Windows Server 2019
Monthly
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
An open redirect (CWE-601) in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated remote attacker to craft an AD FS sign-in URL whose redirect parameter points to an untrusted site, so a victim who clicks the link is bounced from the trusted federation endpoint to an attacker-controlled destination - spoofing the identity provider. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no credentials or privileges but must induce user interaction, and impact is confined to confidentiality/session or credential theft against the user rather than server compromise. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); Microsoft has released patched builds for the affected Windows Server and Windows 10 versions.
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged user to tamper with DNS configuration or zone data on affected hosts, yielding a high-integrity impact with no confidentiality or availability effect. Exploitation is constrained: the attacker must already hold local access to a server running the DNS Server role (Windows Server 2012 through 2025, including Server Core installations), and the issue cannot be triggered remotely or by an unauthenticated user. Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis; at CVSS 5.5 this is a moderate-severity integrity flaw whose practical risk is dominated by the prior-access requirement.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via a double-free memory corruption bug in Windows Failover Cluster affects multiple Windows Server editions from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. An authorized local attacker already holding high privileges can exploit heap corruption triggered by the double-free condition to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified and no CISA KEV listing exists; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Denial of service in the Windows iSCSI Target Service affects authenticated network users on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. An authorized low-privileged attacker can send a crafted network request that triggers an uncaught exception (CWE-248) in the iSCSI Target Service process, causing the service to terminate and disrupting storage connectivity for all iSCSI initiators connected to that target. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected Windows versions.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Tampering in Active Directory Certificate Services (AD CS) allows a low-privileged, authenticated network attacker to manipulate certificate issuance or PKI configuration by supplying inputs that bypass an incomplete deny list. Affected Windows Server versions span 2012 through 2025, as well as Windows 10 builds relying on AD CS. The CVSS vector confirms high integrity impact with no confidentiality or availability effect, consistent with the described tampering primitive. No public exploit has been identified at time of analysis, and a vendor-released patch is available.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Security feature bypass in the Windows Key Distribution Center (KDC) lets an authenticated, low-privileged principal in an Active Directory domain bypass an authorization check on a domain controller reachable over the network. Exploitation is not remote-unauthenticated: it requires valid low-privileged domain credentials (PR:L) plus network reach to a DC running the Kerberos KDC role, and the high attack complexity (AC:H) means success hinges on specific, attacker-uncontrolled conditions rather than a deterministic request, with no user interaction required. Impact is limited to confidentiality (C:H/I:N/A:N) and the flaw affects only KDC-bearing hosts, not standalone or workgroup Windows machines; Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA SSVC rates the issue non-automatable with no observed exploitation, making this a moderate-severity, lower-priority item despite touching a security-critical component.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Key Storage Provider (KSP) allows a locally authenticated attacker with high attack complexity to disclose potentially sensitive memory contents, though the impact is limited to confidentiality (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. This is a low-to-moderate priority issue despite the memory-safety class.
Local tampering in Microsoft Windows SmartScreen allows an authenticated, low-privileged attacker who already holds a session on the host to invoke a critical SmartScreen function that is missing an authentication check (CWE-306) and abuse it to alter protected state, yielding a high integrity impact while confidentiality and availability are unaffected. Exploitation requires local access and prior authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5), with no remote or unauthenticated path, and CISA's SSVC assessment records Exploitation: none and Automatable: no, which supports treating this as a moderate-priority hardening issue rather than an emergency. There is no public exploit identified at time of analysis and no confirmation of active exploitation; vendor-released patches are available for all listed Windows builds.
Security feature bypass in Windows Remote Desktop allows an on-path attacker who occupies a privileged man-in-the-middle position between an RDP client and server to defeat protections that depend on a broken or risky cryptographic algorithm (CWE-327), potentially exposing the confidentiality and integrity of the session. Exploitation is not a self-contained remote trigger: the victim must actually initiate an RDP session (UI:R) and the attacker must already sit on the network path (AC:H), although no credentials on the target are required (PR:N), which is reflected in the CVSS 3.1 base score of 6.8. Microsoft has released fixes for the affected Windows 10, Windows 11 and Windows Server builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the Windows Kernel can be triggered by an unauthenticated, network-based attacker who convinces a user to interact with crafted content, exploiting an out-of-bounds read (CWE-125). The vulnerability has a CVSS 3.1 score of 5.3 with availability-only impact (A:H; C:N/I:N); no data exposure or code execution is possible. No public exploit code has been identified at time of analysis, and CISA SSVC indicates no active exploitation, making real-world priority low. Microsoft has released patches.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).
An open redirect (CWE-601) in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated remote attacker to craft an AD FS sign-in URL whose redirect parameter points to an untrusted site, so a victim who clicks the link is bounced from the trusted federation endpoint to an attacker-controlled destination - spoofing the identity provider. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no credentials or privileges but must induce user interaction, and impact is confined to confidentiality/session or credential theft against the user rather than server compromise. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); Microsoft has released patched builds for the affected Windows Server and Windows 10 versions.
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged user to tamper with DNS configuration or zone data on affected hosts, yielding a high-integrity impact with no confidentiality or availability effect. Exploitation is constrained: the attacker must already hold local access to a server running the DNS Server role (Windows Server 2012 through 2025, including Server Core installations), and the issue cannot be triggered remotely or by an unauthenticated user. Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis; at CVSS 5.5 this is a moderate-severity integrity flaw whose practical risk is dominated by the prior-access requirement.
Secure Boot integrity bypass in Windows 10, Windows 11, and Windows Server 2016 through 2025 lets an authenticated local attacker with administrator or SYSTEM privileges load a boot component that Secure Boot should reject, because the boot chain fails to properly check certificate and bootloader revocation (CWE-299). The issue is rated CVSS 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - it requires pre-existing high privilege and Secure Boot enabled, and it can only undermine boot-chain integrity, with no confidentiality or availability loss. No public exploit identified at time of analysis, and Microsoft has shipped vendor patches; see remediation for exact fixed builds.
Heap-based buffer overflow in the Windows Portable Device (MTP) Driver lets an attacker who can physically attach a crafted MTP peripheral - a smartphone, camera, or rogue USB gadget - corrupt kernel heap memory and elevate privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server hosts. The CVSS vector (AV:P/AC:L/PR:N/UI:N) means no authentication and no user interaction are needed, but the physical-access prerequisite confines realistic risk to attended endpoints, kiosks, shared or public machines, and lost or stolen laptops rather than network-exposed systems. No public exploit code has been identified at time of analysis, and Microsoft has shipped patched builds, so this is a moderate-priority, patch-and-move-on issue rather than an emergency.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Information disclosure in the Windows Remote Desktop Protocol lets an authenticated remote attacker trigger an out-of-bounds read and leak memory contents over the network, with affected builds spanning Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation requires the target's RDP service to be enabled and network-reachable plus valid credentials (PR:L, consistent with Microsoft's 'authorized attacker' wording), and a high-complexity precondition outside the attacker's control must also be satisfied (AC:H), which is why the CVSS score is held to 5.3 even though the confidentiality impact alone is rated High. Impact is confined to information disclosure - no integrity or availability effect - and no public exploit has been identified at time of analysis; Microsoft has published an update-guide entry and vendor patches are available.
Privilege escalation in Windows StorPort allows a physically present attacker to exploit an untrusted pointer dereference in the Windows Storage Port Driver and gain high-integrity kernel-level code execution on unpatched Windows 10, Windows 11, and Windows Server systems. The assessed CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 6.8), meaning physical access is required, no logical authentication or user interaction is needed once that access is obtained, and the impact is high across confidentiality, integrity, and availability. A vendor patch is available; no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in Microsoft's Windows Network File System (NFS) server component allows an authenticated local attacker with low-level privileges to read memory contents the process should not expose, via an untrusted pointer dereference (CWE-822) rated CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw requires the Windows NFS server role/feature to be installed and running, which is not enabled by default, and high attack complexity suggests a race or specific memory-timing condition that is not reliably reproducible; there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so this is a moderate-severity, low-priority issue for most environments. Vendor-released patches are available for all affected Windows builds.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via a double-free memory corruption bug in Windows Failover Cluster affects multiple Windows Server editions from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. An authorized local attacker already holding high privileges can exploit heap corruption triggered by the double-free condition to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified and no CISA KEV listing exists; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Denial of service in the Windows iSCSI Target Service affects authenticated network users on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. An authorized low-privileged attacker can send a crafted network request that triggers an uncaught exception (CWE-248) in the iSCSI Target Service process, causing the service to terminate and disrupting storage connectivity for all iSCSI initiators connected to that target. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected Windows versions.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Tampering in Active Directory Certificate Services (AD CS) allows a low-privileged, authenticated network attacker to manipulate certificate issuance or PKI configuration by supplying inputs that bypass an incomplete deny list. Affected Windows Server versions span 2012 through 2025, as well as Windows 10 builds relying on AD CS. The CVSS vector confirms high integrity impact with no confidentiality or availability effect, consistent with the described tampering primitive. No public exploit has been identified at time of analysis, and a vendor-released patch is available.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.