad range of Microsoft Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). An authenticated local attacker who can run code on the host triggers a heap-based buffer overflow (CWE-122) to gain SYSTEM-level privileges, achieving total confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is modest at 1.50% (71st percentile).
Elevation of privilege in Microsoft Windows (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025) allows a locally authenticated attacker to escalate to higher privileges via an improper access control weakness (CWE-284). An attacker who already holds a low-privilege foothold on the host can gain full confidentiality, integrity, and availability impact over the system. No public exploit identified at time of analysis, though the flaw was reported by Microsoft and a vendor patch is available.
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) in the handling of a shared resource allows an already-authenticated low-privileged attacker to win a timing window and elevate to higher privileges. Exploitation requires winning a non-deterministic race (AC:H) and low-level access to the target host (PR:L, AV:L), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Microsoft has published an advisory and released a patch.
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated local attacker to win a race condition and gain higher privileges. The flaw stems from improper synchronization of a shared resource (CWE-362); successful exploitation yields high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch.
Privilege elevation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server 2019-2025 allows a remote, unauthenticated attacker to win a race condition and gain elevated privileges over the network. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis, EPSS is low (0.33%, 25th percentile) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Elevation of privilege in the Windows Runtime (WinRT) component of Microsoft Windows and Windows Server allows an unauthorized network attacker to win a race condition and gain elevated privileges, achieving full compromise of confidentiality, integrity, and availability. The flaw affects a broad range of supported builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has shipped patches. There is no public exploit identified at time of analysis and CISA/SSVC records no known exploitation, though the low CVSS attack complexity of winning the race is offset by the high technical impact.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker gain SYSTEM-level control by abusing a type-confusion (CWE-843) condition, affecting a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. Successful exploitation yields total loss of confidentiality, integrity, and availability on the host, though there is no public exploit identified at time of analysis and CISA's SSVC framework rates exploitation as 'none' and non-automatable. EPSS is low (0.29%, 21st percentile), consistent with a locally-scoped bug that requires prior code execution rather than a remotely wormable threat.
Local privilege escalation in the Microsoft Windows Kernel (CVE-2026-50377) lets an already-authenticated low-privileged attacker read memory outside intended bounds and leverage it to gain SYSTEM-level rights across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released patches and rates it 7.8 (High); there is no public exploit identified at time of analysis, EPSS is low at 0.40% (32th percentile), and CISA SSVC records exploitation as none. It is a strong second-stage escalation primitive for attackers who already have a foothold, but not a remotely reachable, wormable threat.
Local code execution in Microsoft's Resilient File System (ReFS) driver lets an already-authenticated, low-privileged user on affected Windows 10, Windows 11, and Windows Server 2016–2025 systems escalate to code execution through a numeric truncation flaw (CWE-197). No public exploit has been identified at time of analysis, and it is not on CISA KEV, but Microsoft has released a patch. Note a data conflict: the description states code execution and the CVSS carries C:H/I:H/A:H, yet the vendor tags label it 'Information Disclosure' — the CVSS-backed local elevation-of-privilege reading is treated as authoritative here.
Privilege escalation via a heap-based buffer overflow (CWE-122) in the Windows Remote Desktop Client lets an unauthorized network attacker corrupt heap memory and gain total control of the target host. The flaw affects the built-in RDP client across the entire supported Windows line, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has shipped patches; there is no public exploit identified at time of analysis and it is not in CISA KEV, though CISA's SSVC assessment rates the flaw automatable with total technical impact.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged attacker to gain SYSTEM-level control by triggering a use-after-free condition in the kernel networking driver. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.31%).
Local privilege escalation to code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) that an authenticated local attacker can trigger to run arbitrary code with elevated privileges. The flaw was reported by Microsoft and spans a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and reliable memory-corruption primitive in a core kernel-mode driver make it a strong candidate for patch-Tuesday prioritization.
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap memory (CWE-122) to gain SYSTEM-level control across virtually all supported Windows client and server builds. Publicly available exploit code exists, though CISA SSVC assessed exploitation status as none and EPSS is modest (0.37%, 29th percentile), indicating a serious but not yet mass-exploited weakness. A vendor patch is available via Microsoft's update guide, making prompt patching the clear priority.
Local privilege escalation in the Windows Print Spooler Components affects Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019/2022/2025, where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt heap memory in a Spooler component and gain SYSTEM-level privileges. Exploitation requires low-privilege local access (CVSS AV:L/PR:L) with no user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Privilege escalation in the Windows Netlogon service allows an authenticated network attacker to gain elevated privileges by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server builds, from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025, and was reported by Microsoft. There is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as none, with a low EPSS of 0.62%.
Privilege elevation via a use-after-free in the Microsoft Windows DNS component lets a network-based, unauthenticated attacker corrupt memory and potentially gain higher privileges on affected Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 systems. Microsoft rates it CVSS 9.8, and the SSVC assessment lists total technical impact but notes no observed exploitation and that it is not automatable. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.67% (48th percentile).
Elevation of privilege in the Windows Runtime (WinRT) component affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user run code at higher privilege. Microsoft has released a patch and reported the issue; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Given the CVSS 7.8 (Important) rating and full C/I/A impact, this is a standard local privilege-escalation risk suited for regular patch prioritization rather than emergency response.
Remote code execution in the Windows Event Logging Service affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025), where insufficient granularity of access controls (CWE-1220) lets an authenticated attacker with low privileges execute code over the network with high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds. There is no public exploit identified at time of analysis and CISA has not listed it in KEV, with a low EPSS score of 0.61%.
Local privilege escalation in the Windows Graphics Kernel component allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All currently supported Windows client and server builds are affected - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit identified at time of analysis; Microsoft has released a patch, and the CVSS 7.8 (Important) rating reflects high impact but a local-access, low-privilege prerequisite.
Local privilege escalation in the Microsoft Windows Kernel lets an already-authenticated attacker corrupt heap memory to gain SYSTEM-level control across Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025. The CVSS 7.8 (AV:L/PR:L) rating reflects that low-privileged code execution is a prerequisite; there is no public exploit identified at time of analysis, but Microsoft has released a patch. This is a classic post-exploitation escalation primitive rather than an initial-access vector.
Local privilege escalation to code execution in the Windows NTFS driver affects a broad range of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker who can trigger the vulnerable NTFS code path can corrupt heap memory (CWE-122) to run arbitrary code, gaining high confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and the low EPSS score (0.31%, 23rd percentile) together with CISA SSVC 'Exploitation: none' indicates no observed exploitation, though the total technical impact keeps it patch-worthy.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated attacker who already has low-privileged code execution on a host elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption. It affects a broad range of supported Windows client and server builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven publicly despite the reliably-exploitable nature of kernel UAF flaws.
Local privilege escalation in the Microsoft Windows Kernel (CWE-122 heap-based buffer overflow) allows an authenticated local attacker to gain SYSTEM-level control across a broad range of currently supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Exploitation grants total confidentiality, integrity, and availability impact (CVSS 3.1 7.8, C:H/I:H/A:H). There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and the EPSS score is low at 0.32% (24th percentile), indicating no evidence of active or imminent mass exploitation despite the critical technical impact.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated low-privileged user exploit a use-after-free (CWE-416) memory corruption flaw to elevate to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server builds. Reported by Microsoft and rated CVSS 7.8, it is not currently in CISA KEV and has no public exploit identified at time of analysis; the EPSS score is low at 0.26% (17th percentile). A vendor patch is available via the MSRC update guide.
Information disclosure in the Windows Network Policy Server (NPS) SNMP component allows a remote, unauthenticated attacker to read out-of-bounds memory over the network and disclose sensitive process data. The flaw affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. It was reported by Microsoft, a vendor patch is available, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Local privilege escalation in the Windows Backup Engine affects a broad range of Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) builds, where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt memory and gain SYSTEM-level control. Microsoft rates it 7.8 (AV:L/PR:L) with total confidentiality, integrity, and availability impact, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.25% (16th percentile).
Denial of service in the Windows Domain Controller role on Windows Server 2025 (including Server Core) and Windows 11 24H2/25H2/26H1 lets a remote, unauthenticated attacker crash or hang authentication services by triggering an untrusted pointer dereference over the network. Because the CVSS vector is PR:N/UI:N with A:H and no confidentiality or integrity impact, a single crafted network exchange can disrupt directory and logon services domain-wide without credentials. No public exploit identified at time of analysis, and it is not on CISA KEV; Microsoft has released a patch.
Local privilege escalation in the Windows Wireless Wide Area Network (WWAN) Service affects all supported Windows 10, Windows 11, and Windows Server builds (2019 through 2025), where a race condition (CWE-362) in access to a shared resource lets an already-authenticated local user win a timing window to gain higher privileges. Microsoft rates it CVSS 7.0 with total technical impact (SSVC), but exploitation requires high attack complexity and there is no public exploit identified at time of analysis. EPSS is low (0.16%, 5th percentile), consistent with the difficulty of reliably winning the race.
Remote information disclosure in the Microsoft Windows Kernel (CWE-125 out-of-bounds read) lets an unauthenticated attacker read kernel memory over a network, per the CVSS AV:N/PR:N vector, affecting a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The flaw carries high confidentiality impact (C:H) with a minor availability side effect and no integrity impact, scoring CVSS 8.2. No public exploit is identified at time of analysis and it is not in CISA KEV, but the network-reachable, no-authentication, no-interaction profile makes it a notable patch priority.
Local privilege escalation in Microsoft Windows (Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an already-authenticated local user run code at elevated privilege. The CVSS 3.1 base score is 7.8 with a scope-changed vector, and Microsoft has shipped a fix via MSRC. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Local privilege escalation in the Windows Brokering File System affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local user corrupt memory to elevate to higher privileges (typically SYSTEM). Microsoft has released a patch and rates it 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Windows Media component of Microsoft Windows (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025) allows a remote, unauthenticated attacker to read sensitive information over a network. CVSS 3.1 scores this 7.5 (C:H/I:N/A:N), reflecting a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, and SSVC rates exploitation as none with partial technical impact; EPSS is a modest 0.58% (44th percentile).
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by sending crafted network input that overflows a stack buffer (CWE-121). Because AD FS commonly fronts single sign-on for Microsoft 365, Azure AD, and federated web applications, an outage cascades into loss of authentication for every relying-party application. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; a Microsoft patch is available, and the CVSS 3.1 score is 7.5 (availability-only impact).
Remote code execution in Microsoft's Remote Desktop Client (the RDP client, mstsc.exe, shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) allows an unauthorized attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Exploitation requires the victim to connect to an attacker-controlled or compromised RDP endpoint (UI:R), after which the malicious server can corrupt client-side memory to achieve full code execution. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local code execution in Microsoft Windows' Resilient File System (ReFS) driver lets an unauthorized attacker run arbitrary code by inducing a victim to mount or open a maliciously crafted ReFS volume (CVE-2026-50362). The flaw affects the ReFS component shipped across Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025, carries CVSS 7.8, and requires user interaction (UI:R) with no prior authentication (PR:N). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary code over the network by corrupting heap memory. The flaw (CWE-122) carries a CVSS 9.8 and affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit is identified at time of analysis, but the network-reachable, no-interaction, no-privilege profile of prior MSMQ bugs (e.g. the 'QueueJumper' class) makes this a top-priority patch. Microsoft has released a fix.
Local privilege escalation to code execution in the Windows NTFS driver (CVE-2026-50417) allows an authenticated attacker with low privileges to corrupt heap memory and run arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. The flaw is a heap-based buffer overflow (CWE-122) reported by Microsoft, with CVSS 7.8 (High) reflecting local vector, low complexity, and full confidentiality/integrity/availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local code execution in Microsoft Windows NTFS (New Technology File System) driver arises from a heap-based buffer overflow (CWE-122) that an attacker can trigger by inducing a user to interact with a specially crafted NTFS volume or file. Affecting a broad range of Windows client and server builds from Windows Server 2012/2012 R2 through Windows 11 26H1 and Windows Server 2025, successful exploitation yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Microsoft has issued a fix.
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated low-privileged user to elevate to higher (likely SYSTEM-level) privileges by triggering an out-of-bounds read condition. The flaw affects a broad range of currently supported Windows client and server builds, from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2022/2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server allows an authenticated attacker to run arbitrary code with elevated (SYSTEM-level) privileges by triggering a use-after-free memory-corruption condition (CWE-416). Microsoft has released a patch, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 score of 7.8 (High) with a fully local vector reflects meaningful post-compromise impact but requires the attacker to already have a foothold on the host.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an already-authenticated local attacker to gain elevated (SYSTEM-level) privileges across a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Reported internally by Microsoft with a patch available, the flaw carries CVSS 7.8 with full confidentiality, integrity, and availability impact but no confirmed active exploitation; no public exploit identified at time of analysis.
Remote code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. A use-after-free (CWE-416) in the queue manager lets a remote, unauthenticated attacker who can reach the MSMQ service execute arbitrary code with total impact to confidentiality, integrity, and availability. Microsoft has released patches; there is no public exploit identified at time of analysis and the EPSS probability is modest at 0.52%.
Local integrity and availability tampering in the Microsoft Windows DNS component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker with low privileges can abuse improper access control to modify DNS data or disrupt the service. Microsoft self-reported the issue and has released a patch. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, so exploitation would currently require local access on an already-compromised or shared host.
Local privilege escalation in Microsoft Windows Resilient File System (ReFS) lets an authenticated local attacker gain elevated (SYSTEM-level) privileges by triggering an untrusted pointer dereference in the ReFS driver. It affects a broad range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently patch-and-move rather than emergency.
Local privilege escalation in the Windows Overlay Filter (WOF) driver affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low privileges can trigger a buffer over-read (CWE-126) in the filter to elevate to higher privileges, gaining full confidentiality, integrity, and availability impact on the host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Windows NTFS file-system driver lets an authenticated low-privileged user gain elevated (likely SYSTEM) privileges by exploiting an incorrect conversion between numeric types (CWE-681). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Microsoft reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Brokering File System component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory corruption (CWE-416) lets an already-authenticated local user elevate to higher privileges. Microsoft rates it CVSS 7.8 with full confidentiality, integrity, and availability impact, and has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) lets an already-authenticated, low-privileged user gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2012 through 2025 builds. The root cause is a missing authentication check on a critical RRAS function (CWE-306), enabling an authorized attacker to bypass expected authorization and fully compromise confidentiality, integrity, and availability of the host. There is no public exploit identified at time of analysis, EPSS probability is low (0.22%), and CISA SSVC rates current exploitation as none, but the total technical impact and Microsoft-supplied patch make prompt patching worthwhile.
Local privilege escalation in the Windows Sensor Data Service allows an authenticated low-privileged user to gain full SYSTEM-level control on affected Windows 10, Windows 11, and Windows Server (2019-2025) systems. The flaw stems from incorrect access to an indexable resource (a range/bounds error, CWE-118) and yields high confidentiality, integrity, and availability impact per the CVSS 7.8 vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack) lets an already-authenticated user run arbitrary code with SYSTEM-level rights by triggering a CWE-843 type-confusion condition. The flaw affects a broad range of currently-supported Windows client and server builds, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Windows NTFS file-system driver lets an already-authenticated low-privileged user read memory outside allocated bounds (CWE-125) to gain elevated privileges. It affects a broad Windows fleet spanning Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Content Delivery Manager component lets an authenticated low-privileged user elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of client and server builds (Windows 10 1809 through Windows 11 26H1, plus Server 2019 and Server 2025), and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets a locally authenticated attacker elevate to higher privileges. Per the CVSS vector an already-authorized low-privileged user (PR:L) can execute the attack without user interaction, gaining full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as none, though a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Runtime affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) in the improperly synchronized handling of a shared resource lets an already-authenticated attacker win a timing window to gain higher privileges. Microsoft reported and patched the issue; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 8.8 with scope-changed impact reflects that a low-privileged local user could reach full SYSTEM-level control of confidentiality, integrity, and availability.
Elevation of privilege in the Microsoft Windows RPC API lets an unauthenticated attacker on an adjacent network gain higher privileges by exploiting an improper authentication weakness (CWE-287), provided a user is lured into an interaction. The flaw spans a broad range of client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. No public exploit identified at time of analysis; the issue was reported by Microsoft, which has released a fix.
Local privilege escalation in Windows User Interface Core (UI Core) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a relative path traversal flaw lets an already-authenticated low-privileged user escalate to higher privileges on the local machine. The CVSS 3.1 score of 7.8 reflects full confidentiality, integrity, and availability impact once triggered, though attack requires local access and existing low-level privileges. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Projected File System (ProjFS) driver lets an authenticated low-privileged attacker abuse a symbolic-link/junction race (CWE-59 link following) to redirect a privileged file operation and gain SYSTEM-level rights across Windows 10 (1809-22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in Windows Remote Desktop Services (RDS) lets an authenticated, low-privileged attacker elevate to higher privileges across a network by triggering a use-after-free (CWE-416) memory-corruption condition in the RDS component. The flaw spans a broad range of supported Windows client and server releases (Windows 10/11 and Windows Server 2012 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer overflow that lets an attacker run arbitrary code with the privileges of the affected process. The flaw affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft (the reporter) has shipped a patch; there is no public exploit identified at time of analysis, and the CVSS vector requires local access plus user interaction, so it is a privilege-escalation/code-execution primitive rather than a remotely-wormable bug.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker can exploit a use-after-free (CWE-416) memory-corruption condition to elevate privileges to SYSTEM. The flaw was reported by Microsoft, which has released a patch, and carries a CVSS 7.8 rating driven entirely by high confidentiality, integrity, and availability impact once local access is obtained. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in the Windows DirectX graphics component (CVE-2026-50382) lets an already-authenticated user run arbitrary code and, because the CVSS scope is Changed, break out of the calling security context to compromise the wider system. It affects a broad range of Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Microsoft has issued a patch; there is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Local privilege escalation in the Windows OLE (Object Linking and Embedding) component allows an already-authenticated, low-privileged user on affected Windows and Windows Server builds to elevate to higher privileges through an improper authorization check (CWE-285). Microsoft has released a patch, and no public exploit has been identified at time of analysis. Impact is high across confidentiality, integrity, and availability, though exploitation requires prior local code execution.
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows a remote, unauthenticated attacker to read out-of-bounds memory over the network, potentially leaking sensitive process data such as memory addresses that defeat ASLR, session state, or credential fragments. The flaw (CWE-126, buffer over-read) affects a broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11 including 26H1. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none; EPSS estimates a modest 0.67% (48th percentile) probability of exploitation.
Local privilege elevation in the Windows Graphics Device Interface (GDI) component allows an already-authenticated, low-privileged user to run code at a higher privilege level by triggering a stack-based buffer overflow (CWE-121). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local code execution in the Microsoft Windows NTFS file-system driver lets an attacker run arbitrary code by triggering a heap-based buffer overflow (CWE-122) when Windows parses crafted file-system metadata. The flaw spans a broad range of supported releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. It carries a CVSS 7.8 (Important) rating, requires user interaction, has a vendor patch available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Filtering Platform (WFP) lets an authenticated low-privileged user gain higher privileges on affected Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rooted in insufficient access-control granularity (CWE-1220), a local attacker with a valid session can manipulate WFP to reach SYSTEM-level access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft rates the confidentiality, integrity, and availability impact as High.
Local privilege escalation in the Microsoft Windows Kernel lets an already-authenticated attacker win a use-after-free race (CWE-416) to gain SYSTEM-level control, affecting a broad range of client and server builds from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch and there is no public exploit identified at time of analysis. The moderate 7.0 score reflects high attack complexity (a timing-dependent race) offset by full confidentiality, integrity and availability impact once triggered.
Local privilege escalation in the Microsoft Windows RPC Runtime lets an already-authenticated low-privileged user gain SYSTEM-level control due to improper authorization (CWE-285). Affecting a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Server 2025, the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Key Guard affects all supported Windows 10, Windows 11, and Windows Server releases (Server 2019 through 2025), where a race condition in the synchronization of a shared resource lets an already-authenticated local user win a timing window to elevate to higher privileges. Microsoft has released patches and rates it Important (CVSS 7.0); there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, though the technical impact is rated total. EPSS is low at 0.24% (16th percentile), consistent with a high-complexity local flaw rather than a widely-scanned remote target.
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM-level privileges across a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw stems from improper access control (CWE-284) in kernel-mode code and requires local low-privileged access with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack complexity and SYSTEM-level impact make it a standard patch-Tuesday priority.
Local privilege escalation in the Windows Group Policy component allows an already-authenticated user to elevate to higher privileges (up to SYSTEM) on affected Windows 10, Windows 11, and Windows Server 2012-2025 systems. The flaw stems from improper privilege management (CWE-269) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 and full confidentiality, integrity, and availability impact, it is a strong candidate for the monthly patch cycle on endpoints and domain-joined servers.
Local privilege escalation in Microsoft Windows Media (the Windows Media component/codec subsystem) allows an already-authenticated local attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an already-authenticated local attacker to win a race condition and gain higher privileges. The flaw was reported by Microsoft, which has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high CVSS complexity (AC:H) reflects that the attacker must reliably win a timing window, tempering real-world exploitability despite the full compromise of confidentiality, integrity, and availability once triggered.
Elevation of privilege in Microsoft Windows Runtime (WinRT) lets a remote, unauthenticated attacker win a timing window in a shared-resource race condition and gain higher privileges across a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1 and Windows Server 2019/2022/2025). Microsoft-reported and patched, the flaw carries CVSS 8.1, driven by full confidentiality, integrity, and availability impact but tempered by high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Windows Kernel allows a remote, unauthenticated attacker to read out-of-bounds memory and leak sensitive data across all currently supported Windows client and server builds (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025). The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, high confidentiality impact only). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege, no-interaction profile makes it a broadly applicable patch-now item.
Elevation of privilege in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an authorized attacker to win a race condition and gain higher privileges over a network. The CVSS 3.1 base score is 7.5 with full confidentiality, integrity, and availability impact, though the high attack complexity reflects the timing precision needed to exploit the flaw. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Elevation of privilege in Microsoft's Windows Media component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) lets an already-authenticated attacker win a timing window to gain higher privileges over the network. Microsoft (the reporter) has shipped fixes and rates impact as total loss of confidentiality, integrity, and availability, though there is no public exploit identified at time of analysis and CISA's SSVC marks exploitation status as none. EPSS is low (0.47%, 38th percentile), consistent with a patched, non-trivial-to-exploit flaw rather than an imminent mass-exploitation threat.
Elevation of privilege in the Windows Media component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated attacker to win a race condition and gain higher privileges over a network, with total loss of confidentiality, integrity, and availability. The flaw was reported by Microsoft and a patch is available; SSVC currently rates exploitation as none and no public exploit identified at time of analysis. Note a data conflict: the description characterizes this as network privilege escalation while vendor tags label it 'Information Disclosure' - verify intended impact with the MSRC advisory.
Local privilege escalation in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated low-privileged user to run code with elevated (typically SYSTEM) rights by triggering a heap-based buffer overflow. Microsoft, the reporting party, has released a patch through its Update Guide. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, so there is no evidence of active exploitation, though EIP-class memory-corruption bugs in core OS components are attractive follow-on targets after initial access.
Local privilege escalation in Microsoft Windows via the LUAFV (LUA File Virtualization, luafv.sys) driver allows an already-authenticated low-privileged user to win a timing race and elevate to SYSTEM/administrator on affected Windows client and server builds. The flaw stems from improper synchronization around a shared resource (CWE-362) and carries a CVSS 7.0 (AV:L/AC:H/PR:L) reflecting a local, high-complexity attack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Runtime (WinRT) affects a broad range of supported Windows client and server releases, from Windows 10 1809 and Windows Server 2019 through Windows 11 26H1 and Windows Server 2025. An authorized local attacker who can execute low-privilege code can trigger a use-after-free (CWE-416) memory-corruption condition to elevate privileges, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch.
Local privilege escalation in Microsoft Windows Runtime (WinRT) affects a broad range of Windows client and server builds, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. An authorized local attacker who can run low-privileged code can trigger a use-after-free memory-corruption condition to elevate to higher privileges, with high confidentiality, integrity, and availability impact implying a path to SYSTEM. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch is available.
Local code execution in the Microsoft Windows NTFS driver stems from an out-of-bounds read (CWE-125) that an attacker can leverage to run arbitrary code on affected systems, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Exploitation requires local access and user interaction (AV:L/UI:R), typically opening or mounting a maliciously crafted file or volume, but no prior authentication (PR:N). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows DirectX graphics kernel subsystem allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition across Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. The CVSS 3.1 vector (7.8, AV:L/PR:L) confirms local access and low existing privileges are required with no user interaction, yielding full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Search component lets an already-authenticated low-privilege user gain SYSTEM-level rights through improper access control (CWE-284). It affects all currently supported Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Media component across Windows 10, Windows 11, and Windows Server (2016 through 2025) allows an authenticated low-privileged attacker to elevate to SYSTEM by exploiting a use-after-free memory corruption flaw. Microsoft has released patches and reports no public exploit identified at time of analysis; EPSS is low at 0.25% and CISA SSVC records exploitation status as 'none', though technical impact is rated total. Given the ubiquity of the Windows Media stack, this is a routine but broadly applicable Patch-Tuesday-class local EoP.
Local privilege elevation in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated local attacker to win a race condition and gain higher privileges on the host. The flaw is a concurrency/synchronization defect (CWE-362) reported by Microsoft itself; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is rated high-complexity because the attacker must reliably win a timing window, which tempers the otherwise high confidentiality, integrity, and availability impact.
Privilege escalation in Microsoft Windows Runtime (WinRT) lets an authenticated attacker who can reach an affected host over the network exploit a use-after-free memory corruption to gain higher privileges, with total confidentiality, integrity, and availability impact per CVSS 8.8. Affected platforms include Windows 11 (24H2, 25H2, 26H1), Windows Server 2025, and its Server Core installation. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.48%, 38th percentile), but the technical impact is rated total and a vendor patch is available.
Local privilege escalation in Microsoft Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated, low-privileged attacker win a race condition (CWE-362) over an improperly synchronized shared resource to elevate privileges. Reported by Microsoft itself, the flaw carries a CVSS 7.0 and per SSVC has total technical impact but is not automatable and shows no observed exploitation; no public exploit is identified at time of analysis. EPSS is low at 0.24% (16th percentile), consistent with the high attack complexity of reliably timing the race.
Local privilege elevation in the Windows Brokering File System (bfs.sys/brokering component) lets an authenticated low-privileged user corrupt kernel memory via a double free (CWE-415) to gain SYSTEM-level privileges on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A Microsoft-released patch is available. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Local privilege escalation in the Windows DirectX graphics component affects a broad range of Microsoft Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). An authenticated local attacker who can run code on the host triggers a heap-based buffer overflow (CWE-122) to gain SYSTEM-level privileges, achieving total confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is modest at 1.50% (71st percentile).
Elevation of privilege in Microsoft Windows (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025) allows a locally authenticated attacker to escalate to higher privileges via an improper access control weakness (CWE-284). An attacker who already holds a low-privilege foothold on the host can gain full confidentiality, integrity, and availability impact over the system. No public exploit identified at time of analysis, though the flaw was reported by Microsoft and a vendor patch is available.
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) in the handling of a shared resource allows an already-authenticated low-privileged attacker to win a timing window and elevate to higher privileges. Exploitation requires winning a non-deterministic race (AC:H) and low-level access to the target host (PR:L, AV:L), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Microsoft has published an advisory and released a patch.
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated local attacker to win a race condition and gain higher privileges. The flaw stems from improper synchronization of a shared resource (CWE-362); successful exploitation yields high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch.
Privilege elevation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server 2019-2025 allows a remote, unauthenticated attacker to win a race condition and gain elevated privileges over the network. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis, EPSS is low (0.33%, 25th percentile) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Elevation of privilege in the Windows Runtime (WinRT) component of Microsoft Windows and Windows Server allows an unauthorized network attacker to win a race condition and gain elevated privileges, achieving full compromise of confidentiality, integrity, and availability. The flaw affects a broad range of supported builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has shipped patches. There is no public exploit identified at time of analysis and CISA/SSVC records no known exploitation, though the low CVSS attack complexity of winning the race is offset by the high technical impact.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker gain SYSTEM-level control by abusing a type-confusion (CWE-843) condition, affecting a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. Successful exploitation yields total loss of confidentiality, integrity, and availability on the host, though there is no public exploit identified at time of analysis and CISA's SSVC framework rates exploitation as 'none' and non-automatable. EPSS is low (0.29%, 21st percentile), consistent with a locally-scoped bug that requires prior code execution rather than a remotely wormable threat.
Local privilege escalation in the Microsoft Windows Kernel (CVE-2026-50377) lets an already-authenticated low-privileged attacker read memory outside intended bounds and leverage it to gain SYSTEM-level rights across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released patches and rates it 7.8 (High); there is no public exploit identified at time of analysis, EPSS is low at 0.40% (32th percentile), and CISA SSVC records exploitation as none. It is a strong second-stage escalation primitive for attackers who already have a foothold, but not a remotely reachable, wormable threat.
Local code execution in Microsoft's Resilient File System (ReFS) driver lets an already-authenticated, low-privileged user on affected Windows 10, Windows 11, and Windows Server 2016–2025 systems escalate to code execution through a numeric truncation flaw (CWE-197). No public exploit has been identified at time of analysis, and it is not on CISA KEV, but Microsoft has released a patch. Note a data conflict: the description states code execution and the CVSS carries C:H/I:H/A:H, yet the vendor tags label it 'Information Disclosure' — the CVSS-backed local elevation-of-privilege reading is treated as authoritative here.
Privilege escalation via a heap-based buffer overflow (CWE-122) in the Windows Remote Desktop Client lets an unauthorized network attacker corrupt heap memory and gain total control of the target host. The flaw affects the built-in RDP client across the entire supported Windows line, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has shipped patches; there is no public exploit identified at time of analysis and it is not in CISA KEV, though CISA's SSVC assessment rates the flaw automatable with total technical impact.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged attacker to gain SYSTEM-level control by triggering a use-after-free condition in the kernel networking driver. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.31%).