Windows Server 2012
Monthly
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Tampering in Active Directory Certificate Services (AD CS) allows a low-privileged, authenticated network attacker to manipulate certificate issuance or PKI configuration by supplying inputs that bypass an incomplete deny list. Affected Windows Server versions span 2012 through 2025, as well as Windows 10 builds relying on AD CS. The CVSS vector confirms high integrity impact with no confidentiality or availability effect, consistent with the described tampering primitive. No public exploit has been identified at time of analysis, and a vendor-released patch is available.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Memory exhaustion in the Windows DHCP Server role across Windows Server 2012 through 2025 allows a low-privileged network-authenticated attacker to crash or render the DHCP service unresponsive, denying IP address assignment to all network clients. The root cause (CWE-401) is a failure to release allocated memory after its effective lifetime during DHCP request processing, enabling gradual heap exhaustion. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Memory exhaustion in Windows DHCP Server enables an authorized attacker on the adjacent network to crash or degrade the DHCP service via repeated triggering of a CWE-401 memory leak. The vulnerability affects the Windows Server DHCP Server role across Windows Server 2012 through 2025, including Server Core installations. Exploitation requires low-privilege adjacency and results exclusively in availability loss - no confidentiality or integrity impact. No public exploit identified at time of analysis; vendor patch is available.
Format string exploitation in Microsoft Active Directory Certificate Services (AD CS) allows a low-privileged authenticated attacker to disclose sensitive information over the network. The flaw (CWE-134) arises from externally-controlled format string input reaching a format function without sanitization, potentially exposing memory contents including PKI-sensitive data. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Windows PowerShell (CWE-22) enables network-based security feature bypass across virtually all supported Windows releases, from Server 2012 through Windows Server 2025 and Windows 11 26H2. The flaw allows an unauthenticated remote attacker - contingent on user interaction - to write files outside a restricted directory, circumventing a Windows security boundary with high integrity impact and no direct confidentiality or availability consequence. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the broad affected surface across all major Windows versions warrants prompt patching.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged, authenticated network attacker to crash the service and deny domain authentication. The flaw affects a broad range of Windows Server versions from Windows Server 2012 through Windows Server 2025 as well as Windows 10 and Windows 11 client platforms configured with the AD DS role. Microsoft has issued patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Integer underflow in the Windows DHCP Server service exposes adjacent-network unauthenticated attackers to high-confidentiality memory disclosure across a broad range of Windows Server releases from 2012 through 2025, plus Windows 10 1607 and 1809. The root cause (CWE-125 out-of-bounds read triggered by arithmetic underflow) allows a crafted DHCP packet to cause the server to read and return memory beyond the intended buffer boundary. No active exploitation is confirmed (not in CISA KEV) and SSVC rates exploitation status as none; a vendor patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Information disclosure in the Windows NTFS filesystem driver allows a local low-privileged attacker to read beyond buffer boundaries and expose sensitive memory contents. Affecting virtually every supported Windows desktop and server release - from Windows 10 1607 through Windows Server 2025 and Windows 11 26H1 - the vulnerability requires only a standard local user account and no special configuration, making it a realistic threat in multi-tenant, shared, or cloud environments where local access is granted to semi-trusted users. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.
Windows DNS Server on a broad range of Windows and Windows Server editions contains a heap-based buffer overflow rooted in a numeric truncation error, enabling an authorized local attacker with high-privilege access to escalate privileges on the affected system. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions, with Microsoft confirming full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation status as none and automatable as no, and Microsoft has released patches addressed in the MSRC advisory.
Authentication bypass in Windows Schannel allows a network-based attacker to circumvent cryptographic signature validation, achieving high-integrity impact without requiring prior privileges. Schannel, Microsoft's TLS/SSL security provider, fails to properly verify cryptographic signatures - tagged as a JWT attack vector - enabling forged or malformed tokens to pass validation and bypass security feature enforcement. No active exploitation is confirmed (SSVC: exploitation=none; not listed in CISA KEV), and the high attack complexity and required user interaction constrain opportunistic mass exploitation despite the broad Windows version footprint.
Tampering via partial string comparison in the Windows HTTP Protocol Stack (http.sys) exposes a broad range of Windows client and server editions to integrity compromise by unauthenticated adjacent-network attackers. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, with Microsoft tagging the issue as an authentication bypass rooted in CWE-187. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines.
Information disclosure in Windows Win32K affects a broad range of Microsoft Windows client and server operating systems, from Windows Server 2012 through Windows 11 26H1 and Server 2025. A locally authenticated low-privilege user can trigger a buffer over-read (CWE-126) in the Win32K kernel-mode subsystem, causing the kernel to return out-of-bounds memory contents to user space. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, though the kernel information disclosure primitive carries chaining risk for privilege escalation.
Integer underflow (CWE-125) in the Windows DHCP Server service exposes server memory contents to unauthenticated attackers positioned on the same adjacent network segment. Affecting Windows Server versions from 2012 through 2025 (confirmed by ENISA EUVD-2026-56370), the flaw allows crafted DHCP packets to trigger an out-of-bounds read, resulting in high-confidence confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact - a vendor patch is available via Microsoft MSRC.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory contents to a locally authenticated low-privilege attacker across a wide swath of Windows desktop and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. The impact is strictly information disclosure - high confidentiality loss with no integrity or availability effect - making this most practically useful as a KASLR-bypass building block in a multi-stage local privilege escalation chain. No public exploit or active exploitation has been identified; SSVC classifies exploitation status as none and technical impact as partial.
Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.
Windows Imaging Component (WIC) across a broad span of Windows 10, Windows 11, and Windows Server releases contains an uninitialized memory read flaw (CWE-908) that an authorized local user with low privileges can exploit to disclose sensitive information from process memory. The CVSS vector (AV:L/PR:L/C:H/I:N/A:N) confirms this is strictly a local, low-privilege information disclosure with no network attack surface and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; a vendor-released patch is confirmed via the Microsoft MSRC advisory.
Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.
Windows Wired AutoConfig Service (dot3svc) exposes a buffer over-read (CWE-126) that allows a locally authenticated, low-privileged attacker to read beyond allocated memory boundaries and disclose potentially sensitive information from adjacent memory. Affected scope spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface broad despite the local-only attack vector. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, placing this squarely in the routine patching tier rather than emergency response.
Information disclosure in Windows DHCP Server across six major Windows Server generations exposes heap or stack memory contents to unauthenticated adjacent-network attackers via an integer underflow defect. The vulnerability affects all Windows Server editions from 2012 through 2025 that have the DHCP Server role installed and running, with exploitation constrained to Layer 2 adjacency rather than the open internet. A vendor-released patch is available from Microsoft MSRC; no public exploit code has been identified at time of analysis.
Information disclosure via integer underflow in the Windows DHCP Server service exposes server process memory to unauthenticated attackers on the same network segment, affecting Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the DHCP Server role is installed. The root cause is a CWE-125 out-of-bounds read triggered when an integer underflows and wraps around, causing DHCP packet-processing code to read memory outside intended bounds and potentially return it in a server response. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with partial technical impact, indicating contained but real risk requiring timely patching.
Integer underflow (CWE-125, out-of-bounds read) in the Windows DHCP Server service allows an unauthenticated attacker on an adjacent network segment to disclose sensitive memory contents. Affected systems span Windows Server 2012 through 2025 and certain Windows 10 builds running the DHCP Server role. No public exploit has been identified at time of analysis, and a vendor patch is available via Microsoft's July 2026 update cycle.
Out-of-bounds memory read in the Windows DHCP Server service exposes sensitive server memory to unauthenticated attackers on the adjacent network. The root cause is an integer underflow (CWE-125) in DHCP packet processing, where a miscalculated length or index wraps around, causing the service to read and potentially return memory beyond intended buffer boundaries. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Windows Server versions via the August 2026 Patch Tuesday cycle.
Information disclosure in the Windows DHCP Server service allows unauthenticated attackers on adjacent network segments to read out-of-bounds server memory via a malformed DHCP request that triggers an integer underflow. Affected builds span Windows Server 2012 through Windows Server 2025, as well as Windows 10 versions 1607 and 1809, making the version footprint unusually wide for a single service-role flaw. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as none with non-automatable characteristics, though the high confidentiality impact and the breadth of affected builds warrant prompt patching.
Windows GDI+ (Graphics Device Interface Plus) exposes uninitialized memory contents to local low-privileged attackers across a broad range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1. The root cause is CWE-908 (use of uninitialized resource), where a graphics operation returns memory that has not been zeroed or populated, potentially leaking sensitive in-memory data. No active exploitation is confirmed and CISA SSVC rates exploitation as none; however, the wide affected surface and high confidentiality impact make this a priority patch in shared-access environments such as RDP or VDI deployments.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) enables kernel-level code execution through physical insertion of maliciously crafted UDF media, affecting every supported Windows client and server release from Server 2012 through Windows 11 26H1. The physical attack vector (AV:P) is the dominant risk constraint - a vendor patch is available from Microsoft and the vulnerability is not listed in CISA KEV. No public exploit has been identified at time of analysis, though the breadth of affected builds and the kernel execution context make this high priority in environments where physical access is not strictly controlled.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Tampering in Active Directory Certificate Services (AD CS) allows a low-privileged, authenticated network attacker to manipulate certificate issuance or PKI configuration by supplying inputs that bypass an incomplete deny list. Affected Windows Server versions span 2012 through 2025, as well as Windows 10 builds relying on AD CS. The CVSS vector confirms high integrity impact with no confidentiality or availability effect, consistent with the described tampering primitive. No public exploit has been identified at time of analysis, and a vendor-released patch is available.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Memory exhaustion in the Windows DHCP Server role across Windows Server 2012 through 2025 allows a low-privileged network-authenticated attacker to crash or render the DHCP service unresponsive, denying IP address assignment to all network clients. The root cause (CWE-401) is a failure to release allocated memory after its effective lifetime during DHCP request processing, enabling gradual heap exhaustion. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Memory exhaustion in Windows DHCP Server enables an authorized attacker on the adjacent network to crash or degrade the DHCP service via repeated triggering of a CWE-401 memory leak. The vulnerability affects the Windows Server DHCP Server role across Windows Server 2012 through 2025, including Server Core installations. Exploitation requires low-privilege adjacency and results exclusively in availability loss - no confidentiality or integrity impact. No public exploit identified at time of analysis; vendor patch is available.
Format string exploitation in Microsoft Active Directory Certificate Services (AD CS) allows a low-privileged authenticated attacker to disclose sensitive information over the network. The flaw (CWE-134) arises from externally-controlled format string input reaching a format function without sanitization, potentially exposing memory contents including PKI-sensitive data. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Windows PowerShell (CWE-22) enables network-based security feature bypass across virtually all supported Windows releases, from Server 2012 through Windows Server 2025 and Windows 11 26H2. The flaw allows an unauthenticated remote attacker - contingent on user interaction - to write files outside a restricted directory, circumventing a Windows security boundary with high integrity impact and no direct confidentiality or availability consequence. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the broad affected surface across all major Windows versions warrants prompt patching.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged, authenticated network attacker to crash the service and deny domain authentication. The flaw affects a broad range of Windows Server versions from Windows Server 2012 through Windows Server 2025 as well as Windows 10 and Windows 11 client platforms configured with the AD DS role. Microsoft has issued patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Privilege escalation in Windows DNS across a wide range of Windows 10, Windows 11, and Windows Server releases exploits a numeric truncation error (CWE-122, heap-based buffer overflow) to allow an authorized local attacker with high privileges to fully compromise the vulnerable system. Affected builds span from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, with vendor-supplied patches now available from Microsoft MSRC. SSVC assessment confirms no current exploitation activity and the vulnerability is not automatable, though technical impact is rated total across confidentiality, integrity, and availability.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Integer underflow in the Windows DHCP Server service exposes adjacent-network unauthenticated attackers to high-confidentiality memory disclosure across a broad range of Windows Server releases from 2012 through 2025, plus Windows 10 1607 and 1809. The root cause (CWE-125 out-of-bounds read triggered by arithmetic underflow) allows a crafted DHCP packet to cause the server to read and return memory beyond the intended buffer boundary. No active exploitation is confirmed (not in CISA KEV) and SSVC rates exploitation status as none; a vendor patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Information disclosure in the Windows NTFS filesystem driver allows a local low-privileged attacker to read beyond buffer boundaries and expose sensitive memory contents. Affecting virtually every supported Windows desktop and server release - from Windows 10 1607 through Windows Server 2025 and Windows 11 26H1 - the vulnerability requires only a standard local user account and no special configuration, making it a realistic threat in multi-tenant, shared, or cloud environments where local access is granted to semi-trusted users. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.
Windows DNS Server on a broad range of Windows and Windows Server editions contains a heap-based buffer overflow rooted in a numeric truncation error, enabling an authorized local attacker with high-privilege access to escalate privileges on the affected system. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions, with Microsoft confirming full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation status as none and automatable as no, and Microsoft has released patches addressed in the MSRC advisory.
Authentication bypass in Windows Schannel allows a network-based attacker to circumvent cryptographic signature validation, achieving high-integrity impact without requiring prior privileges. Schannel, Microsoft's TLS/SSL security provider, fails to properly verify cryptographic signatures - tagged as a JWT attack vector - enabling forged or malformed tokens to pass validation and bypass security feature enforcement. No active exploitation is confirmed (SSVC: exploitation=none; not listed in CISA KEV), and the high attack complexity and required user interaction constrain opportunistic mass exploitation despite the broad Windows version footprint.
Tampering via partial string comparison in the Windows HTTP Protocol Stack (http.sys) exposes a broad range of Windows client and server editions to integrity compromise by unauthenticated adjacent-network attackers. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, with Microsoft tagging the issue as an authentication bypass rooted in CWE-187. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines.
Information disclosure in Windows Win32K affects a broad range of Microsoft Windows client and server operating systems, from Windows Server 2012 through Windows 11 26H1 and Server 2025. A locally authenticated low-privilege user can trigger a buffer over-read (CWE-126) in the Win32K kernel-mode subsystem, causing the kernel to return out-of-bounds memory contents to user space. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, though the kernel information disclosure primitive carries chaining risk for privilege escalation.
Integer underflow (CWE-125) in the Windows DHCP Server service exposes server memory contents to unauthenticated attackers positioned on the same adjacent network segment. Affecting Windows Server versions from 2012 through 2025 (confirmed by ENISA EUVD-2026-56370), the flaw allows crafted DHCP packets to trigger an out-of-bounds read, resulting in high-confidence confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact - a vendor patch is available via Microsoft MSRC.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory contents to a locally authenticated low-privilege attacker across a wide swath of Windows desktop and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. The impact is strictly information disclosure - high confidentiality loss with no integrity or availability effect - making this most practically useful as a KASLR-bypass building block in a multi-stage local privilege escalation chain. No public exploit or active exploitation has been identified; SSVC classifies exploitation status as none and technical impact as partial.
Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.
Windows Imaging Component (WIC) across a broad span of Windows 10, Windows 11, and Windows Server releases contains an uninitialized memory read flaw (CWE-908) that an authorized local user with low privileges can exploit to disclose sensitive information from process memory. The CVSS vector (AV:L/PR:L/C:H/I:N/A:N) confirms this is strictly a local, low-privilege information disclosure with no network attack surface and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; a vendor-released patch is confirmed via the Microsoft MSRC advisory.
Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.
Windows Wired AutoConfig Service (dot3svc) exposes a buffer over-read (CWE-126) that allows a locally authenticated, low-privileged attacker to read beyond allocated memory boundaries and disclose potentially sensitive information from adjacent memory. Affected scope spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface broad despite the local-only attack vector. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, placing this squarely in the routine patching tier rather than emergency response.
Information disclosure in Windows DHCP Server across six major Windows Server generations exposes heap or stack memory contents to unauthenticated adjacent-network attackers via an integer underflow defect. The vulnerability affects all Windows Server editions from 2012 through 2025 that have the DHCP Server role installed and running, with exploitation constrained to Layer 2 adjacency rather than the open internet. A vendor-released patch is available from Microsoft MSRC; no public exploit code has been identified at time of analysis.
Information disclosure via integer underflow in the Windows DHCP Server service exposes server process memory to unauthenticated attackers on the same network segment, affecting Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the DHCP Server role is installed. The root cause is a CWE-125 out-of-bounds read triggered when an integer underflows and wraps around, causing DHCP packet-processing code to read memory outside intended bounds and potentially return it in a server response. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with partial technical impact, indicating contained but real risk requiring timely patching.
Integer underflow (CWE-125, out-of-bounds read) in the Windows DHCP Server service allows an unauthenticated attacker on an adjacent network segment to disclose sensitive memory contents. Affected systems span Windows Server 2012 through 2025 and certain Windows 10 builds running the DHCP Server role. No public exploit has been identified at time of analysis, and a vendor patch is available via Microsoft's July 2026 update cycle.
Out-of-bounds memory read in the Windows DHCP Server service exposes sensitive server memory to unauthenticated attackers on the adjacent network. The root cause is an integer underflow (CWE-125) in DHCP packet processing, where a miscalculated length or index wraps around, causing the service to read and potentially return memory beyond intended buffer boundaries. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Windows Server versions via the August 2026 Patch Tuesday cycle.
Information disclosure in the Windows DHCP Server service allows unauthenticated attackers on adjacent network segments to read out-of-bounds server memory via a malformed DHCP request that triggers an integer underflow. Affected builds span Windows Server 2012 through Windows Server 2025, as well as Windows 10 versions 1607 and 1809, making the version footprint unusually wide for a single service-role flaw. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as none with non-automatable characteristics, though the high confidentiality impact and the breadth of affected builds warrant prompt patching.
Windows GDI+ (Graphics Device Interface Plus) exposes uninitialized memory contents to local low-privileged attackers across a broad range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1. The root cause is CWE-908 (use of uninitialized resource), where a graphics operation returns memory that has not been zeroed or populated, potentially leaking sensitive in-memory data. No active exploitation is confirmed and CISA SSVC rates exploitation as none; however, the wide affected surface and high confidentiality impact make this a priority patch in shared-access environments such as RDP or VDI deployments.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) enables kernel-level code execution through physical insertion of maliciously crafted UDF media, affecting every supported Windows client and server release from Server 2012 through Windows 11 26H1. The physical attack vector (AV:P) is the dominant risk constraint - a vendor patch is available from Microsoft and the vulnerability is not listed in CISA KEV. No public exploit has been identified at time of analysis, though the breadth of affected builds and the kernel execution context make this high priority in environments where physical access is not strictly controlled.