Windows Server 2019
Monthly
Information disclosure in the Microsoft Bluetooth Driver allows a locally authenticated attacker with low-level privileges to trigger an out-of-bounds memory read and obtain sensitive data from the affected Windows host. The issue spans an unusually broad servicing footprint covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, and is scored CVSS 5.5 with high confidentiality impact but no integrity or availability impact. There is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation: none), so this rates as a moderate-severity, low-priority hardening item rather than an emergency; Microsoft has already published fixed builds, so remediation is a routine servicing update applied to the Bluetooth driver stack.
Local information disclosure in the Windows Win32K kernel-mode subsystem allows an attacker who already holds a low-privileged, authenticated local session to trigger a use of uninitialized resource and read memory contents that should not be exposed to their privilege level. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is confidentiality-only: it does not by itself grant code execution, privilege escalation, or persistence, but the leaked data can be used to defeat memory-layout protections and support a follow-on attack. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025 (including Server Core) at default configuration, with no special feature or non-default setting required. Microsoft has released fixed builds through the MSRC update guide; there is no public exploit code and CISA's SSVC decision framework records exploitation as 'none', so no public exploit identified at time of analysis.
An out-of-bounds read in the Windows Error Reporting (WER) component of affected Windows client and server builds lets an attacker who already holds low-privileged local access on the host read memory beyond the bounds of an allocated buffer, resulting in disclosure of potentially sensitive information from the affected process's address space. The flaw carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-125, meaning the sole impact is confidentiality - the bug cannot by itself modify data or cause a denial of service. There is no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and CISA KEV does not list this issue. This is a genuinely moderate, low-priority issue rather than an urgent threat: the attack surface is local-only, requires existing authenticated access and the ability to drive the vulnerable code path through WER, and yields information disclosure rather than code execution.
Local information disclosure in the Windows NTFS driver lets an authenticated, low-privileged user trigger an out-of-bounds read that exposes kernel memory contents on unpatched Windows 10, Windows 11 and Windows Server builds. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is only reachable after an attacker already has a local foothold on the host, and it yields confidentiality impact alone with no integrity or availability effect. Microsoft has published a vendor patch, CISA's SSVC evaluation records no exploitation and no automation, and no public exploit code has been identified at time of analysis, so this is a genuine but low-urgency issue that matters mainly as a post-compromise or chained-attack primitive rather than a standalone remote threat.
Local information disclosure in the Windows Print Spooler allows an authenticated, low-privileged user (CVSS PR:L, AV:L) to read memory beyond the bounds of a buffer handled by the printing subsystem, which runs by default on Windows client and server editions. Affected builds are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 that predate the fixed build levels published in the vendor update (for example Windows 11 24H2 before 10.0.26100.9711 and Windows Server 2025 before 10.0.26100.33650). The issue is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N) and no user interaction required; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity, making this a moderate-severity, low-priority issue under real-world scrutiny, with vendor patches available.
Information disclosure in the Windows Event Logging Service allows an authenticated, low-privileged local user to read leftover uninitialized memory from the service, potentially exposing data belonging to other processes or system structures. Every listed Windows 10 and Windows 11 release and Windows Server 2012 through 2025 edition (including Server Core installations) is affected below its patched build number, but exploitation requires the attacker to already have a valid local account plus the ability to execute code on the host - it cannot be triggered remotely or without credentials. Microsoft has published fixes through the MSRC update guide, no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and the assessed 5.5 CVSS reflects confidentiality-only impact with no integrity or availability effect.
Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally authenticated attacker with only low privileges to read data from an uninitialized resource, potentially exposing kernel memory contents that were never cleared before use. Exploitation requires a prior local foothold on an affected host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base score 5.5) and affects only the pre-patch builds enumerated in EUVD-2026-99961, such as Windows Server 2022 below 10.0.20348.5761, Windows 11 24H2 below 10.0.26100.9711, and Windows Server 2012 below 6.2.9200.26434. Impact is confidentiality-only with no integrity or availability effect, CISA's SSVC framework rates the flaw as non-exploited and non-automatable, and no public exploit identified at time of analysis; Microsoft has released a vendor patch. Real-world priority is therefore low-to-moderate despite HTTP.sys being present in essentially every supported Windows installation.
Local information disclosure in the Windows Universal Disk Format file system driver (UDFS, udfs.sys) allows an authenticated low-privilege attacker to read out-of-bounds memory by supplying a maliciously crafted UDF volume - a rogue optical disc, ISO/UDF disk image, or removable/mounted device - that the targeted host then mounts and parses. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5): exploitation requires an existing local authenticated session, there is no remote vector and no victim user interaction, and impact is confined to confidentiality with no integrity or availability loss. Microsoft has shipped fixes per its advisory, CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation 'no' and partial technical impact, and no public exploit code was identified at time of analysis - making this a genuinely moderate, low-urgency issue rather than a top-tier priority.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally positioned attacker who already holds low-privileged code execution on a target host to read sensitive system memory information that should be restricted to a higher privilege sphere. The flaw requires local access and existing low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5), needs no user interaction, and affects default installations of the listed Windows client and server builds because HTTP.sys is a core OS component; a remote, unauthenticated attacker cannot trigger it directly. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and Microsoft has shipped vendor fixes - making this a moderate, low-urgency hardening item rather than an emergency patch.
Adjacent-network denial of service in the Windows Wi-Fi driver affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, where a crafted 802.11 frame reaching the wireless stack triggers an out-of-bounds read (CWE-125) that can crash the driver and render the wireless connection unavailable. Per the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no authentication and no user interaction are required, and unauthenticated attackers within Wi-Fi radio range - on the same wireless LAN, a shared hotspot, or a rogue access point - can reach the target, making this a moderate-severity availability issue rather than a remotely exploitable internet-facing one. No public exploit code has been identified at the time of analysis (CISA SSVC: Exploitation=none, Automatable=no), though the vendor has released patched builds, and the impact is confined to availability with no assessed data exposure or code execution.
Local tampering of Windows Modern Device Management (MDM) state is possible on affected Windows 10, Windows 11, and Windows Server builds, because a TOCTOU race condition (CWE-367) lets an attacker who already holds an authenticated low-privileged local account alter a resource in the window between its validation and its use. Exploitation is non-deterministic and typically requires many attempts (CVSS 4.7, AV:L/AC:H/PR:L/UI:N), there is no remote vector and no user-interaction requirement, and impact is confined to integrity (I:H) with no confidentiality or availability effect. Microsoft has shipped fixes and CISA's SSVC assessment records no observed exploitation and no automatable path, so this ranks as a genuinely low-priority issue; no public exploit code has been identified at time of analysis.
Information disclosure via use of an uninitialized resource in the Microsoft Windows Event Logging Service allows a locally authenticated attacker holding only low privileges (PR:L) to read stale memory contents from the affected service, yielding high confidentiality impact with no integrity or availability effect (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts running unpatched builds of Windows 10, Windows 11, and Windows Server 2012 through 2025 within the version ranges listed in the EUVD advisory are affected, and the flaw cannot be reached remotely - an attacker must already have local code execution and a valid session on the target. Exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit is identified at time of analysis, so real-world urgency is LOW despite the HIGH confidentiality rating; vendor patches are available that eliminate the condition.
An out-of-bounds read in the Microsoft Windows Search Component lets a locally authenticated, low-privileged attacker read memory adjacent to search operations, resulting in information disclosure without any user interaction. Impact is confined to confidentiality (C:H) with no integrity or availability effect, and exploitation requires an existing local session on an affected Windows 10, Windows 11, or Windows Server build - there is no remote or unauthenticated path. No public exploit code and no confirmed active exploitation have been identified (CISA KEV absent; SSVC exploitation: none), and the vendor has released fixed builds, so this is a low-to-moderate priority patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft Windows via the IKE Extension (IKEEXT) service, which can be crashed or disrupted when it processes malformed IKE protocol input, causing a buffer over-read (CWE-126). All supported Windows client and server platforms that ship IKEEXT are affected - including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 through 2025 - but only systems with IPsec/IKE or Windows VPN functionality active and network-reachable are exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an authorized attacker with low-level network access (not anonymous reachability) can cause an availability-only impact; there is no confidentiality or integrity effect and no code execution, and no public exploit has been identified at time of analysis (CISA SSVC: exploitation none, automatable no), making this a moderate-priority patching item rather than an emergency.
An authenticated, network-reachable attacker can disclose files outside the intended directory through absolute path traversal in the Windows Encrypting File System (EFS), tracked as CVE-2026-83683. Only unpatched Windows client and server builds are affected - for example Windows 11 24H2 before 10.0.26100.9711, Windows Server 2022 before 10.0.20348.5761, and legacy platforms back to Windows Server 2012 before 6.2.9200.26434. Exploitation requires the attacker to already hold low-privilege authenticated access (CVSS vector PR:L, AV:N), and the impact is limited to confidentiality (C:H with I:N/A:N), so there is no file modification or denial of service; no public exploit has been identified at time of analysis and CISA's SSVC assessment rates the issue non-automatable, making opportunistic mass exploitation unlikely.
Information disclosure in Microsoft Windows Installer allows an authenticated local attacker holding only low privileges to read sensitive system information that should remain outside their control sphere. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 including Server Core installations, with a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires prior local interactive authentication plus a high-complexity, non-deterministic condition; there is no remote vector, no user interaction, no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available per the Microsoft advisory.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An out-of-bounds read in the Windows WLAN Service lets a locally authenticated attacker disclose information from the host's memory on affected Windows 10, Windows 11 and Windows Server builds. Exploitation requires the attacker to already hold a low-privileged interactive logon or to run code under an existing user token on the target host (CVSS AV:L, PR:L); the issue is not remotely or anonymously reachable, no user interaction is needed (UI:N), and impact is limited to confidentiality (C:H with I:N/A:N), so there is no code execution or system modification. Severity is CVSS 5.5 (MEDIUM), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis; a vendor patch is available and the signal set is consistent with a moderate, low-priority hardening item.
An out-of-bounds read in Active Directory Domain Services (AD DS) on unpatched domain controllers allows an authenticated, low-privileged attacker to crash or hang the directory service over the network, producing a denial of service against domain authentication and directory lookups. The flaw requires a valid domain account or equivalent foothold (CVSS vector PR:L) and no user interaction; success yields only availability impact with no confidentiality or integrity loss (C:N/I:N/A:H, assessed 6.5). No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and non-automatable, and no CISA KEV listing exists, so this is a moderate-priority, availability-only issue affecting a critical infrastructure component rather than an emergency patch case.
Local information disclosure in the Windows Portable Device (WPD) File System driver affects Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 hosts that have not installed the corresponding cumulative update. A type-confusion flaw (CWE-843) lets an attacker who already holds an authenticated, low-privileged local session (CVSS AV:L/PR:L, no user interaction) coerce the driver into treating one object type as another and read memory the caller should not be able to access, yielding high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). There is no network vector, no public exploit identified at time of analysis, and CISA SSVC rates the issue non-automatable with only partial technical impact, so it is best treated as a moderate-priority local information-leak primitive to be fixed on a normal patch cycle rather than as an emergency.
Local information disclosure in Windows Error Reporting (WER) allows an authenticated low-privileged attacker with an existing session on a Windows host to read report data that should be restricted from their privilege level, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) under CWE-862 missing authorization. The impact is confidentiality-only: no data is modified and availability is unaffected, and because the vector is local there is no network path to exploit it, so the attacker must first hold valid low-privileged credentials or a running session on the machine. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', but vendor patches are available for the affected Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 builds listed in EUVD-2026-99319.
Weak authentication in the Windows Modern Device Management (MDM) component allows a locally authenticated, low-privilege user on Windows 10 Version 1809 or Windows Server 2019 (including Server Core) to tamper with device-management data and policy. Impact is integrity-only: there is no remote vector, no confidentiality loss and no denial of service, so exploitation requires an attacker to already hold a foothold on the host with a valid low-privilege account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is assessed as none under the CISA SSVC framework, the issue is not in CISA KEV, and no public exploit code has been identified at time of analysis, but a vendor patch is available from Microsoft, making this a moderate-severity patch-cycle item rather than an emergency.
An authenticated, network-positioned attacker can force an out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS), crashing the service and producing a denial of service on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The vulnerability is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so low-privilege valid credentials and network reachability are prerequisites; unauthenticated attackers cannot exploit it per the assessed vector, and the impact is confined to availability with no confidentiality or integrity consequence. Microsoft has published fixes via its update guide, CISA's SSVC assessment rates exploitation as none, and there is no public exploit identified at time of analysis - making this a moderate-severity, low-urgency patch-cycle item rather than an emergency.
Open redirect in Active Directory Federation Services (AD FS) allows an authenticated attacker to craft a federation/redirect URL that sends a victim to an attacker-controlled site while appearing to originate from a trusted AD FS endpoint. Only Windows systems with the AD FS role configured and reachable by users or the internet are affected - Windows Server 2016, 2019, 2022 and 2025 (including Server Core) plus Windows 10 1607 and 1809 builds below their listed fixed build numbers. Exploitation requires an authorized/high-privilege AD FS actor and a victim who interacts with the crafted URL, and the resulting impact is limited to spoofing (low confidentiality and integrity, no availability impact); there is no public exploit identified at time of analysis, KEV status is negative, and the moderate CVSS 4.8 score places this in a low-priority, hardening-class remediation bucket rather than an emergency one.
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
Local denial of service in Windows DHCP Server (CVE-2026-70201) allows an authenticated attacker holding valid low-privilege credentials on a host running the DHCP Server role to crash the service by supplying malformed input that triggers an out-of-bounds read (CWE-125). Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) the issue is not remotely reachable and yields only availability impact, with no confidentiality or integrity loss and no code execution path. No public exploit identified at time of analysis: CISA SSVC records exploitation as 'none', automatable as 'no', technical impact as 'partial', and the CVE is not KEV-listed; Microsoft has shipped vendor patches, so urgency is low and the main prerequisite is that the DHCP Server role be installed and running (it is not enabled by default on typical member servers).
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
An out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to cause a denial of service (DoS) over the network. The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and Windows 10 Versions 1607 and 1809 when the DNS Server role is enabled; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code has been identified, and CISA SSVC rates exploitation as none, yielding a modest, non-urgent risk despite the network attack vector.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
Incorrect authorization in the Microsoft Windows DNS Server role allows a locally authenticated attacker with low privileges to bypass a DNS security feature and alter DNS resolution behavior on the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it cannot be triggered remotely or by an unauthenticated actor - the attacker must already hold a foothold on the server - and its impact is limited to integrity, with no confidentiality or availability loss and no user interaction required. All supported Windows Server generations that host the DNS Server role are affected, from Windows Server 2012 through Windows Server 2025, along with the Windows 10 1607 and 1809 clients that ship the same DNS components; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' (technical impact: partial), and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority hardening issue rather than an emergency.
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged attacker to tamper with DNS data or configuration, earning a CVSS 5.5 rating (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The flaw (CWE-862) affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installation variants, with integrity-only impact and no data disclosure or denial-of-service component. Microsoft has released a vendor patch per the MSRC update guide, and CISA's SSVC assessment records no known exploitation with no public exploit identified at time of analysis; because exploitation requires existing local credentials on the DNS server, real-world urgency is moderate rather than critical.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Incorrect authorization in the Windows DNS Server role allows an attacker who already holds a low-privileged local account or interactive logon session on the DNS host to tamper with DNS data or service configuration, degrading integrity with no confidentiality or availability impact. Affected systems span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) plus Windows 10 versions 1607 and 1809, in each case below the vendor's patched build numbers. Microsoft has released a fix, and no public exploit code has been identified at time of analysis; the SSVC assessment records exploitation as 'none', automatable as 'no' and technical impact as 'partial', so this is a genuine but moderate-priority issue rather than a top-tier emergency.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
An out-of-bounds read in the Windows DNS component lets a locally authenticated, low-privileged attacker cause the service to read past the end of an allocated buffer and leak information from process memory, giving high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an attacker to already hold local, authenticated low-privileged access to an affected Windows host - there is no remote or network-triggerable path - and no public exploit code has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'. Affected builds span Windows Server 2012 through Windows Server 2025 and Windows 10 versions 1607 and 1809, and Microsoft has released fixed builds for each, making this a moderate, low-priority patching item rather than an urgent emergency.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
Improper verification of cryptographic signatures in the Windows DNS Server component lets an authenticated, low-privileged attacker who already has local access to the host tamper with data that the service is supposed to validate, with the impact confined to integrity (no loss of confidentiality or availability). Exploitation is local only (AV:L, PR:L, UI:N) and requires a signature-validating configuration to be in use for the tampering to have meaning, so this is a moderate, non-urgent issue rather than a remotely reachable emergency. No public exploit code exists and there is no evidence of active exploitation, and CISA's SSVC assessment records Exploitation as none and Automatable as no; Microsoft has published patched builds that resolve the flaw.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
Active Directory Federation Services (AD FS) on Windows Server 2019, 2022, and 2025 lets an unauthenticated network attacker bypass an authentication security feature, yielding a high integrity impact (CVSS 5.9, CWE-1390) with no credentials and no user interaction required. Exploitation depends on network reachability to the AD FS federation endpoint - which in many deployments is internet-facing - but the HIGH attack complexity (AC:H) means the attacker must also satisfy conditions outside their control, so reliable exploitation is difficult. There is no public exploit identified at time of analysis, and vendor-released patches are available for every affected build (Windows Server 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650 and later, including Server Core installations).
Authentication bypass in Microsoft Active Directory Federation Services (AD FS) allows a remote attacker with network reachability to the federation/SSO endpoint to satisfy an authentication check under specific conditions and obtain a trust outcome that should have been denied. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (base 5.9) confirms no credentials and no user interaction are required, while the High attack complexity signals the bypass succeeds only in particular attacker-uncontrolled token or request states rather than against every request; impact is integrity-only (C:N/I:H), meaning a modified or improperly validated authentication decision rather than data disclosure. Microsoft has released vendor fixes for the affected AD FS-enabled Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis, so risk concentrates on default-configured, internet-exposed, unpatched AD FS deployments.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.
Information disclosure in the Microsoft Bluetooth Driver allows a locally authenticated attacker with low-level privileges to trigger an out-of-bounds memory read and obtain sensitive data from the affected Windows host. The issue spans an unusually broad servicing footprint covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, and is scored CVSS 5.5 with high confidentiality impact but no integrity or availability impact. There is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation: none), so this rates as a moderate-severity, low-priority hardening item rather than an emergency; Microsoft has already published fixed builds, so remediation is a routine servicing update applied to the Bluetooth driver stack.
Local information disclosure in the Windows Win32K kernel-mode subsystem allows an attacker who already holds a low-privileged, authenticated local session to trigger a use of uninitialized resource and read memory contents that should not be exposed to their privilege level. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is confidentiality-only: it does not by itself grant code execution, privilege escalation, or persistence, but the leaked data can be used to defeat memory-layout protections and support a follow-on attack. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025 (including Server Core) at default configuration, with no special feature or non-default setting required. Microsoft has released fixed builds through the MSRC update guide; there is no public exploit code and CISA's SSVC decision framework records exploitation as 'none', so no public exploit identified at time of analysis.
An out-of-bounds read in the Windows Error Reporting (WER) component of affected Windows client and server builds lets an attacker who already holds low-privileged local access on the host read memory beyond the bounds of an allocated buffer, resulting in disclosure of potentially sensitive information from the affected process's address space. The flaw carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-125, meaning the sole impact is confidentiality - the bug cannot by itself modify data or cause a denial of service. There is no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and CISA KEV does not list this issue. This is a genuinely moderate, low-priority issue rather than an urgent threat: the attack surface is local-only, requires existing authenticated access and the ability to drive the vulnerable code path through WER, and yields information disclosure rather than code execution.
Local information disclosure in the Windows NTFS driver lets an authenticated, low-privileged user trigger an out-of-bounds read that exposes kernel memory contents on unpatched Windows 10, Windows 11 and Windows Server builds. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is only reachable after an attacker already has a local foothold on the host, and it yields confidentiality impact alone with no integrity or availability effect. Microsoft has published a vendor patch, CISA's SSVC evaluation records no exploitation and no automation, and no public exploit code has been identified at time of analysis, so this is a genuine but low-urgency issue that matters mainly as a post-compromise or chained-attack primitive rather than a standalone remote threat.
Local information disclosure in the Windows Print Spooler allows an authenticated, low-privileged user (CVSS PR:L, AV:L) to read memory beyond the bounds of a buffer handled by the printing subsystem, which runs by default on Windows client and server editions. Affected builds are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 that predate the fixed build levels published in the vendor update (for example Windows 11 24H2 before 10.0.26100.9711 and Windows Server 2025 before 10.0.26100.33650). The issue is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N) and no user interaction required; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity, making this a moderate-severity, low-priority issue under real-world scrutiny, with vendor patches available.
Information disclosure in the Windows Event Logging Service allows an authenticated, low-privileged local user to read leftover uninitialized memory from the service, potentially exposing data belonging to other processes or system structures. Every listed Windows 10 and Windows 11 release and Windows Server 2012 through 2025 edition (including Server Core installations) is affected below its patched build number, but exploitation requires the attacker to already have a valid local account plus the ability to execute code on the host - it cannot be triggered remotely or without credentials. Microsoft has published fixes through the MSRC update guide, no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and the assessed 5.5 CVSS reflects confidentiality-only impact with no integrity or availability effect.
Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally authenticated attacker with only low privileges to read data from an uninitialized resource, potentially exposing kernel memory contents that were never cleared before use. Exploitation requires a prior local foothold on an affected host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base score 5.5) and affects only the pre-patch builds enumerated in EUVD-2026-99961, such as Windows Server 2022 below 10.0.20348.5761, Windows 11 24H2 below 10.0.26100.9711, and Windows Server 2012 below 6.2.9200.26434. Impact is confidentiality-only with no integrity or availability effect, CISA's SSVC framework rates the flaw as non-exploited and non-automatable, and no public exploit identified at time of analysis; Microsoft has released a vendor patch. Real-world priority is therefore low-to-moderate despite HTTP.sys being present in essentially every supported Windows installation.
Local information disclosure in the Windows Universal Disk Format file system driver (UDFS, udfs.sys) allows an authenticated low-privilege attacker to read out-of-bounds memory by supplying a maliciously crafted UDF volume - a rogue optical disc, ISO/UDF disk image, or removable/mounted device - that the targeted host then mounts and parses. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5): exploitation requires an existing local authenticated session, there is no remote vector and no victim user interaction, and impact is confined to confidentiality with no integrity or availability loss. Microsoft has shipped fixes per its advisory, CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation 'no' and partial technical impact, and no public exploit code was identified at time of analysis - making this a genuinely moderate, low-urgency issue rather than a top-tier priority.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally positioned attacker who already holds low-privileged code execution on a target host to read sensitive system memory information that should be restricted to a higher privilege sphere. The flaw requires local access and existing low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5), needs no user interaction, and affects default installations of the listed Windows client and server builds because HTTP.sys is a core OS component; a remote, unauthenticated attacker cannot trigger it directly. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and Microsoft has shipped vendor fixes - making this a moderate, low-urgency hardening item rather than an emergency patch.
Adjacent-network denial of service in the Windows Wi-Fi driver affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, where a crafted 802.11 frame reaching the wireless stack triggers an out-of-bounds read (CWE-125) that can crash the driver and render the wireless connection unavailable. Per the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no authentication and no user interaction are required, and unauthenticated attackers within Wi-Fi radio range - on the same wireless LAN, a shared hotspot, or a rogue access point - can reach the target, making this a moderate-severity availability issue rather than a remotely exploitable internet-facing one. No public exploit code has been identified at the time of analysis (CISA SSVC: Exploitation=none, Automatable=no), though the vendor has released patched builds, and the impact is confined to availability with no assessed data exposure or code execution.
Local tampering of Windows Modern Device Management (MDM) state is possible on affected Windows 10, Windows 11, and Windows Server builds, because a TOCTOU race condition (CWE-367) lets an attacker who already holds an authenticated low-privileged local account alter a resource in the window between its validation and its use. Exploitation is non-deterministic and typically requires many attempts (CVSS 4.7, AV:L/AC:H/PR:L/UI:N), there is no remote vector and no user-interaction requirement, and impact is confined to integrity (I:H) with no confidentiality or availability effect. Microsoft has shipped fixes and CISA's SSVC assessment records no observed exploitation and no automatable path, so this ranks as a genuinely low-priority issue; no public exploit code has been identified at time of analysis.
Information disclosure via use of an uninitialized resource in the Microsoft Windows Event Logging Service allows a locally authenticated attacker holding only low privileges (PR:L) to read stale memory contents from the affected service, yielding high confidentiality impact with no integrity or availability effect (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts running unpatched builds of Windows 10, Windows 11, and Windows Server 2012 through 2025 within the version ranges listed in the EUVD advisory are affected, and the flaw cannot be reached remotely - an attacker must already have local code execution and a valid session on the target. Exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit is identified at time of analysis, so real-world urgency is LOW despite the HIGH confidentiality rating; vendor patches are available that eliminate the condition.
An out-of-bounds read in the Microsoft Windows Search Component lets a locally authenticated, low-privileged attacker read memory adjacent to search operations, resulting in information disclosure without any user interaction. Impact is confined to confidentiality (C:H) with no integrity or availability effect, and exploitation requires an existing local session on an affected Windows 10, Windows 11, or Windows Server build - there is no remote or unauthenticated path. No public exploit code and no confirmed active exploitation have been identified (CISA KEV absent; SSVC exploitation: none), and the vendor has released fixed builds, so this is a low-to-moderate priority patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft Windows via the IKE Extension (IKEEXT) service, which can be crashed or disrupted when it processes malformed IKE protocol input, causing a buffer over-read (CWE-126). All supported Windows client and server platforms that ship IKEEXT are affected - including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 through 2025 - but only systems with IPsec/IKE or Windows VPN functionality active and network-reachable are exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an authorized attacker with low-level network access (not anonymous reachability) can cause an availability-only impact; there is no confidentiality or integrity effect and no code execution, and no public exploit has been identified at time of analysis (CISA SSVC: exploitation none, automatable no), making this a moderate-priority patching item rather than an emergency.
An authenticated, network-reachable attacker can disclose files outside the intended directory through absolute path traversal in the Windows Encrypting File System (EFS), tracked as CVE-2026-83683. Only unpatched Windows client and server builds are affected - for example Windows 11 24H2 before 10.0.26100.9711, Windows Server 2022 before 10.0.20348.5761, and legacy platforms back to Windows Server 2012 before 6.2.9200.26434. Exploitation requires the attacker to already hold low-privilege authenticated access (CVSS vector PR:L, AV:N), and the impact is limited to confidentiality (C:H with I:N/A:N), so there is no file modification or denial of service; no public exploit has been identified at time of analysis and CISA's SSVC assessment rates the issue non-automatable, making opportunistic mass exploitation unlikely.
Information disclosure in Microsoft Windows Installer allows an authenticated local attacker holding only low privileges to read sensitive system information that should remain outside their control sphere. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 including Server Core installations, with a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires prior local interactive authentication plus a high-complexity, non-deterministic condition; there is no remote vector, no user interaction, no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available per the Microsoft advisory.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An out-of-bounds read in the Windows WLAN Service lets a locally authenticated attacker disclose information from the host's memory on affected Windows 10, Windows 11 and Windows Server builds. Exploitation requires the attacker to already hold a low-privileged interactive logon or to run code under an existing user token on the target host (CVSS AV:L, PR:L); the issue is not remotely or anonymously reachable, no user interaction is needed (UI:N), and impact is limited to confidentiality (C:H with I:N/A:N), so there is no code execution or system modification. Severity is CVSS 5.5 (MEDIUM), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis; a vendor patch is available and the signal set is consistent with a moderate, low-priority hardening item.
An out-of-bounds read in Active Directory Domain Services (AD DS) on unpatched domain controllers allows an authenticated, low-privileged attacker to crash or hang the directory service over the network, producing a denial of service against domain authentication and directory lookups. The flaw requires a valid domain account or equivalent foothold (CVSS vector PR:L) and no user interaction; success yields only availability impact with no confidentiality or integrity loss (C:N/I:N/A:H, assessed 6.5). No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and non-automatable, and no CISA KEV listing exists, so this is a moderate-priority, availability-only issue affecting a critical infrastructure component rather than an emergency patch case.
Local information disclosure in the Windows Portable Device (WPD) File System driver affects Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 hosts that have not installed the corresponding cumulative update. A type-confusion flaw (CWE-843) lets an attacker who already holds an authenticated, low-privileged local session (CVSS AV:L/PR:L, no user interaction) coerce the driver into treating one object type as another and read memory the caller should not be able to access, yielding high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). There is no network vector, no public exploit identified at time of analysis, and CISA SSVC rates the issue non-automatable with only partial technical impact, so it is best treated as a moderate-priority local information-leak primitive to be fixed on a normal patch cycle rather than as an emergency.
Local information disclosure in Windows Error Reporting (WER) allows an authenticated low-privileged attacker with an existing session on a Windows host to read report data that should be restricted from their privilege level, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) under CWE-862 missing authorization. The impact is confidentiality-only: no data is modified and availability is unaffected, and because the vector is local there is no network path to exploit it, so the attacker must first hold valid low-privileged credentials or a running session on the machine. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', but vendor patches are available for the affected Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 builds listed in EUVD-2026-99319.
Weak authentication in the Windows Modern Device Management (MDM) component allows a locally authenticated, low-privilege user on Windows 10 Version 1809 or Windows Server 2019 (including Server Core) to tamper with device-management data and policy. Impact is integrity-only: there is no remote vector, no confidentiality loss and no denial of service, so exploitation requires an attacker to already hold a foothold on the host with a valid low-privilege account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is assessed as none under the CISA SSVC framework, the issue is not in CISA KEV, and no public exploit code has been identified at time of analysis, but a vendor patch is available from Microsoft, making this a moderate-severity patch-cycle item rather than an emergency.
An authenticated, network-positioned attacker can force an out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS), crashing the service and producing a denial of service on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The vulnerability is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so low-privilege valid credentials and network reachability are prerequisites; unauthenticated attackers cannot exploit it per the assessed vector, and the impact is confined to availability with no confidentiality or integrity consequence. Microsoft has published fixes via its update guide, CISA's SSVC assessment rates exploitation as none, and there is no public exploit identified at time of analysis - making this a moderate-severity, low-urgency patch-cycle item rather than an emergency.
Open redirect in Active Directory Federation Services (AD FS) allows an authenticated attacker to craft a federation/redirect URL that sends a victim to an attacker-controlled site while appearing to originate from a trusted AD FS endpoint. Only Windows systems with the AD FS role configured and reachable by users or the internet are affected - Windows Server 2016, 2019, 2022 and 2025 (including Server Core) plus Windows 10 1607 and 1809 builds below their listed fixed build numbers. Exploitation requires an authorized/high-privilege AD FS actor and a victim who interacts with the crafted URL, and the resulting impact is limited to spoofing (low confidentiality and integrity, no availability impact); there is no public exploit identified at time of analysis, KEV status is negative, and the moderate CVSS 4.8 score places this in a low-priority, hardening-class remediation bucket rather than an emergency one.
Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.
An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
Open redirect handling in Windows BitLocker (CWE-601) lets an attacker with physical possession of a BitLocker-protected device redirect to an untrusted destination and bypass the drive-encryption security feature, with high confidentiality and integrity impact assessed at CVSS 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector is unauthenticated and requires no user interaction, but the attack is strictly physical: it cannot be performed remotely or automated (CISA SSVC Automatable: no, Exploitation: none) and realistically applies to lost, stolen, or unattended hardware rather than devices kept under physical control. No public exploit identified at time of analysis, and Microsoft has shipped vendor-released patched builds for every affected Windows 10, Windows 11, and Windows Server version.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70288) allows an authenticated local attacker holding low privileges to read kernel-managed information belonging to other security contexts by winning a time-of-check time-of-use race. Every Windows client and server build below the patched levels published by Microsoft is affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through Server 2025. No public exploit has been identified at time of analysis, the flaw is not listed in CISA KEV, and CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate-severity, low-priority issue in practice despite NVD's CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
An out-of-bounds read in the Windows Fast FAT driver (fastfat.sys) lets a local attacker disclose kernel memory contents by persuading a user to mount or open an attacker-crafted FAT/exFAT volume, disk image, or VHD. Windows 10 and Windows 11 (23H2 through 26H2) plus Windows Server 2012 through 2025 are affected, and exploitation requires local access with user interaction while yielding information disclosure only - no code execution or system modification, which keeps severity moderate rather than critical. No public exploit code has been identified at time of analysis, no confirmed active exploitation is known, and a vendor patch is available from Microsoft's update guide.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Denial of service in Microsoft Windows Hyper-V allows an attacker with low-privileged local access inside a guest virtual machine to trigger a null pointer dereference in the hypervisor, crashing the host and every VM it runs. Affected platforms are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, including Server Core installations, but only where the Hyper-V role is enabled and untrusted users can control guest VMs. Microsoft has released a vendor patch and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the practical risk is moderate and concentrated in multi-tenant or shared-virtualization deployments rather than in general single-tenant environments.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Insufficiently granular access control in the Windows Mobile Device Management (MDM) component allows an authorized, locally present low-privileged user to tamper with MDM-managed state on the host, yielding high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the vendor-patched build numbers, and the gap is only meaningful where the MDM subsystem is enrolled or in use; a valid local standard-user account is a hard prerequisite. No public exploit code or active exploitation has been identified - CISA's SSVC assessment records Exploitation: none and Automatable: no - so this is a moderate-severity, low-priority issue in practice.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
Local denial of service in Windows DHCP Server (CVE-2026-70201) allows an authenticated attacker holding valid low-privilege credentials on a host running the DHCP Server role to crash the service by supplying malformed input that triggers an out-of-bounds read (CWE-125). Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) the issue is not remotely reachable and yields only availability impact, with no confidentiality or integrity loss and no code execution path. No public exploit identified at time of analysis: CISA SSVC records exploitation as 'none', automatable as 'no', technical impact as 'partial', and the CVE is not KEV-listed; Microsoft has shipped vendor patches, so urgency is low and the main prerequisite is that the DHCP Server role be installed and running (it is not enabled by default on typical member servers).
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
An out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to cause a denial of service (DoS) over the network. The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and Windows 10 Versions 1607 and 1809 when the DNS Server role is enabled; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code has been identified, and CISA SSVC rates exploitation as none, yielding a modest, non-urgent risk despite the network attack vector.
Improper authorization in the Windows Broadcast DVR User Service lets a locally authenticated, low-privileged user obtain confidential information that the service should not expose to them (CVSS 6.5, C:H/I:N/A:N). Exploitation requires an existing local foothold on the host (AV:L, PR:L) and no user interaction, and the affected service ships by default across Windows 10 21H2/22H2/1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019 including Server Core; there is no network vector and no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not listed in CISA KEV.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
Incorrect authorization in the Microsoft Windows DNS Server role allows a locally authenticated attacker with low privileges to bypass a DNS security feature and alter DNS resolution behavior on the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it cannot be triggered remotely or by an unauthenticated actor - the attacker must already hold a foothold on the server - and its impact is limited to integrity, with no confidentiality or availability loss and no user interaction required. All supported Windows Server generations that host the DNS Server role are affected, from Windows Server 2012 through Windows Server 2025, along with the Windows 10 1607 and 1809 clients that ship the same DNS components; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' (technical impact: partial), and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority hardening issue rather than an emergency.
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged attacker to tamper with DNS data or configuration, earning a CVSS 5.5 rating (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The flaw (CWE-862) affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installation variants, with integrity-only impact and no data disclosure or denial-of-service component. Microsoft has released a vendor patch per the MSRC update guide, and CISA's SSVC assessment records no known exploitation with no public exploit identified at time of analysis; because exploitation requires existing local credentials on the DNS server, real-world urgency is moderate rather than critical.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Incorrect authorization in the Windows DNS Server role allows an attacker who already holds a low-privileged local account or interactive logon session on the DNS host to tamper with DNS data or service configuration, degrading integrity with no confidentiality or availability impact. Affected systems span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) plus Windows 10 versions 1607 and 1809, in each case below the vendor's patched build numbers. Microsoft has released a fix, and no public exploit code has been identified at time of analysis; the SSVC assessment records exploitation as 'none', automatable as 'no' and technical impact as 'partial', so this is a genuine but moderate-priority issue rather than a top-tier emergency.
Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.
Time-of-check time-of-use race condition in Microsoft Windows Virtualization-Based Security (VBS) Enclave lets an attacker who already holds high local privileges bypass a security feature on the affected host, resulting in an integrity/security-feature bypass (CWE-367) rather than data disclosure, code execution, or denial of service. Only systems that actually use VBS Enclaves are in scope, and because exploitation requires PR:H local access plus successful timing of a race window, the issue is rated low severity (CVSS 4.4) with no public exploit identified at time of analysis. Vendor patches are available and this should be handled through routine Windows update cycles rather than emergency response.
An out-of-bounds read in the Windows DNS component lets a locally authenticated, low-privileged attacker cause the service to read past the end of an allocated buffer and leak information from process memory, giving high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an attacker to already hold local, authenticated low-privileged access to an affected Windows host - there is no remote or network-triggerable path - and no public exploit code has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'. Affected builds span Windows Server 2012 through Windows Server 2025 and Windows 10 versions 1607 and 1809, and Microsoft has released fixed builds for each, making this a moderate, low-priority patching item rather than an urgent emergency.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
Improper verification of cryptographic signatures in the Windows DNS Server component lets an authenticated, low-privileged attacker who already has local access to the host tamper with data that the service is supposed to validate, with the impact confined to integrity (no loss of confidentiality or availability). Exploitation is local only (AV:L, PR:L, UI:N) and requires a signature-validating configuration to be in use for the tampering to have meaning, so this is a moderate, non-urgent issue rather than a remotely reachable emergency. No public exploit code exists and there is no evidence of active exploitation, and CISA's SSVC assessment records Exploitation as none and Automatable as no; Microsoft has published patched builds that resolve the flaw.
Information disclosure in the Windows Kernel lets an attacker who already holds local, authenticated low-privilege access on a Windows host read past the bounds of a kernel buffer and leak adjacent kernel memory, but only when a hard-to-control precondition such as a race window or a specific kernel memory layout is satisfied. All currently supported Windows 10, Windows 11 and Windows Server builds below the patched levels listed in Microsoft's advisory are affected; the defect can neither modify data nor crash the system, so its impact is confined to confidentiality (C:H/I:N/A:N, CVSS 4.7). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no EPSS score was supplied with this record - the limiting factors are the local-access prerequisite and the complex triggering condition, making this a low-to-moderate priority despite the notable 'Windows Kernel' target.
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) lets a locally authenticated low-privileged attacker bypass a security feature, producing a high integrity impact (I:H) with no confidentiality or availability effect (CVSS 5.5, AV:L/PR:L/UI:N). The issue affects Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched versions and requires the RRAS role to be present, making it a post-compromise security-feature bypass rather than an initial-access path. No public exploit was identified at time of analysis (SSVC exploitation: none), and vendor patches are available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
Active Directory Federation Services (AD FS) on Windows Server 2019, 2022, and 2025 lets an unauthenticated network attacker bypass an authentication security feature, yielding a high integrity impact (CVSS 5.9, CWE-1390) with no credentials and no user interaction required. Exploitation depends on network reachability to the AD FS federation endpoint - which in many deployments is internet-facing - but the HIGH attack complexity (AC:H) means the attacker must also satisfy conditions outside their control, so reliable exploitation is difficult. There is no public exploit identified at time of analysis, and vendor-released patches are available for every affected build (Windows Server 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650 and later, including Server Core installations).
Authentication bypass in Microsoft Active Directory Federation Services (AD FS) allows a remote attacker with network reachability to the federation/SSO endpoint to satisfy an authentication check under specific conditions and obtain a trust outcome that should have been denied. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (base 5.9) confirms no credentials and no user interaction are required, while the High attack complexity signals the bypass succeeds only in particular attacker-uncontrolled token or request states rather than against every request; impact is integrity-only (C:N/I:H), meaning a modified or improperly validated authentication decision rather than data disclosure. Microsoft has released vendor fixes for the affected AD FS-enabled Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis, so risk concentrates on default-configured, internet-exposed, unpatched AD FS deployments.
A locally triggered NULL pointer dereference in the Windows Hyper-V virtual switch (VMSwitch) lets an authenticated low-privilege user crash the host's virtual networking component, causing a denial of service (CVSS 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H); confidentiality and integrity are unaffected. Only Windows systems with the Hyper-V role and virtual switching enabled are exposed, and successful triggering depends on a specific timing/state condition (AC:H), which keeps practical exploitation difficult; there is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with no automatable path. Although the vulnerable component is broad (Windows Server 2019 through 2025, Server Core, Windows 10 21H2/22H2/1809, and Windows 11 23H2 through 26H2 per the advisory), this is a moderate-severity, low-priority availability defect rather than an urgent threat.
Information disclosure in the Windows Desktop Window Manager (dwm.exe) allows a locally authenticated attacker holding only low-level user privileges to read memory beyond an intended buffer inside the compositor process, potentially exposing data belonging to the DWM session. Exploitation is not straightforward: it requires an existing local foothold and the high attack complexity indicated by the CVSS vector (AV:L/AC:H/PR:L/UI:N) means success likely depends on winning a race or hitting a specific memory state that the attacker cannot reliably control. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (Automatable: no), and the issue is confined to confidentiality impact (C:H/I:N/A:N); Microsoft has released fixes for all affected Windows branches, making this a low-priority local information-disclosure flaw that is best addressed through routine patch cycles.
Archive extraction path traversal in the Libarchive component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows a remote, unauthenticated attacker to write or overwrite files outside the intended destination directory, but only when a victim extracts a crafted tar/zip archive, so the attack is gated by mandatory user interaction (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, CWE-22). Impact is integrity-only - attackers cannot read data or cause denial of service, they can only plant or tamper with files in locations the victim's user context can write to, which can still be chained into persistence or code execution via planted configuration or startup artifacts. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as "none" and automatable as "no," and vendor patches are available per Microsoft's update guide.
Relative path traversal (CWE-23) in the Libarchive component shipped with Windows lets an unauthenticated remote attacker tamper with files on a target system if they can convince a user to open or extract a crafted archive - a condition reflected in the CVSS vector's UI:R requirement. Affected are supported Windows client and server builds below their respective patched levels, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations); impact is integrity-only (no confidentiality or availability effect), and the assessment notes no confirmed active exploitation (not in CISA KEV), no publicly available exploit code identified at time of analysis, and CISA SSVC rating Exploitation=none, Automatable=no, Technical Impact=partial. Vendor patch is available, making this a medium-severity (CVSS 6.5) issue that should be remediated through standard Windows update cycles.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
Local tampering in the Windows AppX Deployment Service allows an already-authenticated, low-privileged user to perform packaging and deployment operations that the service is supposed to restrict, weakening the integrity of installed app packages on the host. Affected platforms are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations, and exploitation requires an existing local foothold with low-level user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5). There is no public exploit code and no confirmed active exploitation - CISA SSVC records Exploitation=none and Automatable=no - so this is a medium-severity post-compromise integrity issue rather than a remotely reachable or self-propagating threat; Microsoft has published fixed builds for all affected branches.
Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.