Windows Server 2019
Monthly
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX controls in Office documents, exploited as a zero-day in targeted attacks before the September 2021 patch.
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Update Medic Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows LSA Spoofing Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Windows Event Tracing Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Scripting Engine Memory Corruption Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Windows MSHTML Platform Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Win32k Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by the Bitter APT group in February 2021 for targeted espionage operations.
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Local Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A spoofing vulnerability exists when Windows incorrectly validates file signatures. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to SYSTEM-level access by exploiting an out-of-bounds write triggered through the DrawIconEx API. Confirmed actively exploited (CISA KEV) with a publicly available proof-of-concept on Packet Storm, this flaw affects a sweeping range of Windows versions from Windows 7 through Windows 10 1909 and the full Windows Server ecosystem through 2019. The EPSS score of 52.78% at the 99th percentile aligns with documented real-world exploitation and places this well above typical local privilege escalation vulnerabilities in urgency.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.1%.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds authorized access to the DNS service (CVSS PR:L) disclose memory contents over the network, with no user interaction required (UI:N) and low attack complexity (AC:L). Impact is strictly confidentiality (C:H/I:N/A:N) - there is no code execution, data modification, or denial of service, and only Windows and Windows Server builds with the DNS Server role enabled are exposed. This is a genuine but moderate-priority issue rather than a top-tier emergency: CISA SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.
An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Tampering with Windows DNS Server configuration or data is possible for an authenticated local attacker on affected Windows Server and Windows 10 builds because of missing authorization checks (CWE-862). Affected systems must be running the DNS Server role, and exploitation only compromises integrity (no confidentiality or availability impact). Microsoft has released vendor patches; CISA SSVC rates exploitation as none, the issue is not automatable, and no public exploit is identified at time of analysis.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX controls in Office documents, exploited as a zero-day in targeted attacks before the September 2021 patch.
Windows Common Log File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Update Medic Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows LSA Spoofing Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Windows Event Tracing Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Scripting Engine Memory Corruption Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Windows MSHTML Platform Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows NTFS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Win32k Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by the Bitter APT group in February 2021 for targeted espionage operations.
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Windows Kernel Local Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A spoofing vulnerability exists when Windows incorrectly validates file signatures. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to SYSTEM-level access by exploiting an out-of-bounds write triggered through the DrawIconEx API. Confirmed actively exploited (CISA KEV) with a publicly available proof-of-concept on Packet Storm, this flaw affects a sweeping range of Windows versions from Windows 7 through Windows 10 1909 and the full Windows Server ecosystem through 2019. The EPSS score of 52.78% at the 99th percentile aligns with documented real-world exploitation and places this well above typical local privilege escalation vulnerabilities in urgency.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.1%.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.
An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.
Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.
Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.
Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.
Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.
An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.
Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.
Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.
An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.
An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.
Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.
An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.
Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds authorized access to the DNS service (CVSS PR:L) disclose memory contents over the network, with no user interaction required (UI:N) and low attack complexity (AC:L). Impact is strictly confidentiality (C:H/I:N/A:N) - there is no code execution, data modification, or denial of service, and only Windows and Windows Server builds with the DNS Server role enabled are exposed. This is a genuine but moderate-priority issue rather than a top-tier emergency: CISA SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.
Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.
An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.
Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).
An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.
An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Tampering with Windows DNS Server configuration or data is possible for an authenticated local attacker on affected Windows Server and Windows 10 builds because of missing authorization checks (CWE-862). Affected systems must be running the DNS Server role, and exploitation only compromises integrity (no confidentiality or availability impact). Microsoft has released vendor patches; CISA SSVC rates exploitation as none, the issue is not automatable, and no public exploit is identified at time of analysis.