Windows Server 2016
Monthly
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.
A heap-based buffer overflow in the Windows Kernel lets a local attacker who already holds low privileges on a host escalate to higher integrity - potentially SYSTEM - with no user interaction required. Every unpatched build across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 is affected by default, since the flaw sits in the kernel itself rather than an optional feature. There is no public exploit identified at time of analysis and no indication of active exploitation (CISA SSVC exploitation: none), and EPSS is low at 0.33% (25th percentile), but a successful trigger yields full confidentiality, integrity and availability impact, so Microsoft's fix should be scheduled in this week's patch cycle.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Spoofing and identity impersonation in Microsoft Active Directory Federation Services (AD FS) let an unauthenticated network attacker get forged or intercepted certificates accepted as trusted, undermining the integrity of federated authentication. Affected deployments are AD FS running on Windows Server 2012 R2 through Windows Server 2025, along with the underlying .NET Framework certificate-validation components (3.5, 4.6.2 through 4.8.1) and System.Security.Cryptography.Xml, plus Visual Studio 2022 17.14 and Visual Studio 2026 18.10. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4), meaning no credentials or user interaction are needed but the attacker must first obtain a privileged network/intercept position or craft a certificate that slips past validation; impact is limited to confidentiality and integrity, with no availability effect. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but a vendor patch is available and should be applied promptly given the authentication-bypass potential in default, network-exposed AD FS deployments.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows RPC Runtime is possible due to an untrusted pointer dereference (CWE-822) that can be triggered when a victim initiates or accepts an RPC connection to an attacker-controlled endpoint. Unauthenticated attackers on the network can exploit this with user interaction (CVSS 8.8, AV:N/AC:L/PR:N/UI:R), affecting a wide range of supported Windows client and server editions. No public exploit or active exploitation has been observed (SSVC Exploitation: none), but vendor patches are available.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged user who already has code execution on the host to trigger an out-of-bounds read in the compositor and, per the assessed CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H), achieve high confidentiality, integrity and availability impact in DWM's more privileged context. Every default installation of the affected Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025 builds - including Server Core - carries the vulnerable component, but the flaw is not remotely reachable and requires an existing local foothold as an authenticated user. No public exploit code has been identified at time of analysis and CISA's SSVC records no observed exploitation, making this a post-compromise escalation step rather than an initial-access vector; Microsoft has shipped patched builds and a fix is available via the MSRC update guide.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.
Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.
A heap-based buffer overflow in the Windows Kernel lets a local attacker who already holds low privileges on a host escalate to higher integrity - potentially SYSTEM - with no user interaction required. Every unpatched build across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 is affected by default, since the flaw sits in the kernel itself rather than an optional feature. There is no public exploit identified at time of analysis and no indication of active exploitation (CISA SSVC exploitation: none), and EPSS is low at 0.33% (25th percentile), but a successful trigger yields full confidentiality, integrity and availability impact, so Microsoft's fix should be scheduled in this week's patch cycle.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Spoofing and identity impersonation in Microsoft Active Directory Federation Services (AD FS) let an unauthenticated network attacker get forged or intercepted certificates accepted as trusted, undermining the integrity of federated authentication. Affected deployments are AD FS running on Windows Server 2012 R2 through Windows Server 2025, along with the underlying .NET Framework certificate-validation components (3.5, 4.6.2 through 4.8.1) and System.Security.Cryptography.Xml, plus Visual Studio 2022 17.14 and Visual Studio 2026 18.10. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4), meaning no credentials or user interaction are needed but the attacker must first obtain a privileged network/intercept position or craft a certificate that slips past validation; impact is limited to confidentiality and integrity, with no availability effect. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but a vendor patch is available and should be applied promptly given the authentication-bypass potential in default, network-exposed AD FS deployments.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows RPC Runtime is possible due to an untrusted pointer dereference (CWE-822) that can be triggered when a victim initiates or accepts an RPC connection to an attacker-controlled endpoint. Unauthenticated attackers on the network can exploit this with user interaction (CVSS 8.8, AV:N/AC:L/PR:N/UI:R), affecting a wide range of supported Windows client and server editions. No public exploit or active exploitation has been observed (SSVC Exploitation: none), but vendor patches are available.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged user who already has code execution on the host to trigger an out-of-bounds read in the compositor and, per the assessed CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H), achieve high confidentiality, integrity and availability impact in DWM's more privileged context. Every default installation of the affected Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025 builds - including Server Core - carries the vulnerable component, but the flaw is not remotely reachable and requires an existing local foothold as an authenticated user. No public exploit code has been identified at time of analysis and CISA's SSVC records no observed exploitation, making this a post-compromise escalation step rather than an initial-access vector; Microsoft has shipped patched builds and a fix is available via the MSRC update guide.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.
Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.