Windows Server 2012
Monthly
Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Windows Installer Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Win32k Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX controls in Office documents, exploited as a zero-day in targeted attacks before the September 2021 patch.
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows LSA Spoofing Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Scripting Engine Memory Corruption Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Windows MSHTML Platform Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Windows Kernel Local Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A spoofing vulnerability exists when Windows incorrectly validates file signatures. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX. Rated critical severity (CVSS 9.0), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to SYSTEM-level access by exploiting an out-of-bounds write triggered through the DrawIconEx API. Confirmed actively exploited (CISA KEV) with a publicly available proof-of-concept on Packet Storm, this flaw affects a sweeping range of Windows versions from Windows 7 through Windows 10 1909 and the full Windows Server ecosystem through 2019. The EPSS score of 52.78% at the 99th percentile aligns with documented real-world exploitation and places this well above typical local privilege escalation vulnerabilities in urgency.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system compromise through crafted web pages, exploited in the wild as a zero-day before the May 2018 patch.
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary code via malicious RTF or Office documents exploiting Windows API object linking. Confirmed actively exploited (CISA KEV) with EPSS score of 94.33% indicating near-certain real-world exploitation probability. Multiple public exploit codes available including weaponized RTF generators. Despite local attack vector classification (AV:L), exploitation occurs remotely through email/web delivery of crafted documents requiring only user interaction to open the file.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited alongside CVE-2016-7256 in targeted attacks attributed to the Strontium (APT28/Fancy Bear) group.
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 26.1%.
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 58.3%.
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 59.1%.
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 73.0%.
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 39.8%.
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 17.6%.
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.1%.
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 38.2%.
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.1%.
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 27.2%.
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 17.6%.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).
Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Windows Installer Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Win32k Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX controls in Office documents, exploited as a zero-day in targeted attacks before the September 2021 patch.
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows LSA Spoofing Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Scripting Engine Memory Corruption Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Windows MSHTML Platform Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Windows Kernel Local Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A spoofing vulnerability exists when Windows incorrectly validates file signatures. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX. Rated critical severity (CVSS 9.0), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to SYSTEM-level access by exploiting an out-of-bounds write triggered through the DrawIconEx API. Confirmed actively exploited (CISA KEV) with a publicly available proof-of-concept on Packet Storm, this flaw affects a sweeping range of Windows versions from Windows 7 through Windows 10 1909 and the full Windows Server ecosystem through 2019. The EPSS score of 52.78% at the 99th percentile aligns with documented real-world exploitation and places this well above typical local privilege escalation vulnerabilities in urgency.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system compromise through crafted web pages, exploited in the wild as a zero-day before the May 2018 patch.
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary code via malicious RTF or Office documents exploiting Windows API object linking. Confirmed actively exploited (CISA KEV) with EPSS score of 94.33% indicating near-certain real-world exploitation probability. Multiple public exploit codes available including weaponized RTF generators. Despite local attack vector classification (AV:L), exploitation occurs remotely through email/web delivery of crafted documents requiring only user interaction to open the file.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited alongside CVE-2016-7256 in targeted attacks attributed to the Strontium (APT28/Fancy Bear) group.
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 26.1%.
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 58.3%.
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 59.1%.
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 73.0%.
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 39.8%.
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 17.6%.
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.1%.
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 38.2%.
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.1%.
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 27.2%.
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 17.6%.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).