Windows Server 2012
Monthly
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Windows Shell's link-resolution logic fails to safely handle symbolic or hard links before granting file access, enabling a remote unauthenticated attacker to perform network-based spoofing against a victim who interacts with a crafted payload. The flaw (CWE-59) spans the full current Windows ecosystem - from Server 2012 R2 through Windows 11 26H2 and Server 2025 - and can yield both confidentiality and integrity compromise (C:H/I:H). No public exploit or CISA KEV listing has been identified at time of analysis, but user interaction (UI:R) is the sole barrier to exploitation.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Remote code execution in the Windows DNS Server component allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing. The CWE-362 flaw affects every actively supported Windows Server release from Server 2012 through Server 2025, with full confidentiality, integrity, and availability impact if exploited. No active exploitation or public proof-of-concept has been identified, and the CVSS AC:H rating reflects that reliable exploitation requires precise race-condition timing against a production DNS service.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated attacker to achieve full SYSTEM-level code execution via a time-of-check time-of-use (TOCTOU) race condition in the kernel graphics subsystem. The vulnerability spans an exceptionally broad range of Microsoft Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all current servicing branches - making patch deployment a significant operational undertaking. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically favored as second-stage payloads in multi-stage attack chains following initial remote compromise.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Privilege escalation in the Windows TCP/IP stack lets an attacker who already holds low-privileged authorized access on a reachable host trigger a kernel use-after-free and elevate to SYSTEM, with full compromise of confidentiality, integrity, and availability on the affected machine. The flaw affects a very broad install base - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - but exploitation is constrained by high attack complexity, since the attacker must reliably win a memory reclamation race in kernel space; Microsoft has shipped fixes and there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and no public exploit identified at time of analysis. EPSS is low at 0.52% (43rd percentile), so this is best handled as a routine but high-priority patch-cycle item rather than an emergency.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DNS Server role (across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free that an unauthenticated attacker can trigger over the network, per CVSS PR:N/UI:N. Microsoft rates it 9.8 (critical) with full confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Elevation of privilege in Windows Group Policy allows an attacker who already holds valid low-privilege credentials on a network-reachable machine to run code at high integrity/SYSTEM level by inducing an untrusted pointer dereference in the policy-processing component. Unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 (including Server Core installations) builds are affected, with builds below the fixed revision for each product line remaining exposed. Exploitation is unconfirmed: no public exploit code and no KEV listing exist, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.70% (51st percentile) - this is a genuinely serious but not top-tier-urgent issue, with the low-privilege authentication prerequisite (PR:L, AV:N) as the principal limiting factor.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation on unpatched Windows hosts is achievable by a network-positioned attacker who already holds low-privilege credentials, exploiting a stack-based buffer overflow (CWE-121) in the Windows Device Association Service; with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the primitive yields high confidentiality, integrity, and availability impact with no user interaction, though it is a post-foothold escalation rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and EPSS is modest at 0.85% (56th percentile), so this is a genuine patch-priority item rather than an emergency. Microsoft has published vendor patches for every affected Windows 10, Windows 11, and Windows Server build, making remediation a straightforward monthly-update action.
Remote code execution in the Windows Key Distribution Center (KDC) - the Kerberos authentication service running on every Active Directory domain controller - allows a low-privileged authenticated network attacker to execute arbitrary code via a use-after-free memory corruption flaw (CWE-416). Every currently-supported Windows Server release from Server 2012 through Server 2025 is affected, spanning the full breadth of enterprise Active Directory infrastructure. Microsoft has released patches with exact build-level thresholds per platform; no public exploit code and no CISA KEV listing are identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Privilege escalation in the Windows Win32K kernel component allows an attacker who already holds low-privileged execution on a target host (PR:L) to corrupt kernel memory and escalate to SYSTEM-level privileges. Microsoft rates the flaw CVSS 7.5 (HIGH) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, although our assessment reads the practical attack vector as local (AV:L); in either reading the precondition is existing code execution on the box, making this a post-compromise escalation primitive rather than a remotely reachable entry point, and the high attack complexity means a race condition or specific heap/object state must be won reliably. Affected are unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 builds below the fixed build numbers published by Microsoft; there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.44% (37th percentile), so near-term exploitation risk is driven by targeted, post-access actors rather than mass scanning.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Privilege escalation on unpatched Windows 10, Windows 11, and Windows Server systems is possible through a heap-based buffer overflow in the Encrypting File System (EFS), which a low-privileged authenticated account can reach over the network to gain SYSTEM-level code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), implying a race condition or precise heap grooming rather than a deterministic one-shot trigger, and no user interaction is required. There is no evidence of active exploitation and no public exploit identified at time of analysis; CISA SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is a low 0.57% (45th percentile) despite the total technical impact score. Microsoft has released fixes, so the residual risk is concentrated on systems that remain unpatched.
Privilege escalation via integer underflow in Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged user to gain SYSTEM-level access across virtually the entire Windows ecosystem. The flaw spans Windows Server 2012 through Windows 11 26H1 and Server 2025, making it a broad-surface local elevation-of-privilege issue. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. Successful cache poisoning yields full confidentiality, integrity, and availability impact - enabling credential interception, traffic redirection, and service disruption for any client relying on the compromised resolver. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated user to gain SYSTEM-level access via an out-of-bounds read in the kernel graphics subsystem. The flaw spans a remarkably wide surface - Windows Server 2012 through Server 2025 and every current Windows 10/11 feature release - making it broadly relevant across enterprise patch cycles. Microsoft has released per-version updates; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Elevation of privilege in the Windows exFAT file-system driver allows an attacker who already holds low-privileged access to hand the kernel a malformed exFAT structure, triggering an out-of-bounds read (CWE-125) that can corrupt memory and yield SYSTEM-level execution (Microsoft CVSS 3.1 base 8.8; vector requires authenticated access, PR:L, with no user interaction). Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025, i.e. essentially the entire supported Windows fleet, which makes the low exploit-probability signal the main moderating factor. No public exploit code has been identified at time of analysis, EPSS is 0.77% (53rd percentile), and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total; a vendor patch is available. Note a vector discrepancy: Microsoft rates this AV:N ('over a network'), whereas independent assessment places it AV:L, since triggering requires a system to process attacker-controlled exFAT data and remote reachability for a file-system parsing bug is unverified.
Use-after-free in the Windows Image Acquisition (WIA) subsystem enables an authorized local attacker to escalate privileges on every supported Windows release, from Server 2012 to Windows 11 26H1. The CVSS vector (AV:L/AC:H/PR:L) places exploitation difficulty above average - a low-privileged user must trigger a race condition or specific memory-reuse timing within the WIA service - but a successful exploit yields full C:H/I:H/A:H impact, effectively granting SYSTEM-level control. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Remote code execution in Microsoft's Routing and Remote Access Service (RRAS) lets a network-positioned attacker with no credentials (PR:N) and no user interaction (UI:N) execute code with high impact to confidentiality, integrity and availability on affected Windows hosts by triggering a use-after-free (CWE-416) in the service. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 including Server Core installations, but the flaw is only reachable where an administrator has installed and enabled the RRAS role - it is not enabled by default, concentrating real exposure on routing, RAS/dial-up and VPN servers that are network-reachable. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' (and non-automatable), and EPSS is low at 0.42% (36th percentile); the High attack complexity (AC:H) reflects the race-condition/heap-grooming reliability problem typical of use-after-free bugs.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Windows Shell's link-resolution logic fails to safely handle symbolic or hard links before granting file access, enabling a remote unauthenticated attacker to perform network-based spoofing against a victim who interacts with a crafted payload. The flaw (CWE-59) spans the full current Windows ecosystem - from Server 2012 R2 through Windows 11 26H2 and Server 2025 - and can yield both confidentiality and integrity compromise (C:H/I:H). No public exploit or CISA KEV listing has been identified at time of analysis, but user interaction (UI:R) is the sole barrier to exploitation.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Remote code execution in the Windows DNS Server component allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing. The CWE-362 flaw affects every actively supported Windows Server release from Server 2012 through Server 2025, with full confidentiality, integrity, and availability impact if exploited. No active exploitation or public proof-of-concept has been identified, and the CVSS AC:H rating reflects that reliable exploitation requires precise race-condition timing against a production DNS service.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated attacker to achieve full SYSTEM-level code execution via a time-of-check time-of-use (TOCTOU) race condition in the kernel graphics subsystem. The vulnerability spans an exceptionally broad range of Microsoft Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all current servicing branches - making patch deployment a significant operational undertaking. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically favored as second-stage payloads in multi-stage attack chains following initial remote compromise.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Privilege escalation in the Windows TCP/IP stack lets an attacker who already holds low-privileged authorized access on a reachable host trigger a kernel use-after-free and elevate to SYSTEM, with full compromise of confidentiality, integrity, and availability on the affected machine. The flaw affects a very broad install base - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - but exploitation is constrained by high attack complexity, since the attacker must reliably win a memory reclamation race in kernel space; Microsoft has shipped fixes and there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and no public exploit identified at time of analysis. EPSS is low at 0.52% (43rd percentile), so this is best handled as a routine but high-priority patch-cycle item rather than an emergency.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DNS Server role (across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free that an unauthenticated attacker can trigger over the network, per CVSS PR:N/UI:N. Microsoft rates it 9.8 (critical) with full confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Elevation of privilege in Windows Group Policy allows an attacker who already holds valid low-privilege credentials on a network-reachable machine to run code at high integrity/SYSTEM level by inducing an untrusted pointer dereference in the policy-processing component. Unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 (including Server Core installations) builds are affected, with builds below the fixed revision for each product line remaining exposed. Exploitation is unconfirmed: no public exploit code and no KEV listing exist, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.70% (51st percentile) - this is a genuinely serious but not top-tier-urgent issue, with the low-privilege authentication prerequisite (PR:L, AV:N) as the principal limiting factor.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation on unpatched Windows hosts is achievable by a network-positioned attacker who already holds low-privilege credentials, exploiting a stack-based buffer overflow (CWE-121) in the Windows Device Association Service; with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the primitive yields high confidentiality, integrity, and availability impact with no user interaction, though it is a post-foothold escalation rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and EPSS is modest at 0.85% (56th percentile), so this is a genuine patch-priority item rather than an emergency. Microsoft has published vendor patches for every affected Windows 10, Windows 11, and Windows Server build, making remediation a straightforward monthly-update action.
Remote code execution in the Windows Key Distribution Center (KDC) - the Kerberos authentication service running on every Active Directory domain controller - allows a low-privileged authenticated network attacker to execute arbitrary code via a use-after-free memory corruption flaw (CWE-416). Every currently-supported Windows Server release from Server 2012 through Server 2025 is affected, spanning the full breadth of enterprise Active Directory infrastructure. Microsoft has released patches with exact build-level thresholds per platform; no public exploit code and no CISA KEV listing are identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Privilege escalation in the Windows Win32K kernel component allows an attacker who already holds low-privileged execution on a target host (PR:L) to corrupt kernel memory and escalate to SYSTEM-level privileges. Microsoft rates the flaw CVSS 7.5 (HIGH) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, although our assessment reads the practical attack vector as local (AV:L); in either reading the precondition is existing code execution on the box, making this a post-compromise escalation primitive rather than a remotely reachable entry point, and the high attack complexity means a race condition or specific heap/object state must be won reliably. Affected are unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 builds below the fixed build numbers published by Microsoft; there is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.44% (37th percentile), so near-term exploitation risk is driven by targeted, post-access actors rather than mass scanning.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Privilege escalation on unpatched Windows 10, Windows 11, and Windows Server systems is possible through a heap-based buffer overflow in the Encrypting File System (EFS), which a low-privileged authenticated account can reach over the network to gain SYSTEM-level code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), implying a race condition or precise heap grooming rather than a deterministic one-shot trigger, and no user interaction is required. There is no evidence of active exploitation and no public exploit identified at time of analysis; CISA SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is a low 0.57% (45th percentile) despite the total technical impact score. Microsoft has released fixes, so the residual risk is concentrated on systems that remain unpatched.
Privilege escalation via integer underflow in Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged user to gain SYSTEM-level access across virtually the entire Windows ecosystem. The flaw spans Windows Server 2012 through Windows 11 26H1 and Server 2025, making it a broad-surface local elevation-of-privilege issue. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. Successful cache poisoning yields full confidentiality, integrity, and availability impact - enabling credential interception, traffic redirection, and service disruption for any client relying on the compromised resolver. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated user to gain SYSTEM-level access via an out-of-bounds read in the kernel graphics subsystem. The flaw spans a remarkably wide surface - Windows Server 2012 through Server 2025 and every current Windows 10/11 feature release - making it broadly relevant across enterprise patch cycles. Microsoft has released per-version updates; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Elevation of privilege in the Windows exFAT file-system driver allows an attacker who already holds low-privileged access to hand the kernel a malformed exFAT structure, triggering an out-of-bounds read (CWE-125) that can corrupt memory and yield SYSTEM-level execution (Microsoft CVSS 3.1 base 8.8; vector requires authenticated access, PR:L, with no user interaction). Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025, i.e. essentially the entire supported Windows fleet, which makes the low exploit-probability signal the main moderating factor. No public exploit code has been identified at time of analysis, EPSS is 0.77% (53rd percentile), and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total; a vendor patch is available. Note a vector discrepancy: Microsoft rates this AV:N ('over a network'), whereas independent assessment places it AV:L, since triggering requires a system to process attacker-controlled exFAT data and remote reachability for a file-system parsing bug is unverified.
Use-after-free in the Windows Image Acquisition (WIA) subsystem enables an authorized local attacker to escalate privileges on every supported Windows release, from Server 2012 to Windows 11 26H1. The CVSS vector (AV:L/AC:H/PR:L) places exploitation difficulty above average - a low-privileged user must trigger a race condition or specific memory-reuse timing within the WIA service - but a successful exploit yields full C:H/I:H/A:H impact, effectively granting SYSTEM-level control. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.