Windows Server 2019
Monthly
Privilege escalation via integer underflow in Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged user to gain SYSTEM-level access across virtually the entire Windows ecosystem. The flaw spans Windows Server 2012 through Windows 11 26H1 and Server 2025, making it a broad-surface local elevation-of-privilege issue. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. Successful cache poisoning yields full confidentiality, integrity, and availability impact - enabling credential interception, traffic redirection, and service disruption for any client relying on the compromised resolver. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Privilege escalation in Windows Accounts Control allows an authorized local attacker to gain elevated system access by exploiting a use-after-free memory corruption flaw (CWE-416). The vulnerability spans a broad range of Windows 10, 11, and Windows Server editions from build 14393 through build 28000, making the exposure surface wide across enterprise and consumer deployments. Microsoft has released patches; no public exploit code or CISA KEV listing exists at time of analysis, though the AC:H vector indicates a race-condition-dependent trigger consistent with timing-sensitive UAF exploitation.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated user to gain SYSTEM-level access via an out-of-bounds read in the kernel graphics subsystem. The flaw spans a remarkably wide surface - Windows Server 2012 through Server 2025 and every current Windows 10/11 feature release - making it broadly relevant across enterprise patch cycles. Microsoft has released per-version updates; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Elevation of privilege in Windows DiagTrack (Connected User Experiences and Telemetry) allows an authenticated low-privileged attacker with network access to trigger a heap-based buffer overflow and potentially gain elevated privileges, including SYSTEM-level access. The vulnerability affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2019/2022/2025 builds below the fixed versions. No public exploit identified at time of analysis; EPSS is 0.74% (52nd percentile) and CISA SSVC reports exploitation: none. Vendor patches are available.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Elevation of privilege in the Windows exFAT file-system driver allows an attacker who already holds low-privileged access to hand the kernel a malformed exFAT structure, triggering an out-of-bounds read (CWE-125) that can corrupt memory and yield SYSTEM-level execution (Microsoft CVSS 3.1 base 8.8; vector requires authenticated access, PR:L, with no user interaction). Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025, i.e. essentially the entire supported Windows fleet, which makes the low exploit-probability signal the main moderating factor. No public exploit code has been identified at time of analysis, EPSS is 0.77% (53rd percentile), and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total; a vendor patch is available. Note a vector discrepancy: Microsoft rates this AV:N ('over a network'), whereas independent assessment places it AV:L, since triggering requires a system to process attacker-controlled exFAT data and remote reachability for a file-system parsing bug is unverified.
Use-after-free in the Windows Image Acquisition (WIA) subsystem enables an authorized local attacker to escalate privileges on every supported Windows release, from Server 2012 to Windows 11 26H1. The CVSS vector (AV:L/AC:H/PR:L) places exploitation difficulty above average - a low-privileged user must trigger a race condition or specific memory-reuse timing within the WIA service - but a successful exploit yields full C:H/I:H/A:H impact, effectively granting SYSTEM-level control. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Win32K kernel graphics driver affects every supported Windows release from Server 2012 through Windows 11 26H1, allowing a low-privileged authenticated local user to gain SYSTEM-level access. The root cause is a buffer over-read (CWE-126) in the Win32K subsystem: out-of-bounds memory reads in kernel context can expose critical kernel data structures - including address layout information - that enable a subsequent control-flow hijack to full SYSTEM privileges. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though Microsoft has issued patched cumulative updates for all affected product lines.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released corrective patches across all affected build branches.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows PrintWorkflowUserSvc (Print Workflow User Service) component of Microsoft's modern print stack lets a low-privileged, authenticated attacker elevate to a higher-integrity context by winning a use-after-free race inside the service (CWE-416). Unpatched Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2019/2022/2025 systems - including Server Core installations - are exposed, and the service is present by default. Scoring CVSS 7.5 with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, the bug is network-reachable but requires careful heap grooming and no user interaction; there is no public exploit code identified at time of analysis (EPSS 0.57%, 45th percentile; CISA SSVC exploitation status "none"), and vendor patches are available.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation to SYSTEM in the Windows Search Component (WSearch) affects virtually every supported Windows client and server platform from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major release branches. The vulnerability stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with a standard user account can trigger to execute code at elevated privilege. The high attack complexity (AC:H) in the CVSS vector indicates exploitation likely requires precise timing consistent with a race condition; no public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor patch is available.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Remote code execution in Microsoft Windows PDF rendering affects a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds, where an integer overflow while parsing a crafted PDF wraps a size calculation and triggers a heap-based buffer overflow (CWE-122). An unauthenticated attacker who delivers a malicious PDF over the network can execute arbitrary code with the privileges of the rendering process. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Remote code execution in Microsoft's Windows Message Queuing (MSMQ) service affects all supported Windows client and server releases and lets an unauthenticated remote attacker corrupt memory via a use-after-free (CWE-416) to run arbitrary code. The flaw carries a critical CVSS 9.8 with a fully remote, no-interaction, no-privilege vector. Microsoft has shipped patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Local privilege escalation in the Windows Graphic Fonts subsystem allows any low-privileged, authenticated local user to gain SYSTEM-level access via a use-after-free memory corruption flaw (CWE-416). The vulnerability spans the full breadth of supported and legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it an enterprise-wide concern. No public exploit code or CISA KEV listing is identified at time of analysis, though the broad attack surface across all modern Windows versions elevates its remediation priority significantly.
Local privilege escalation in Windows Storage Spaces Controller via a use-after-free memory corruption flaw enables an authenticated low-privilege attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability (CWE-416) exists in the Storage Spaces Controller kernel driver; exploiting it yields full confidentiality, integrity, and availability impact on the local system. No public exploit code or active exploitation confirmed at time of analysis, but the breadth of affected Windows versions makes this a broad-footprint local privilege escalation risk.
Use-after-free in the Windows Device Association Service enables a low-privileged local attacker to escalate to full system control across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw (CWE-416) resides in the service responsible for managing device pairing and trust relationships, and exploitation yields high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Elevation of privilege in Windows Hyper-V lets an attacker who already holds low-level authenticated access to a Hyper-V-enabled host reach the hypervisor's network-facing interfaces and gain high-integrity (SYSTEM-level) code execution, with full compromise of confidentiality, integrity, and availability of the affected host. Microsoft rates this 7.5 HIGH using CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, needs only low privileges, and requires no user interaction, but carries high attack complexity - consistent with a race or timing-dependent state that CISA's SSVC assessment explicitly marks as not automatable (Exploitation: none, Automatable: no, Technical Impact: total). The EPSS score is only 0.50% (41st percentile), no public exploit code has been identified, and the CVE is not in CISA KEV; exploitation is limited to hosts where the Hyper-V role/feature is installed and active, which is not a default configuration on most Windows 10/11 clients.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows an authenticated low-privilege user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions via an out-of-bounds read (CWE-125) in the kernel-mode driver. The vulnerability spans over a dozen currently-supported Windows releases including Server 2019, 2022, and 2025. No public exploit or CISA KEV listing has been identified; Microsoft has released patches through its standard update channels.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Audio Service (AudioSrv) exploits a use-after-free condition (CWE-416) to allow an authenticated local attacker to gain SYSTEM-level privileges on unpatched Windows 10, Windows 11, and Windows Server 2019-2025 systems. The attack requires low user privileges and high complexity to execute, consistent with a race condition in the service's memory management. Microsoft has released patches across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Command injection in the Windows Program Compatibility Assistant (PCA) Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated low-privilege attacker can inject shell commands through the PCA service's unsanitized input handling (CWE-77), achieving full control of the local system with C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis, but the wide Windows install base and low exploitation complexity make patching high priority.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution is possible across Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 through a use-after-free vulnerability (CWE-416) in the Reliable Multicast Transport Driver (rmcast.sys), a kernel-mode component. An unauthenticated network attacker can exploit a race condition in the driver to corrupt freed kernel memory and achieve arbitrary code execution at SYSTEM privilege level. No public exploit has been identified at time of analysis; the CVSS 8.1 rating reflects high attack complexity (AC:H) due to the timing-sensitive nature of use-after-free race condition exploitation, though a vendor patch is available.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) via a use-after-free condition allows an authorized local attacker with standard user privileges to achieve full system compromise (C:H/I:H/A:H). The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server builds, with Microsoft-confirmed patch availability across all listed versions. No public exploit code has been identified at time of analysis, and the AC:H rating indicates exploitation likely requires precise timing or race-condition manipulation, limiting automatable mass exploitation.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Spaceport.sys, the kernel-mode driver that backs Windows Storage Spaces, lets an attacker who already holds low-privileged authenticated access elevate to kernel-level privileges on affected Windows 10, Windows 11 and Windows Server builds. Successful exploitation yields total impact across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with code execution in kernel context, and no user interaction is required beyond the attacker's existing session. The flaw is not listed in CISA KEV, SSVC records exploitation as 'none' and the attack as non-automatable, and no public exploit code has been identified at time of analysis; EPSS is a modest 0.77% (53rd percentile), so real-world risk is currently driven by targeted post-compromise privilege escalation rather than mass exploitation.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Privilege escalation via integer underflow in Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged user to gain SYSTEM-level access across virtually the entire Windows ecosystem. The flaw spans Windows Server 2012 through Windows 11 26H1 and Server 2025, making it a broad-surface local elevation-of-privilege issue. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. Successful cache poisoning yields full confidentiality, integrity, and availability impact - enabling credential interception, traffic redirection, and service disruption for any client relying on the compromised resolver. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Privilege escalation in Windows Accounts Control allows an authorized local attacker to gain elevated system access by exploiting a use-after-free memory corruption flaw (CWE-416). The vulnerability spans a broad range of Windows 10, 11, and Windows Server editions from build 14393 through build 28000, making the exposure surface wide across enterprise and consumer deployments. Microsoft has released patches; no public exploit code or CISA KEV listing exists at time of analysis, though the AC:H vector indicates a race-condition-dependent trigger consistent with timing-sensitive UAF exploitation.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated user to gain SYSTEM-level access via an out-of-bounds read in the kernel graphics subsystem. The flaw spans a remarkably wide surface - Windows Server 2012 through Server 2025 and every current Windows 10/11 feature release - making it broadly relevant across enterprise patch cycles. Microsoft has released per-version updates; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Elevation of privilege in Windows DiagTrack (Connected User Experiences and Telemetry) allows an authenticated low-privileged attacker with network access to trigger a heap-based buffer overflow and potentially gain elevated privileges, including SYSTEM-level access. The vulnerability affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2019/2022/2025 builds below the fixed versions. No public exploit identified at time of analysis; EPSS is 0.74% (52nd percentile) and CISA SSVC reports exploitation: none. Vendor patches are available.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Elevation of privilege in the Windows exFAT file-system driver allows an attacker who already holds low-privileged access to hand the kernel a malformed exFAT structure, triggering an out-of-bounds read (CWE-125) that can corrupt memory and yield SYSTEM-level execution (Microsoft CVSS 3.1 base 8.8; vector requires authenticated access, PR:L, with no user interaction). Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025, i.e. essentially the entire supported Windows fleet, which makes the low exploit-probability signal the main moderating factor. No public exploit code has been identified at time of analysis, EPSS is 0.77% (53rd percentile), and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total; a vendor patch is available. Note a vector discrepancy: Microsoft rates this AV:N ('over a network'), whereas independent assessment places it AV:L, since triggering requires a system to process attacker-controlled exFAT data and remote reachability for a file-system parsing bug is unverified.
Use-after-free in the Windows Image Acquisition (WIA) subsystem enables an authorized local attacker to escalate privileges on every supported Windows release, from Server 2012 to Windows 11 26H1. The CVSS vector (AV:L/AC:H/PR:L) places exploitation difficulty above average - a low-privileged user must trigger a race condition or specific memory-reuse timing within the WIA service - but a successful exploit yields full C:H/I:H/A:H impact, effectively granting SYSTEM-level control. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Win32K kernel graphics driver affects every supported Windows release from Server 2012 through Windows 11 26H1, allowing a low-privileged authenticated local user to gain SYSTEM-level access. The root cause is a buffer over-read (CWE-126) in the Win32K subsystem: out-of-bounds memory reads in kernel context can expose critical kernel data structures - including address layout information - that enable a subsequent control-flow hijack to full SYSTEM privileges. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though Microsoft has issued patched cumulative updates for all affected product lines.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released corrective patches across all affected build branches.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows PrintWorkflowUserSvc (Print Workflow User Service) component of Microsoft's modern print stack lets a low-privileged, authenticated attacker elevate to a higher-integrity context by winning a use-after-free race inside the service (CWE-416). Unpatched Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2019/2022/2025 systems - including Server Core installations - are exposed, and the service is present by default. Scoring CVSS 7.5 with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, the bug is network-reachable but requires careful heap grooming and no user interaction; there is no public exploit code identified at time of analysis (EPSS 0.57%, 45th percentile; CISA SSVC exploitation status "none"), and vendor patches are available.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation to SYSTEM in the Windows Search Component (WSearch) affects virtually every supported Windows client and server platform from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major release branches. The vulnerability stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with a standard user account can trigger to execute code at elevated privilege. The high attack complexity (AC:H) in the CVSS vector indicates exploitation likely requires precise timing consistent with a race condition; no public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor patch is available.
Remote code execution in Windows iSCSI is possible due to incorrect buffer size calculation (CWE-131), affecting a broad swath of Windows releases from Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, unauthenticated attack path requiring some user interaction - consistent with a scenario where a victim system initiates an iSCSI connection to a malicious target. Microsoft has released patches addressing specific build thresholds across all affected Windows versions. No public exploit code or CISA KEV listing is present at time of analysis.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Remote code execution in Microsoft Windows PDF rendering affects a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds, where an integer overflow while parsing a crafted PDF wraps a size calculation and triggers a heap-based buffer overflow (CWE-122). An unauthenticated attacker who delivers a malicious PDF over the network can execute arbitrary code with the privileges of the rendering process. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Remote code execution in Microsoft's Windows Message Queuing (MSMQ) service affects all supported Windows client and server releases and lets an unauthenticated remote attacker corrupt memory via a use-after-free (CWE-416) to run arbitrary code. The flaw carries a critical CVSS 9.8 with a fully remote, no-interaction, no-privilege vector. Microsoft has shipped patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Local privilege escalation in the Windows Graphic Fonts subsystem allows any low-privileged, authenticated local user to gain SYSTEM-level access via a use-after-free memory corruption flaw (CWE-416). The vulnerability spans the full breadth of supported and legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it an enterprise-wide concern. No public exploit code or CISA KEV listing is identified at time of analysis, though the broad attack surface across all modern Windows versions elevates its remediation priority significantly.
Local privilege escalation in Windows Storage Spaces Controller via a use-after-free memory corruption flaw enables an authenticated low-privilege attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability (CWE-416) exists in the Storage Spaces Controller kernel driver; exploiting it yields full confidentiality, integrity, and availability impact on the local system. No public exploit code or active exploitation confirmed at time of analysis, but the breadth of affected Windows versions makes this a broad-footprint local privilege escalation risk.
Use-after-free in the Windows Device Association Service enables a low-privileged local attacker to escalate to full system control across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw (CWE-416) resides in the service responsible for managing device pairing and trust relationships, and exploitation yields high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Elevation of privilege in Windows Hyper-V lets an attacker who already holds low-level authenticated access to a Hyper-V-enabled host reach the hypervisor's network-facing interfaces and gain high-integrity (SYSTEM-level) code execution, with full compromise of confidentiality, integrity, and availability of the affected host. Microsoft rates this 7.5 HIGH using CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, needs only low privileges, and requires no user interaction, but carries high attack complexity - consistent with a race or timing-dependent state that CISA's SSVC assessment explicitly marks as not automatable (Exploitation: none, Automatable: no, Technical Impact: total). The EPSS score is only 0.50% (41st percentile), no public exploit code has been identified, and the CVE is not in CISA KEV; exploitation is limited to hosts where the Hyper-V role/feature is installed and active, which is not a default configuration on most Windows 10/11 clients.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows an authenticated low-privilege user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions via an out-of-bounds read (CWE-125) in the kernel-mode driver. The vulnerability spans over a dozen currently-supported Windows releases including Server 2019, 2022, and 2025. No public exploit or CISA KEV listing has been identified; Microsoft has released patches through its standard update channels.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Audio Service (AudioSrv) exploits a use-after-free condition (CWE-416) to allow an authenticated local attacker to gain SYSTEM-level privileges on unpatched Windows 10, Windows 11, and Windows Server 2019-2025 systems. The attack requires low user privileges and high complexity to execute, consistent with a race condition in the service's memory management. Microsoft has released patches across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Command injection in the Windows Program Compatibility Assistant (PCA) Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated low-privilege attacker can inject shell commands through the PCA service's unsanitized input handling (CWE-77), achieving full control of the local system with C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis, but the wide Windows install base and low exploitation complexity make patching high priority.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution is possible across Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 through a use-after-free vulnerability (CWE-416) in the Reliable Multicast Transport Driver (rmcast.sys), a kernel-mode component. An unauthenticated network attacker can exploit a race condition in the driver to corrupt freed kernel memory and achieve arbitrary code execution at SYSTEM privilege level. No public exploit has been identified at time of analysis; the CVSS 8.1 rating reflects high attack complexity (AC:H) due to the timing-sensitive nature of use-after-free race condition exploitation, though a vendor patch is available.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) via a use-after-free condition allows an authorized local attacker with standard user privileges to achieve full system compromise (C:H/I:H/A:H). The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server builds, with Microsoft-confirmed patch availability across all listed versions. No public exploit code has been identified at time of analysis, and the AC:H rating indicates exploitation likely requires precise timing or race-condition manipulation, limiting automatable mass exploitation.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Spaceport.sys, the kernel-mode driver that backs Windows Storage Spaces, lets an attacker who already holds low-privileged authenticated access elevate to kernel-level privileges on affected Windows 10, Windows 11 and Windows Server builds. Successful exploitation yields total impact across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with code execution in kernel context, and no user interaction is required beyond the attacker's existing session. The flaw is not listed in CISA KEV, SSVC records exploitation as 'none' and the attack as non-automatable, and no public exploit code has been identified at time of analysis; EPSS is a modest 0.77% (53rd percentile), so real-world risk is currently driven by targeted post-compromise privilege escalation rather than mass exploitation.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.