Windows Server 2012

Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.

Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.

Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.

Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.

Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.

Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.

Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.

Remote unauthenticated denial of service in Windows Network File System (NFS) allows a network attacker to crash the NFS service by sending a malformed packet that triggers a buffer over-read (CWE-126). Affected systems span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog; Microsoft has released patches across all affected build lines.

Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.

Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.

Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.

Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.

Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.

Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.

Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.

Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.

Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.

Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.

Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.

Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.

Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.

Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.

Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.

Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.

Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.

Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.

Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.

Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.

Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.

Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.

Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.

Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.

Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.

Stack-based buffer overflow in Microsoft's Remote Desktop Client (mstsc.exe) enables remote code execution on unpatched Windows 10 1607 and Windows Server 2012/2016 systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no attacker privileges, but demands that a victim actively connect to an attacker-controlled RDP server - a meaningful but achievable social-engineering hurdle. Microsoft has released patches for all affected version branches; no public exploit identified at time of analysis.

Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.

Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.

Remote code execution in Microsoft Active Directory Certificate Services (AD CS) is achievable by low-privileged authenticated network attackers through a use-after-free (CWE-416) memory corruption flaw. All supported Windows Server versions from 2012 through 2025 are affected, along with Windows 10 versions 1607 and 1809. Microsoft has released patches via the MSRC update guide; no public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version coverage make this a high-priority remediation item.

Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.

Integer underflow in the Windows DHCP Server service exposes adjacent-network unauthenticated attackers to high-confidentiality memory disclosure across a broad range of Windows Server releases from 2012 through 2025, plus Windows 10 1607 and 1809. The root cause (CWE-125 out-of-bounds read triggered by arithmetic underflow) allows a crafted DHCP packet to cause the server to read and return memory beyond the intended buffer boundary. No active exploitation is confirmed (not in CISA KEV) and SSVC rates exploitation status as none; a vendor patch is available via the Microsoft Security Response Center.

Local privilege escalation in Windows DHCP Server affects all major Windows Server releases from 2012 through 2025, as well as Windows 10 versions 1607 and 1809. An authorized low-privileged local attacker can exploit a symlink-following flaw (CWE-59) during DHCP Server file access operations to gain full control (C:H/I:H/A:H) over the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.

Local privilege escalation in the Windows DHCP Server service allows a low-privileged authenticated attacker to fully compromise system confidentiality, integrity, and availability through improper symbolic link handling (CWE-59). Affected deployments span Windows Server 2012 through 2025 and Windows 10 1607/1809. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across enterprise server infrastructure make this a credible post-access escalation path.

Privilege escalation in Windows DHCP Server exploits improper symbolic link resolution (CWE-59), allowing an authenticated local attacker with low privileges to fully compromise system confidentiality, integrity, and availability. The flaw affects Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is active. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and no user interaction requirement make this a credible post-compromise escalation path.

Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.

Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.

Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.

Information disclosure in the Windows NTFS filesystem driver allows a local low-privileged attacker to read beyond buffer boundaries and expose sensitive memory contents. Affecting virtually every supported Windows desktop and server release - from Windows 10 1607 through Windows Server 2025 and Windows 11 26H1 - the vulnerability requires only a standard local user account and no special configuration, making it a realistic threat in multi-tenant, shared, or cloud environments where local access is granted to semi-trusted users. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected product lines.

Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.

Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.

Remote code execution via use-after-free in the Windows DNS service allows an authenticated, network-based attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025 and is exploitable over the network, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit identified at time of analysis; vendor-released patches with specific build targets are available via the Microsoft Security Response Center.

Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.

Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.

Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.

Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.

Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.

Privilege escalation in Windows DHCP Server allows a locally authenticated attacker to gain SYSTEM-level privileges by exploiting a symlink/link-following flaw (CWE-59). Affected products span Windows Server 2012 through Windows Server 2025 and Windows 10 (1607/1809), all receiving patches in this advisory cycle. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and broad version coverage make this a meaningful patching priority for any Windows Server environment running the DHCP Server role.

Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.

Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Windows DNS Server on a broad range of Windows and Windows Server editions contains a heap-based buffer overflow rooted in a numeric truncation error, enabling an authorized local attacker with high-privilege access to escalate privileges on the affected system. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions, with Microsoft confirming full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation status as none and automatable as no, and Microsoft has released patches addressed in the MSRC advisory.

Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.

Local privilege escalation in Windows DHCP Server exploits improper symbolic link resolution (CWE-59), allowing a low-privileged authenticated local user to gain full SYSTEM-level access across a wide range of Windows Server versions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires no interaction and only low-level local access, making this a practical post-exploitation escalation tool once an attacker has any foothold on a DHCP Server host. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.

Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.

Authentication bypass in Windows Schannel allows a network-based attacker to circumvent cryptographic signature validation, achieving high-integrity impact without requiring prior privileges. Schannel, Microsoft's TLS/SSL security provider, fails to properly verify cryptographic signatures - tagged as a JWT attack vector - enabling forged or malformed tokens to pass validation and bypass security feature enforcement. No active exploitation is confirmed (SSVC: exploitation=none; not listed in CISA KEV), and the high attack complexity and required user interaction constrain opportunistic mass exploitation despite the broad Windows version footprint.

Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.

Heap-based buffer overflow in the Windows Kerberos authentication subsystem enables a locally authenticated attacker to elevate privileges to SYSTEM-level access across a broad range of Windows client and server releases. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact upon successful exploitation with low attack complexity once local access is established. Microsoft has released patches per MSRC advisory CVE-2026-62754; no public exploit code has been identified and the vulnerability has not appeared in the CISA KEV catalog at time of analysis.

Heap-based buffer overflow in Windows HTTP.sys enables a locally authenticated, low-privileged attacker to escalate privileges on the affected host, likely achieving SYSTEM-level control. The flaw spans a wide range of Windows versions from Server 2012 through Windows 11 26H1, representing substantial enterprise exposure despite requiring initial local access. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines via the MSRC advisory.

Privilege escalation via heap-based buffer overflow in Windows Kerberos affects the full breadth of supported Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025. An attacker holding a valid low-privilege local account can trigger a heap corruption condition in the Kerberos implementation to achieve complete confidentiality, integrity, and availability impact on the compromised host - effectively gaining SYSTEM-level control. Vendor-released patches with exact fixed build numbers are available via Microsoft MSRC; no public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis.

Tampering via partial string comparison in the Windows HTTP Protocol Stack (http.sys) exposes a broad range of Windows client and server editions to integrity compromise by unauthenticated adjacent-network attackers. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, with Microsoft tagging the issue as an authentication bypass rooted in CWE-187. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines.

Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.

Information disclosure in Windows Win32K affects a broad range of Microsoft Windows client and server operating systems, from Windows Server 2012 through Windows 11 26H1 and Server 2025. A locally authenticated low-privilege user can trigger a buffer over-read (CWE-126) in the Win32K kernel-mode subsystem, causing the kernel to return out-of-bounds memory contents to user space. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, though the kernel information disclosure primitive carries chaining risk for privilege escalation.

Integer underflow (CWE-125) in the Windows DHCP Server service exposes server memory contents to unauthenticated attackers positioned on the same adjacent network segment. Affecting Windows Server versions from 2012 through 2025 (confirmed by ENISA EUVD-2026-56370), the flaw allows crafted DHCP packets to trigger an out-of-bounds read, resulting in high-confidence confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact - a vendor patch is available via Microsoft MSRC.

Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory contents to a locally authenticated low-privilege attacker across a wide swath of Windows desktop and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. The impact is strictly information disclosure - high confidentiality loss with no integrity or availability effect - making this most practically useful as a KASLR-bypass building block in a multi-stage local privilege escalation chain. No public exploit or active exploitation has been identified; SSVC classifies exploitation status as none and technical impact as partial.

Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.

Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.

Windows Imaging Component (WIC) across a broad span of Windows 10, Windows 11, and Windows Server releases contains an uninitialized memory read flaw (CWE-908) that an authorized local user with low privileges can exploit to disclose sensitive information from process memory. The CVSS vector (AV:L/PR:L/C:H/I:N/A:N) confirms this is strictly a local, low-privilege information disclosure with no network attack surface and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; a vendor-released patch is confirmed via the Microsoft MSRC advisory.

Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.

Privilege escalation via heap-based buffer overflow in Windows HTTP.sys (a kernel-mode HTTP listener driver) allows a locally authenticated low-privilege attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local authenticated access with no user interaction and low attack complexity, making this a practical post-compromise escalation primitive. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected product lines.

Local privilege escalation via race condition in Windows Telephony Service affects a sweeping range of Microsoft Windows client and server editions, from Server 2012 through Windows 11 26H1. An authorized local attacker with low-privileged access can exploit improper synchronization over a shared resource to elevate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the breadth of affected Windows versions across enterprise environments makes unpatched exposure a meaningful operational risk.

Privilege escalation via an out-of-bounds read in the Windows Win32K kernel subsystem allows a local authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server versions. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects a low-complexity local attack with full C/I/A impact, meaning any low-privileged user or compromised process can exploit this to completely own the host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the 19 affected Windows SKUs spanning Server 2012 through Windows 11 26H1 make this a high-priority patch cycle item - particularly for Remote Desktop and terminal server deployments where untrusted local sessions are common.

Privilege escalation via heap-based buffer overflow in Windows Telephony Service (TAPI) affects virtually all supported Windows client and server builds, from legacy Server 2012 through current Windows 11 25H2 and Server 2025. An authorized local user with standard low-privilege credentials can trigger the heap overflow in tapisrv to achieve SYSTEM-level access. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patches are available across all 19 affected product SKUs per MSRC.

Windows Wired AutoConfig Service (dot3svc) exposes a buffer over-read (CWE-126) that allows a locally authenticated, low-privileged attacker to read beyond allocated memory boundaries and disclose potentially sensitive information from adjacent memory. Affected scope spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface broad despite the local-only attack vector. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, placing this squarely in the routine patching tier rather than emergency response.

Privilege escalation in Windows Telephony Service affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized local attacker exploits an improper synchronization flaw (CWE-362) in shared resource access within the telephony subsystem to elevate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability impact. Microsoft has released patched builds; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.

Privilege escalation via a time-of-check time-of-use (TOCTOU) race condition in the Windows Common Log File System (CLFS) Driver affects a broad range of Windows client and server versions from Server 2012 through Windows 11 25H2/26H1. A low-privileged local attacker can exploit the race window to gain SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available from Microsoft via the MSRC update guide.

Privilege escalation in Windows Telephony Service (TAPI) via a use-after-free memory corruption flaw enables a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected hosts. The vulnerability spans a broad range of Microsoft Windows versions from Server 2012 through Windows 11 26H1 and multiple Windows Server 2022/2025 builds, confirmed by Microsoft MSRC and catalogued under EUVD-2026-56640. No public exploit code or active exploitation has been identified at time of analysis, though the pervasive Windows deployment footprint makes patch deployment a meaningful operational priority.