Windows Server 2012
Monthly
Local privilege escalation in the Windows Win32K kernel graphics driver affects every supported Windows release from Server 2012 through Windows 11 26H1, allowing a low-privileged authenticated local user to gain SYSTEM-level access. The root cause is a buffer over-read (CWE-126) in the Win32K subsystem: out-of-bounds memory reads in kernel context can expose critical kernel data structures - including address layout information - that enable a subsequent control-flow hijack to full SYSTEM privileges. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though Microsoft has issued patched cumulative updates for all affected product lines.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released corrective patches across all affected build branches.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation to SYSTEM in the Windows Search Component (WSearch) affects virtually every supported Windows client and server platform from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major release branches. The vulnerability stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with a standard user account can trigger to execute code at elevated privilege. The high attack complexity (AC:H) in the CVSS vector indicates exploitation likely requires precise timing consistent with a race condition; no public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor patch is available.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Remote code execution in Microsoft's Windows Message Queuing (MSMQ) service affects all supported Windows client and server releases and lets an unauthenticated remote attacker corrupt memory via a use-after-free (CWE-416) to run arbitrary code. The flaw carries a critical CVSS 9.8 with a fully remote, no-interaction, no-privilege vector. Microsoft has shipped patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Local privilege escalation in the Windows Graphic Fonts subsystem allows any low-privileged, authenticated local user to gain SYSTEM-level access via a use-after-free memory corruption flaw (CWE-416). The vulnerability spans the full breadth of supported and legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it an enterprise-wide concern. No public exploit code or CISA KEV listing is identified at time of analysis, though the broad attack surface across all modern Windows versions elevates its remediation priority significantly.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Local privilege escalation in the Windows Device Association Service allows a low-privileged attacker to gain SYSTEM-level access on unpatched systems via a use-after-free memory corruption bug (CWE-416). The vulnerability spans the entire current Windows ecosystem - from Windows 10 1607 and Server 2012 R2 through Windows 11 25H2 and Server 2025 - making the attack surface extremely broad. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Privilege escalation in Windows Remote Desktop Services exploits an untrusted pointer dereference (CWE-822) to allow a locally authenticated low-privileged attacker to gain full system control (C:H/I:H/A:H). The flaw affects a broad swath of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature update branches. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches via the standard update cycle.
Privilege escalation in the Windows Kernel via a use-after-free memory corruption flaw allows an authenticated local attacker to elevate from low-privileged user to SYSTEM-level access. The vulnerability spans the entire current Windows ecosystem - from legacy Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly relevant to enterprise patch management. No public exploit code or active exploitation has been identified at time of analysis, but the breadth of affected OS versions and the practical value of local EoP payloads in post-initial-access attack chains make timely patching essential.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Path traversal in the Windows Compressed Folder built-in ZIP handler allows a locally authenticated standard user to escalate privileges to SYSTEM or Administrator level across a wide range of Windows client and server editions. The vulnerability (CWE-22) exists in the component that processes ZIP archive extraction, enabling crafted archive entries to write files outside the intended extraction directory into sensitive system paths. No public exploit or KEV listing exists at time of analysis, but the low attack complexity and broad version coverage across Windows 10, 11, and Server 2012 through 2025 make this a high-priority patching target in environments where local privilege escalation is a concern.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Local privilege escalation in the Windows Win32K kernel graphics driver affects every supported Windows release from Server 2012 through Windows 11 26H1, allowing a low-privileged authenticated local user to gain SYSTEM-level access. The root cause is a buffer over-read (CWE-126) in the Win32K subsystem: out-of-bounds memory reads in kernel context can expose critical kernel data structures - including address layout information - that enable a subsequent control-flow hijack to full SYSTEM privileges. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though Microsoft has issued patched cumulative updates for all affected product lines.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released corrective patches across all affected build branches.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation to SYSTEM in the Windows Search Component (WSearch) affects virtually every supported Windows client and server platform from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major release branches. The vulnerability stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with a standard user account can trigger to execute code at elevated privilege. The high attack complexity (AC:H) in the CVSS vector indicates exploitation likely requires precise timing consistent with a race condition; no public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor patch is available.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Remote code execution in Microsoft's Windows Message Queuing (MSMQ) service affects all supported Windows client and server releases and lets an unauthenticated remote attacker corrupt memory via a use-after-free (CWE-416) to run arbitrary code. The flaw carries a critical CVSS 9.8 with a fully remote, no-interaction, no-privilege vector. Microsoft has shipped patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Local privilege escalation in the Windows Graphic Fonts subsystem allows any low-privileged, authenticated local user to gain SYSTEM-level access via a use-after-free memory corruption flaw (CWE-416). The vulnerability spans the full breadth of supported and legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it an enterprise-wide concern. No public exploit code or CISA KEV listing is identified at time of analysis, though the broad attack surface across all modern Windows versions elevates its remediation priority significantly.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Local privilege escalation in the Windows Device Association Service allows a low-privileged attacker to gain SYSTEM-level access on unpatched systems via a use-after-free memory corruption bug (CWE-416). The vulnerability spans the entire current Windows ecosystem - from Windows 10 1607 and Server 2012 R2 through Windows 11 25H2 and Server 2025 - making the attack surface extremely broad. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Privilege escalation in Windows Remote Desktop Services exploits an untrusted pointer dereference (CWE-822) to allow a locally authenticated low-privileged attacker to gain full system control (C:H/I:H/A:H). The flaw affects a broad swath of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature update branches. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches via the standard update cycle.
Privilege escalation in the Windows Kernel via a use-after-free memory corruption flaw allows an authenticated local attacker to elevate from low-privileged user to SYSTEM-level access. The vulnerability spans the entire current Windows ecosystem - from legacy Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly relevant to enterprise patch management. No public exploit code or active exploitation has been identified at time of analysis, but the breadth of affected OS versions and the practical value of local EoP payloads in post-initial-access attack chains make timely patching essential.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Path traversal in the Windows Compressed Folder built-in ZIP handler allows a locally authenticated standard user to escalate privileges to SYSTEM or Administrator level across a wide range of Windows client and server editions. The vulnerability (CWE-22) exists in the component that processes ZIP archive extraction, enabling crafted archive entries to write files outside the intended extraction directory into sensitive system paths. No public exploit or KEV listing exists at time of analysis, but the low attack complexity and broad version coverage across Windows 10, 11, and Server 2012 through 2025 make this a high-priority patching target in environments where local privilege escalation is a concern.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.