Windows Server 2019
Monthly
Out-of-bounds read in Windows DHCP Server exposes adjacent memory contents and can crash the service, yielding both information disclosure and a high-severity denial-of-service condition on affected Windows systems. The flaw (CWE-125) is exploitable locally with low attack complexity and no user interaction, targeting systems where the DHCP Server role is installed across a broad range of Windows 10, 11, and Server editions from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via the MSRC update guide (CVE-2026-45608).
Out-of-bounds read in Microsoft's UxTheme Library (uxtheme.dll) enables a locally authenticated attacker to crash the affected Windows system, resulting in denial of service. The vulnerability spans a broad swath of Windows releases - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management critical for enterprise environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Mark of the Web (MOTW) protection mechanism failure across a broad range of Windows client and server releases allows unauthenticated network-based attackers to deliver files that evade the Zone.Identifier security tag, bypassing downstream defenses such as SmartScreen and Office Protected View that depend on MOTW presence. User interaction is required to trigger the bypass, limiting automated mass exploitation. No public exploit code exists and CISA has not listed this in KEV; however, the breadth of affected Windows versions - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - gives this vulnerability significant surface area as a link in social-engineering attack chains.
Information disclosure in the Windows Application Identity (AppID) Subsystem exposes sensitive data to locally authenticated, low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires only a local session with standard user privileges - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide affected surface spanning consumer and server SKUs makes patching a meaningful priority in multi-user or shared-system environments.
Use-after-free in the Windows Network Controller (NC) Host Agent enables a locally authenticated attacker to crash the service, resulting in a denial of service on affected Windows Server deployments. The vulnerability carries a CVSS score of 5.5 (Medium) with local attack vector and low-privilege requirements, limiting its blast radius to service availability - confidentiality and integrity are unaffected. No public exploit code exists and CISA KEV listing is absent at time of analysis, though a vendor patch from Microsoft is available and should be prioritized on Windows Server deployments leveraging Software Defined Networking.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated attacker to read sensitive information from memory without elevation of privilege. Affecting a wide range of Windows 10, Windows 11, and Windows Server builds, the vulnerability requires only low-privilege local access and no user interaction to trigger. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact, placing this in a lower-urgency remediation band despite the High confidentiality rating in the CVSS vector.
Local information disclosure in Windows Hyper-V enables an authenticated low-privileged attacker to access sensitive data they are not authorized to read, without any user interaction. Affected systems span a broad range of Windows desktop and server editions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis and no CISA KEV listing; however, the high confidentiality impact (C:H) and breadth of affected versions make this a meaningful patching priority, particularly in multi-tenant virtualization environments.
Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory contents through an uninitialized resource condition, allowing a low-privileged local user to read high-confidentiality data without any user interaction. The CVSS vector (AV:L/PR:L) confirms this is strictly a local privilege issue - no remote attack path exists - limiting its practical blast radius to insider threats and post-compromise lateral reconnaissance. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local attackers to disclose sensitive information across a wide breadth of Microsoft Windows desktop and server platforms. Spanning Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, the vulnerability carries a CVSS 5.5 Medium score with high confidentiality impact (C:H) but no integrity or availability impact. Microsoft has released patches via the June 2026 Patch Tuesday cycle; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Windows Push Notifications on a broad range of Windows 10, Windows 11, and Windows Server editions leaks sensitive memory contents to locally authenticated low-privileged users through an uninitialized resource condition (CWE-908). The CVSS vector confirms local attack vector with low-privilege authentication requirement, no user interaction needed, and high confidentiality impact - meaning an attacker who has already obtained a standard user account can read residual memory data that could include tokens, credentials, or other sensitive artifacts. No public exploit code exists and no active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Out-of-bounds read in the Windows Telephony Service exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. The flaw (CWE-125) is exploitable with only low privileges and no user interaction, yielding high confidentiality impact while leaving integrity and availability unaffected. No public exploit code or active exploitation has been identified; CISA's SSVC framework rates this as non-automatable with partial technical impact, placing it at medium operational priority.
Windows Kerberos out-of-bounds read (CWE-125) allows a low-privilege network attacker to crash the Kerberos authentication service across all actively supported Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. The attack requires prior domain authentication and high-complexity triggering conditions (CVSS AC:H), limiting opportunistic mass exploitation, though a successful attack against a domain controller can deny authentication domain-wide by crashing the KDC. Vendor patches are available via the Microsoft MSRC advisory; no public exploit code exists and SSVC confirms no observed exploitation at time of analysis.
Information disclosure in Windows Shell exposes sensitive data to authenticated low-privileged attackers, with a confirmed vendor patch available. The vulnerability stems from CWE-200 improper information exposure within the Windows Shell component, allowing confidentiality compromise with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact score (C:H) and low attack complexity elevate practical concern for environments where lateral movement or credential harvesting are threat vectors.
Null pointer dereference in Windows Kerberos enables an authenticated network attacker to crash the Kerberos service, causing denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is achievable over the network by any low-privilege authenticated user with no user interaction required, resulting in high availability impact (A:H) with no confidentiality or integrity consequences. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.
Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.
Windows Shell information disclosure vulnerability (CVE-2026-32151) allows authenticated network attackers to read sensitive data without authorization. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2012-2025, and associated Server Core installations. Microsoft has released vendor patches for all affected versions; exploitation requires valid credentials and network access but no user interaction.
Windows Biometric Service contains a race condition in concurrent resource access that allows unauthorized attackers to bypass biometric authentication controls via physical attack, affecting Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2019, 2022, and 2025. The vulnerability requires physical access to the device and carries a moderate CVSS score of 6.1 (physical attack vector); Microsoft has released patches for all affected versions.
Windows File Explorer exposes sensitive information to authenticated local users with low privileges, allowing them to read confidential data without modification or service disruption. This affects multiple Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025. Microsoft has released patches addressing the information disclosure vector; exploitation requires local system access and valid user credentials.
Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local attackers to read sensitive files through a flaw in access control validation. CVSS 5.5 indicates moderate risk with confidentiality impact but no integrity or availability compromise. Patch available from Microsoft; no public exploit code or active exploitation confirmed at time of analysis.
Improper authentication in Windows Active Directory enables local spoofing attacks on unauthenticated users, allowing attackers with local access to bypass authentication mechanisms and gain unauthorized access to sensitive information. This vulnerability affects multiple Windows 10 and Windows 11 versions as well as Windows Server 2016 through 2025. A vendor-released patch is available from Microsoft, and the moderate CVSS score (6.2) reflects the local attack vector requirement combined with high confidentiality impact.
Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.
Use-after-free memory corruption in Windows UPnP Device Host enables unauthenticated adjacent network attackers to disclose sensitive information with CVSS 6.5 high severity. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and multiple Windows Server editions (2012 through 2025). Microsoft has released patches with specific version thresholds; exploitation requires network adjacency but no authentication or user interaction.
Buffer over-read in Windows Kernel Memory allows authenticated local attackers to disclose sensitive kernel information with high confidence. CVE-2026-26169 affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016 through 2025. The vulnerability requires local access and low-level user privileges but does not enable privilege escalation or code execution. Microsoft has released vendor patches addressing the issue across all affected versions.
Type confusion in Windows COM component allows authenticated local attackers to read sensitive information from memory. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025 across multiple installation types. An attacker with local user privileges can exploit improper type handling in COM to disclose confidential data without modifying or disrupting system availability. Microsoft has released patches addressing this information disclosure risk.
Windows Recovery Environment Agent improperly stores sensitive information without adequate removal, allowing physical attackers to extract confidential data and bypass security features. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2016-2025, and Server Core installations across multiple builds. Microsoft has released vendor patches to remediate the information disclosure.
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim
Windows Kernel logs sensitive information that can be read by local authenticated users, allowing information disclosure on Windows 10 and Windows 11 systems across multiple versions as well as Windows Server 2012 through 2025. The vulnerability requires local access and valid user credentials (privilege level L) but results in high confidentiality impact. Microsoft has released patches for all affected versions.
Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, and 2025. An authorized local attacker with user-level privileges can access kernel log files to retrieve confidential data without elevated rights or user interaction. Microsoft has released patches addressing this CWE-532 insertion-of-sensitive-information vulnerability with specific build fixes across all affected editions.
Windows Boot Loader accepts untrusted inputs for security decisions, allowing authorized local attackers to bypass security features with high confidentiality, integrity, and availability impact. This authentication bypass vulnerability (CVSS 6.7) affects Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2016, 2019, and 2022. Microsoft has released patches addressing the root cause of reliance on untrusted security-critical inputs.
Windows Remote Procedure Call (RPC) discloses sensitive information to local authenticated users in Windows 10, Windows 11, and Windows Server 2016-2025. An authorized attacker with local access and limited privileges can read confidential data without user interaction, affecting multiple Windows editions across a 9-year product span. Patch availability confirmed from Microsoft; no active exploitation reported.
Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local users to access sensitive information without authorization. The vulnerability affects multiple Windows 10 versions (1607, 1809, 21H2, 22H2), Windows 11 versions (22H3 through 26H1), and Windows Server 2016 through 2025. Microsoft has released patches addressing this CWE-200 information exposure flaw, with no evidence of active exploitation at the time of analysis.
Windows Boot Manager contains an uninitialized resource vulnerability (CWE-908) that allows unauthorized attackers to bypass security features through physical access to affected systems. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025. While the CVSS score of 4.6 reflects the physical attack vector requirement and information disclosure impact, the authentication bypass nature comb
Microsoft Local Security Authority Subsystem Service (LSASS) information disclosure vulnerability allows authenticated network attackers to read sensitive memory contents via a bounds check bypass in the LSASS process. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. No public exploit code or active exploitation has been reported; vendor-released patches are available across all affected versions.
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows authorized local attackers to bypass security features, affecting Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016-2025. With a CVSS score of 5.7 and high privilege requirement (PR:H), the vulnerability requires administrative or high-privilege account access but presents significant confidentiality and integrity risk to isolated security domai
Unauthorized disclosure of sensitive information in Windows Accessibility Infrastructure (ATBroker.exe) affects Windows Server 2019, 2025, Windows 10 22h2, and Windows 11 25h2, allowing local authenticated attackers to read confidential data. The vulnerability requires user privileges and local access but poses no risk to system integrity or availability. No patch is currently available for this issue.
Windows Shell Link Processing leaks sensitive information over the network in Windows Server 2012, 2019, and 2022, enabling remote spoofing attacks without authentication or user interaction. An unauthenticated attacker can exploit this information disclosure to conduct spoofing attacks against affected systems. No patch is currently available.
A division by zero flaw in the Microsoft Graphics Component on Windows 10 and Windows 11 systems enables local attackers to trigger a denial of service condition without requiring special privileges or user interaction. The vulnerability affects multiple Windows versions including Windows 10 1607, 22h2 and Windows 11 25h2, 26h1, with no patch currently available.
Microsoft Graphics Component on Windows 10 21H2, Windows Server 2016, and Windows 11 25H2 is vulnerable to a null pointer dereference that enables local denial of service attacks. An attacker with local access can trigger the vulnerability without requiring elevated privileges or user interaction to crash the graphics component and render the system unavailable. No patch is currently available for this medium-severity vulnerability.
Windows Kerberos authentication in Server 2012 and Windows 10 (versions 1607, 1809) contains a race condition that enables unauthenticated remote attackers to circumvent security feature protections. The synchronization flaw in concurrent resource access allows attackers to bypass intended security controls without user interaction over the network. No patch is currently available for this vulnerability.
Windows Kernel inadvertently logs sensitive information accessible to authenticated local users, enabling information disclosure attacks. This medium-severity vulnerability affects Windows 10 22H2, Windows 11 23H2, and 24H2, as well as Linux systems, allowing authorized attackers with local access to retrieve confidential data. No patch is currently available for this issue.
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. [CVSS 6.4 MEDIUM]
Uninitialized memory in the Dynamic Root of Trust for Measurement (DRTM) component of Windows 11 25h2, Windows Server 2019, Windows 10 22h2, Windows 10 1809, and Windows 11 23h2 allows a high-privileged local attacker to read sensitive information from kernel memory. The vulnerability requires administrative or equivalent privileges to exploit and carries no patch availability. This issue is tracked under CWE-908 with a CVSS score of 4.4.
Windows File Explorer information disclosure affects Windows 10 and 11 systems, allowing local authenticated attackers to access sensitive data through improper access controls. The vulnerability requires valid user credentials and local system access, posing a risk in multi-user or shared computing environments where sensitive files may be exposed to other authorized users.
Windows File Explorer improperly restricts access to sensitive information, enabling authenticated local users to read confidential data without authorization. This vulnerability affects Windows 10 across multiple versions (1607, 1809, 21H2, 22H2) and requires valid user credentials and local system access to exploit. Currently, no patch is available to remediate this information disclosure issue.
Information disclosure in Windows NDIS allows a privileged local attacker with physical access to read sensitive kernel memory regions on Windows 10 and Windows 11 systems. The vulnerability requires both authentication and direct hardware interaction, limiting its practical exploitation to scenarios where an attacker has already compromised system access. No patch is currently available for affected Windows versions including 10 (21h2, 22h2) and 11 (25h2).
Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.
Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.
Windows NTLM authentication across multiple Windows versions (10, Server 2008/2019) allows remote attackers to manipulate file name or path parameters without authentication, enabling network-based identity spoofing attacks. The vulnerability requires user interaction and has no available patch, affecting systems still running older Windows Server editions alongside current Windows 10 releases. An attacker could impersonate legitimate services or users to compromise trust in networked communications.
Windows NTLM authentication is vulnerable to path manipulation attacks that enable network-based spoofing when users interact with malicious content, affecting Windows 10 22H2 and Windows Server editions 2008-2016. An unauthenticated attacker can exploit improper file name or path validation to impersonate legitimate systems or services, potentially redirecting authentication requests to attacker-controlled resources. No patch is currently available for this vulnerability.
Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.
Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.
Information disclosure in Windows Client-Side Caching Service allows authenticated local users to read sensitive data on affected systems including Windows 10, Windows 11, and Windows Server editions. An attacker with valid credentials can exploit improper access controls to access cached information without additional user interaction. No patch is currently available for this vulnerability.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Windows Server 2008 versions up to - is affected by use of a broken or risky cryptographic algorithm (CVSS 5.5).
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Windows Kernel inadvertently logs sensitive information to accessible log files, enabling local attackers to read confidential data on affected Windows and Linux systems. This information disclosure vulnerability requires no privileges or user interaction to exploit and impacts Windows Server 2016, 2022, and 2025 along with standard Windows installations. No patch is currently available for this medium-severity issue.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Local privilege escalation in the Windows Shell (the shell32/explorer component handling shell operations and namespace objects) lets an authenticated low-privileged attacker who can already run code on a Windows host race a shared resource against a concurrent privileged operation and cross a security boundary, gaining elevated rights on the same machine. The flaw is CWE-362 (improper synchronization / race condition) and carries CVSS 7.8 with Scope:Changed, reflecting that the vulnerable component's flaw impacts a component with different privileges, but the assessed vector (AC:H, PR:L, AV:L) means exploitation is non-deterministic, requires many timing attempts, and no remote or unauthenticated path exists. All supported Windows client and server branches are affected - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2016 through 2025 - and no public exploit code has been identified at time of analysis, with no CISA KEV listing, so real-world risk sits below what the raw 7.8 score suggests in isolation.
Privilege escalation in the Windows Shell lets a low-privileged local attacker who already has code execution on a host defeat the shell's shared-resource synchronization and gain SYSTEM-level rights (scope change, high confidentiality/integrity/availability impact). Exploitation is constrained on three fronts: the attacker must already hold a local foothold (PR:L), must win a timing-sensitive race condition (AC:H per CWE-362), and must wait for a victim to perform a normal shell or file operation that the attacker can race (UI:R). Affected platforms are Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025, with multi-user, RDP, and terminal-server hosts representing the highest-value targets; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated remote attacker to achieve code execution on affected hosts, but only where the optional RRAS role is installed and enabled and a user is induced to connect to an attacker-controlled routing or VPN endpoint (UI:R). The flaw is an untrusted pointer dereference (CWE-822) in a service that normally runs with high privilege, and it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Server 2025. EPSS is 1.32% (70th percentile) and no public exploit code has been identified at time of analysis; Microsoft has published a security update and third-party detection and mitigation scripts are available, but the non-default nature of the RRAS role and the mandatory user interaction keep exposure limited.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) allows an authenticated attacker with low privileges to gain SYSTEM-level access on affected Windows 10, 11, and Windows Server systems (2008 R2 through 2025). The flaw is an improper access control (CWE-284) issue reachable by local code, requiring no user interaction; exploitation is limited to post-compromise escalation from a standard user to SYSTEM. No public exploit was identified at time of analysis, and EPSS is low (0.37%, 28th percentile).
Information disclosure in Microsoft's Windows Routing and Remote Access Service (RRAS) allows an unauthenticated, remote attacker to trigger a buffer over-read that leaks memory contents over the network. The exposed population is narrow: exploitation requires the optional RRAS role to be enabled (it is not installed by default on Windows 10/11 or Windows Server SKUs), and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates victim-side interaction is needed rather than a fully passive server-side hit. Impact is confined to confidentiality (C:H with I:N/A:N - no code execution, tampering, or denial of service), and no public exploit code has been identified at time of analysis (EPSS 1.08%, roughly the 64th percentile), making this a moderate, non-urgent issue.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
Local privilege escalation in the Windows Projected File System (ProjFS) component allows an authenticated attacker who already holds low-privileged code execution on a host to elevate to a higher-integrity context, including kernel/SYSTEM, through a memory-safety flaw reported as an integer overflow or wraparound. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation is strictly local and requires no user interaction, but it also offers no remote or network-facing path, which is the main limit on real-world risk. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not urgent patching priority for unpatched Windows 10, Windows 11, and Windows Server systems where ProjFS is active.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged code-execution foothold on a Windows host to trigger a null pointer dereference in the service and escalate to higher privileges, rated CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every affected build - Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, plus the listed Windows Server releases including Server 2008 SP2 x64 - includes the CSC/Offline Files component by default, so no non-default configuration is required for exploitation. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with a post-compromise escalation primitive rather than a remotely reachable threat.
Privilege elevation on Windows 10, Windows 11, and Windows Server systems is possible when a locally authenticated attacker able to run code as a low-privileged user triggers a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS), assigned CVSS v3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft rates the outcome as high impact to confidentiality, integrity, and availability of the elevated context, so the flaw functions as an escalation building block that converts a standard-user foothold into SYSTEM-level access rather than a standalone entry point; no remote path exists and user interaction is not required. No public exploit code has been identified at time of analysis and EPSS is low at 0.40% (32nd percentile), so exploitation is currently expected to be targeted and post-compromise rather than broad and opportunistic.
A buffer over-read in the Windows Projected File System (ProjFS) kernel component lets a locally authenticated attacker who can already run code as a low-privileged user escalate to higher privileges on affected Windows 10, Windows 11, and Windows Server hosts. Because the flaw is reached through resource parsing (AV:L, PR:L, UI:N, AC:L), it is not remotely exploitable and serves primarily as a post-compromise escalation step rather than an initial access vector, but successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and EPSS is low at roughly 0.4% (32nd percentile), so this is a genuine but not urgent priority - patch on the normal monthly update cadence, with faster turnaround on multi-user or high-value systems where local code execution is plausible.
Local privilege escalation in Microsoft Windows stems from a buffer over-read (CWE-126) in the Projected File System filter driver (prjflt.sys), a kernel-mode component that ships in-box with Windows 10 1809, Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019, 2022, 2022 23H2 and 2025. An authenticated attacker who already holds low-privileged local code execution on the host can trigger the over-read and, because the flaw is reachable in kernel context, gain SYSTEM-level elevation - CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no unusual complexity, but a mandatory local foothold. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.40% (32nd percentile), so this is a patch-on-cycle item rather than an emergency, with priority driven by the number of unpatched Windows endpoints exposed to post-compromise escalation. Microsoft published the fix through its standard monthly update channel (MSRC advisory CVE-2025-62461).
Heap-based buffer overflow in the Windows Win32K GRFX kernel component allows a locally authenticated, low-privileged attacker to elevate privileges to SYSTEM on affected hosts. Impacted platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2, and Windows Server 2008 R2 SP1 through 2012 R2 as well as Server 2016/2019/2022 per vendor tagging. Exploitation requires an existing local foothold as a standard user (AV:L, PR:L, UI:N) and yields full confidentiality, integrity, and availability impact at CVSS 3.1 base 7.8 (HIGH); EPSS is 0.66% (49th percentile) and no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects supported Windows 10, Windows 11, and Windows Server builds, enabling a local attacker with low-privileged code execution to exploit an out-of-bounds read and gain elevated privileges. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires an existing local foothold; it is not remotely reachable and needs no user interaction. No public exploit identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not emergency-grade second-stage escalation issue.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) lets a low-privileged, authenticated user who can already log on to a host run crafted input against the MSMQ service and elevate to SYSTEM-level privileges (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N, C:H/I:H/A:H). The exposure is limited by configuration: MSMQ is an optional Windows component that is not installed or enabled by default, so only hosts that have deliberately deployed the queue service are affected, and the flaw is not remotely exploitable on its own - it is a post-foothold escalation step that requires an existing local session. Affected platforms include Windows 10 1607, 1809, 21H2 and 22H2 and Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2016 and 2019; no public exploit code has been identified at time of analysis and Microsoft's MSRC update guide entry is the authoritative remediation source. Overall this is a genuine but not top-tier priority: high impact if MSMQ is deployed, but gated behind local authenticated access and a non-default component.
Local privilege escalation in the Windows Storage VSP Driver allows an authenticated attacker with low-level privileges to elevate to SYSTEM on affected Windows systems. This post-access flaw requires the attacker to already have local code execution as a low-privileged user (PR:L, AV:L) and does not require user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis, though the EPSS score is 2.45% (84th percentile), indicating a moderate likelihood of exploitation. Affected platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 through 2025.
Local privilege escalation in the Windows Storage VSP (Virtual Storage Port) Driver allows an authenticated, low-privileged attacker who already has code execution on a Windows host to obtain SYSTEM-level control. Tracked as CVE-2025-59516 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025); no user interaction is required once local access exists. Exploitation is a post-compromise escalation step rather than an initial-access vector: there is no remote or network-facing exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while EPSS sits at 2.34% (83rd percentile), indicating elevated but not imminent exploitation likelihood.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated attacker holding only standard-user rights to read out of bounds and elevate to full SYSTEM-level impact on affected Windows hosts. The flaw is scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable and requires a pre-existing foothold with code execution as a low-privileged user; no user interaction is needed. EPSS is low at 0.40% (32nd percentile), no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV, though Microsoft has published a security update via its update guide.
Command injection in Windows PowerShell (CVE-2025-54100) lets an attacker execute arbitrary code in a victim's user context when that user opens or runs attacker-supplied content within the shell. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - it requires local access plus user interaction, not network reachability, so an attacker must first deliver a malicious script, file, or command and persuade the victim to execute it. It affects PowerShell as shipped by default across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 25H2), and Windows Server 2008 SP2 through 2025. EPSS is a modest 2.23% (82nd percentile), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis, making this actionable but not emergency-tier.
Out-of-bounds read in Windows DHCP Server exposes adjacent memory contents and can crash the service, yielding both information disclosure and a high-severity denial-of-service condition on affected Windows systems. The flaw (CWE-125) is exploitable locally with low attack complexity and no user interaction, targeting systems where the DHCP Server role is installed across a broad range of Windows 10, 11, and Server editions from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via the MSRC update guide (CVE-2026-45608).
Out-of-bounds read in Microsoft's UxTheme Library (uxtheme.dll) enables a locally authenticated attacker to crash the affected Windows system, resulting in denial of service. The vulnerability spans a broad swath of Windows releases - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management critical for enterprise environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Mark of the Web (MOTW) protection mechanism failure across a broad range of Windows client and server releases allows unauthenticated network-based attackers to deliver files that evade the Zone.Identifier security tag, bypassing downstream defenses such as SmartScreen and Office Protected View that depend on MOTW presence. User interaction is required to trigger the bypass, limiting automated mass exploitation. No public exploit code exists and CISA has not listed this in KEV; however, the breadth of affected Windows versions - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - gives this vulnerability significant surface area as a link in social-engineering attack chains.
Information disclosure in the Windows Application Identity (AppID) Subsystem exposes sensitive data to locally authenticated, low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires only a local session with standard user privileges - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide affected surface spanning consumer and server SKUs makes patching a meaningful priority in multi-user or shared-system environments.
Use-after-free in the Windows Network Controller (NC) Host Agent enables a locally authenticated attacker to crash the service, resulting in a denial of service on affected Windows Server deployments. The vulnerability carries a CVSS score of 5.5 (Medium) with local attack vector and low-privilege requirements, limiting its blast radius to service availability - confidentiality and integrity are unaffected. No public exploit code exists and CISA KEV listing is absent at time of analysis, though a vendor patch from Microsoft is available and should be prioritized on Windows Server deployments leveraging Software Defined Networking.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated attacker to read sensitive information from memory without elevation of privilege. Affecting a wide range of Windows 10, Windows 11, and Windows Server builds, the vulnerability requires only low-privilege local access and no user interaction to trigger. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact, placing this in a lower-urgency remediation band despite the High confidentiality rating in the CVSS vector.
Local information disclosure in Windows Hyper-V enables an authenticated low-privileged attacker to access sensitive data they are not authorized to read, without any user interaction. Affected systems span a broad range of Windows desktop and server editions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis and no CISA KEV listing; however, the high confidentiality impact (C:H) and breadth of affected versions make this a meaningful patching priority, particularly in multi-tenant virtualization environments.
Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory contents through an uninitialized resource condition, allowing a low-privileged local user to read high-confidentiality data without any user interaction. The CVSS vector (AV:L/PR:L) confirms this is strictly a local privilege issue - no remote attack path exists - limiting its practical blast radius to insider threats and post-compromise lateral reconnaissance. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local attackers to disclose sensitive information across a wide breadth of Microsoft Windows desktop and server platforms. Spanning Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, the vulnerability carries a CVSS 5.5 Medium score with high confidentiality impact (C:H) but no integrity or availability impact. Microsoft has released patches via the June 2026 Patch Tuesday cycle; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Windows Push Notifications on a broad range of Windows 10, Windows 11, and Windows Server editions leaks sensitive memory contents to locally authenticated low-privileged users through an uninitialized resource condition (CWE-908). The CVSS vector confirms local attack vector with low-privilege authentication requirement, no user interaction needed, and high confidentiality impact - meaning an attacker who has already obtained a standard user account can read residual memory data that could include tokens, credentials, or other sensitive artifacts. No public exploit code exists and no active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Out-of-bounds read in the Windows Telephony Service exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. The flaw (CWE-125) is exploitable with only low privileges and no user interaction, yielding high confidentiality impact while leaving integrity and availability unaffected. No public exploit code or active exploitation has been identified; CISA's SSVC framework rates this as non-automatable with partial technical impact, placing it at medium operational priority.
Windows Kerberos out-of-bounds read (CWE-125) allows a low-privilege network attacker to crash the Kerberos authentication service across all actively supported Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. The attack requires prior domain authentication and high-complexity triggering conditions (CVSS AC:H), limiting opportunistic mass exploitation, though a successful attack against a domain controller can deny authentication domain-wide by crashing the KDC. Vendor patches are available via the Microsoft MSRC advisory; no public exploit code exists and SSVC confirms no observed exploitation at time of analysis.
Information disclosure in Windows Shell exposes sensitive data to authenticated low-privileged attackers, with a confirmed vendor patch available. The vulnerability stems from CWE-200 improper information exposure within the Windows Shell component, allowing confidentiality compromise with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact score (C:H) and low attack complexity elevate practical concern for environments where lateral movement or credential harvesting are threat vectors.
Null pointer dereference in Windows Kerberos enables an authenticated network attacker to crash the Kerberos service, causing denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is achievable over the network by any low-privilege authenticated user with no user interaction required, resulting in high availability impact (A:H) with no confidentiality or integrity consequences. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.
Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.
Windows Shell information disclosure vulnerability (CVE-2026-32151) allows authenticated network attackers to read sensitive data without authorization. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2012-2025, and associated Server Core installations. Microsoft has released vendor patches for all affected versions; exploitation requires valid credentials and network access but no user interaction.
Windows Biometric Service contains a race condition in concurrent resource access that allows unauthorized attackers to bypass biometric authentication controls via physical attack, affecting Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2019, 2022, and 2025. The vulnerability requires physical access to the device and carries a moderate CVSS score of 6.1 (physical attack vector); Microsoft has released patches for all affected versions.
Windows File Explorer exposes sensitive information to authenticated local users with low privileges, allowing them to read confidential data without modification or service disruption. This affects multiple Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025. Microsoft has released patches addressing the information disclosure vector; exploitation requires local system access and valid user credentials.
Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local attackers to read sensitive files through a flaw in access control validation. CVSS 5.5 indicates moderate risk with confidentiality impact but no integrity or availability compromise. Patch available from Microsoft; no public exploit code or active exploitation confirmed at time of analysis.
Improper authentication in Windows Active Directory enables local spoofing attacks on unauthenticated users, allowing attackers with local access to bypass authentication mechanisms and gain unauthorized access to sensitive information. This vulnerability affects multiple Windows 10 and Windows 11 versions as well as Windows Server 2016 through 2025. A vendor-released patch is available from Microsoft, and the moderate CVSS score (6.2) reflects the local attack vector requirement combined with high confidentiality impact.
Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.
Use-after-free memory corruption in Windows UPnP Device Host enables unauthenticated adjacent network attackers to disclose sensitive information with CVSS 6.5 high severity. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and multiple Windows Server editions (2012 through 2025). Microsoft has released patches with specific version thresholds; exploitation requires network adjacency but no authentication or user interaction.
Buffer over-read in Windows Kernel Memory allows authenticated local attackers to disclose sensitive kernel information with high confidence. CVE-2026-26169 affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016 through 2025. The vulnerability requires local access and low-level user privileges but does not enable privilege escalation or code execution. Microsoft has released vendor patches addressing the issue across all affected versions.
Type confusion in Windows COM component allows authenticated local attackers to read sensitive information from memory. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025 across multiple installation types. An attacker with local user privileges can exploit improper type handling in COM to disclose confidential data without modifying or disrupting system availability. Microsoft has released patches addressing this information disclosure risk.
Windows Recovery Environment Agent improperly stores sensitive information without adequate removal, allowing physical attackers to extract confidential data and bypass security features. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2016-2025, and Server Core installations across multiple builds. Microsoft has released vendor patches to remediate the information disclosure.
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim
Windows Kernel logs sensitive information that can be read by local authenticated users, allowing information disclosure on Windows 10 and Windows 11 systems across multiple versions as well as Windows Server 2012 through 2025. The vulnerability requires local access and valid user credentials (privilege level L) but results in high confidentiality impact. Microsoft has released patches for all affected versions.
Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, and 2025. An authorized local attacker with user-level privileges can access kernel log files to retrieve confidential data without elevated rights or user interaction. Microsoft has released patches addressing this CWE-532 insertion-of-sensitive-information vulnerability with specific build fixes across all affected editions.
Windows Boot Loader accepts untrusted inputs for security decisions, allowing authorized local attackers to bypass security features with high confidentiality, integrity, and availability impact. This authentication bypass vulnerability (CVSS 6.7) affects Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2016, 2019, and 2022. Microsoft has released patches addressing the root cause of reliance on untrusted security-critical inputs.
Windows Remote Procedure Call (RPC) discloses sensitive information to local authenticated users in Windows 10, Windows 11, and Windows Server 2016-2025. An authorized attacker with local access and limited privileges can read confidential data without user interaction, affecting multiple Windows editions across a 9-year product span. Patch availability confirmed from Microsoft; no active exploitation reported.
Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local users to access sensitive information without authorization. The vulnerability affects multiple Windows 10 versions (1607, 1809, 21H2, 22H2), Windows 11 versions (22H3 through 26H1), and Windows Server 2016 through 2025. Microsoft has released patches addressing this CWE-200 information exposure flaw, with no evidence of active exploitation at the time of analysis.
Windows Boot Manager contains an uninitialized resource vulnerability (CWE-908) that allows unauthorized attackers to bypass security features through physical access to affected systems. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025. While the CVSS score of 4.6 reflects the physical attack vector requirement and information disclosure impact, the authentication bypass nature comb
Microsoft Local Security Authority Subsystem Service (LSASS) information disclosure vulnerability allows authenticated network attackers to read sensitive memory contents via a bounds check bypass in the LSASS process. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. No public exploit code or active exploitation has been reported; vendor-released patches are available across all affected versions.
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows authorized local attackers to bypass security features, affecting Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2016-2025. With a CVSS score of 5.7 and high privilege requirement (PR:H), the vulnerability requires administrative or high-privilege account access but presents significant confidentiality and integrity risk to isolated security domai
Unauthorized disclosure of sensitive information in Windows Accessibility Infrastructure (ATBroker.exe) affects Windows Server 2019, 2025, Windows 10 22h2, and Windows 11 25h2, allowing local authenticated attackers to read confidential data. The vulnerability requires user privileges and local access but poses no risk to system integrity or availability. No patch is currently available for this issue.
Windows Shell Link Processing leaks sensitive information over the network in Windows Server 2012, 2019, and 2022, enabling remote spoofing attacks without authentication or user interaction. An unauthenticated attacker can exploit this information disclosure to conduct spoofing attacks against affected systems. No patch is currently available.
A division by zero flaw in the Microsoft Graphics Component on Windows 10 and Windows 11 systems enables local attackers to trigger a denial of service condition without requiring special privileges or user interaction. The vulnerability affects multiple Windows versions including Windows 10 1607, 22h2 and Windows 11 25h2, 26h1, with no patch currently available.
Microsoft Graphics Component on Windows 10 21H2, Windows Server 2016, and Windows 11 25H2 is vulnerable to a null pointer dereference that enables local denial of service attacks. An attacker with local access can trigger the vulnerability without requiring elevated privileges or user interaction to crash the graphics component and render the system unavailable. No patch is currently available for this medium-severity vulnerability.
Windows Kerberos authentication in Server 2012 and Windows 10 (versions 1607, 1809) contains a race condition that enables unauthenticated remote attackers to circumvent security feature protections. The synchronization flaw in concurrent resource access allows attackers to bypass intended security controls without user interaction over the network. No patch is currently available for this vulnerability.
Windows Kernel inadvertently logs sensitive information accessible to authenticated local users, enabling information disclosure attacks. This medium-severity vulnerability affects Windows 10 22H2, Windows 11 23H2, and 24H2, as well as Linux systems, allowing authorized attackers with local access to retrieve confidential data. No patch is currently available for this issue.
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. [CVSS 6.4 MEDIUM]
Uninitialized memory in the Dynamic Root of Trust for Measurement (DRTM) component of Windows 11 25h2, Windows Server 2019, Windows 10 22h2, Windows 10 1809, and Windows 11 23h2 allows a high-privileged local attacker to read sensitive information from kernel memory. The vulnerability requires administrative or equivalent privileges to exploit and carries no patch availability. This issue is tracked under CWE-908 with a CVSS score of 4.4.
Windows File Explorer information disclosure affects Windows 10 and 11 systems, allowing local authenticated attackers to access sensitive data through improper access controls. The vulnerability requires valid user credentials and local system access, posing a risk in multi-user or shared computing environments where sensitive files may be exposed to other authorized users.
Windows File Explorer improperly restricts access to sensitive information, enabling authenticated local users to read confidential data without authorization. This vulnerability affects Windows 10 across multiple versions (1607, 1809, 21H2, 22H2) and requires valid user credentials and local system access to exploit. Currently, no patch is available to remediate this information disclosure issue.
Information disclosure in Windows NDIS allows a privileged local attacker with physical access to read sensitive kernel memory regions on Windows 10 and Windows 11 systems. The vulnerability requires both authentication and direct hardware interaction, limiting its practical exploitation to scenarios where an attacker has already compromised system access. No patch is currently available for affected Windows versions including 10 (21h2, 22h2) and 11 (25h2).
Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.
Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.
Windows NTLM authentication across multiple Windows versions (10, Server 2008/2019) allows remote attackers to manipulate file name or path parameters without authentication, enabling network-based identity spoofing attacks. The vulnerability requires user interaction and has no available patch, affecting systems still running older Windows Server editions alongside current Windows 10 releases. An attacker could impersonate legitimate services or users to compromise trust in networked communications.
Windows NTLM authentication is vulnerable to path manipulation attacks that enable network-based spoofing when users interact with malicious content, affecting Windows 10 22H2 and Windows Server editions 2008-2016. An unauthenticated attacker can exploit improper file name or path validation to impersonate legitimate systems or services, potentially redirecting authentication requests to attacker-controlled resources. No patch is currently available for this vulnerability.
Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.
Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.
Information disclosure in Windows Client-Side Caching Service allows authenticated local users to read sensitive data on affected systems including Windows 10, Windows 11, and Windows Server editions. An attacker with valid credentials can exploit improper access controls to access cached information without additional user interaction. No patch is currently available for this vulnerability.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Windows Server 2008 versions up to - is affected by use of a broken or risky cryptographic algorithm (CVSS 5.5).
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Windows Kernel inadvertently logs sensitive information to accessible log files, enabling local attackers to read confidential data on affected Windows and Linux systems. This information disclosure vulnerability requires no privileges or user interaction to exploit and impacts Windows Server 2016, 2022, and 2025 along with standard Windows installations. No patch is currently available for this medium-severity issue.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Local privilege escalation in the Windows Shell (the shell32/explorer component handling shell operations and namespace objects) lets an authenticated low-privileged attacker who can already run code on a Windows host race a shared resource against a concurrent privileged operation and cross a security boundary, gaining elevated rights on the same machine. The flaw is CWE-362 (improper synchronization / race condition) and carries CVSS 7.8 with Scope:Changed, reflecting that the vulnerable component's flaw impacts a component with different privileges, but the assessed vector (AC:H, PR:L, AV:L) means exploitation is non-deterministic, requires many timing attempts, and no remote or unauthenticated path exists. All supported Windows client and server branches are affected - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2016 through 2025 - and no public exploit code has been identified at time of analysis, with no CISA KEV listing, so real-world risk sits below what the raw 7.8 score suggests in isolation.
Privilege escalation in the Windows Shell lets a low-privileged local attacker who already has code execution on a host defeat the shell's shared-resource synchronization and gain SYSTEM-level rights (scope change, high confidentiality/integrity/availability impact). Exploitation is constrained on three fronts: the attacker must already hold a local foothold (PR:L), must win a timing-sensitive race condition (AC:H per CWE-362), and must wait for a victim to perform a normal shell or file operation that the attacker can race (UI:R). Affected platforms are Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025, with multi-user, RDP, and terminal-server hosts representing the highest-value targets; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated remote attacker to achieve code execution on affected hosts, but only where the optional RRAS role is installed and enabled and a user is induced to connect to an attacker-controlled routing or VPN endpoint (UI:R). The flaw is an untrusted pointer dereference (CWE-822) in a service that normally runs with high privilege, and it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Server 2025. EPSS is 1.32% (70th percentile) and no public exploit code has been identified at time of analysis; Microsoft has published a security update and third-party detection and mitigation scripts are available, but the non-default nature of the RRAS role and the mandatory user interaction keep exposure limited.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) allows an authenticated attacker with low privileges to gain SYSTEM-level access on affected Windows 10, 11, and Windows Server systems (2008 R2 through 2025). The flaw is an improper access control (CWE-284) issue reachable by local code, requiring no user interaction; exploitation is limited to post-compromise escalation from a standard user to SYSTEM. No public exploit was identified at time of analysis, and EPSS is low (0.37%, 28th percentile).
Information disclosure in Microsoft's Windows Routing and Remote Access Service (RRAS) allows an unauthenticated, remote attacker to trigger a buffer over-read that leaks memory contents over the network. The exposed population is narrow: exploitation requires the optional RRAS role to be enabled (it is not installed by default on Windows 10/11 or Windows Server SKUs), and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates victim-side interaction is needed rather than a fully passive server-side hit. Impact is confined to confidentiality (C:H with I:N/A:N - no code execution, tampering, or denial of service), and no public exploit code has been identified at time of analysis (EPSS 1.08%, roughly the 64th percentile), making this a moderate, non-urgent issue.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
Local privilege escalation in the Windows Projected File System (ProjFS) component allows an authenticated attacker who already holds low-privileged code execution on a host to elevate to a higher-integrity context, including kernel/SYSTEM, through a memory-safety flaw reported as an integer overflow or wraparound. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation is strictly local and requires no user interaction, but it also offers no remote or network-facing path, which is the main limit on real-world risk. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not urgent patching priority for unpatched Windows 10, Windows 11, and Windows Server systems where ProjFS is active.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged code-execution foothold on a Windows host to trigger a null pointer dereference in the service and escalate to higher privileges, rated CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every affected build - Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, plus the listed Windows Server releases including Server 2008 SP2 x64 - includes the CSC/Offline Files component by default, so no non-default configuration is required for exploitation. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with a post-compromise escalation primitive rather than a remotely reachable threat.
Privilege elevation on Windows 10, Windows 11, and Windows Server systems is possible when a locally authenticated attacker able to run code as a low-privileged user triggers a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS), assigned CVSS v3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft rates the outcome as high impact to confidentiality, integrity, and availability of the elevated context, so the flaw functions as an escalation building block that converts a standard-user foothold into SYSTEM-level access rather than a standalone entry point; no remote path exists and user interaction is not required. No public exploit code has been identified at time of analysis and EPSS is low at 0.40% (32nd percentile), so exploitation is currently expected to be targeted and post-compromise rather than broad and opportunistic.
A buffer over-read in the Windows Projected File System (ProjFS) kernel component lets a locally authenticated attacker who can already run code as a low-privileged user escalate to higher privileges on affected Windows 10, Windows 11, and Windows Server hosts. Because the flaw is reached through resource parsing (AV:L, PR:L, UI:N, AC:L), it is not remotely exploitable and serves primarily as a post-compromise escalation step rather than an initial access vector, but successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and EPSS is low at roughly 0.4% (32nd percentile), so this is a genuine but not urgent priority - patch on the normal monthly update cadence, with faster turnaround on multi-user or high-value systems where local code execution is plausible.
Local privilege escalation in Microsoft Windows stems from a buffer over-read (CWE-126) in the Projected File System filter driver (prjflt.sys), a kernel-mode component that ships in-box with Windows 10 1809, Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019, 2022, 2022 23H2 and 2025. An authenticated attacker who already holds low-privileged local code execution on the host can trigger the over-read and, because the flaw is reachable in kernel context, gain SYSTEM-level elevation - CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no unusual complexity, but a mandatory local foothold. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.40% (32nd percentile), so this is a patch-on-cycle item rather than an emergency, with priority driven by the number of unpatched Windows endpoints exposed to post-compromise escalation. Microsoft published the fix through its standard monthly update channel (MSRC advisory CVE-2025-62461).
Heap-based buffer overflow in the Windows Win32K GRFX kernel component allows a locally authenticated, low-privileged attacker to elevate privileges to SYSTEM on affected hosts. Impacted platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2, and Windows Server 2008 R2 SP1 through 2012 R2 as well as Server 2016/2019/2022 per vendor tagging. Exploitation requires an existing local foothold as a standard user (AV:L, PR:L, UI:N) and yields full confidentiality, integrity, and availability impact at CVSS 3.1 base 7.8 (HIGH); EPSS is 0.66% (49th percentile) and no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects supported Windows 10, Windows 11, and Windows Server builds, enabling a local attacker with low-privileged code execution to exploit an out-of-bounds read and gain elevated privileges. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires an existing local foothold; it is not remotely reachable and needs no user interaction. No public exploit identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not emergency-grade second-stage escalation issue.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) lets a low-privileged, authenticated user who can already log on to a host run crafted input against the MSMQ service and elevate to SYSTEM-level privileges (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N, C:H/I:H/A:H). The exposure is limited by configuration: MSMQ is an optional Windows component that is not installed or enabled by default, so only hosts that have deliberately deployed the queue service are affected, and the flaw is not remotely exploitable on its own - it is a post-foothold escalation step that requires an existing local session. Affected platforms include Windows 10 1607, 1809, 21H2 and 22H2 and Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2016 and 2019; no public exploit code has been identified at time of analysis and Microsoft's MSRC update guide entry is the authoritative remediation source. Overall this is a genuine but not top-tier priority: high impact if MSMQ is deployed, but gated behind local authenticated access and a non-default component.
Local privilege escalation in the Windows Storage VSP Driver allows an authenticated attacker with low-level privileges to elevate to SYSTEM on affected Windows systems. This post-access flaw requires the attacker to already have local code execution as a low-privileged user (PR:L, AV:L) and does not require user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis, though the EPSS score is 2.45% (84th percentile), indicating a moderate likelihood of exploitation. Affected platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 through 2025.
Local privilege escalation in the Windows Storage VSP (Virtual Storage Port) Driver allows an authenticated, low-privileged attacker who already has code execution on a Windows host to obtain SYSTEM-level control. Tracked as CVE-2025-59516 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025); no user interaction is required once local access exists. Exploitation is a post-compromise escalation step rather than an initial-access vector: there is no remote or network-facing exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while EPSS sits at 2.34% (83rd percentile), indicating elevated but not imminent exploitation likelihood.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated attacker holding only standard-user rights to read out of bounds and elevate to full SYSTEM-level impact on affected Windows hosts. The flaw is scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable and requires a pre-existing foothold with code execution as a low-privileged user; no user interaction is needed. EPSS is low at 0.40% (32nd percentile), no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV, though Microsoft has published a security update via its update guide.
Command injection in Windows PowerShell (CVE-2025-54100) lets an attacker execute arbitrary code in a victim's user context when that user opens or runs attacker-supplied content within the shell. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - it requires local access plus user interaction, not network reachability, so an attacker must first deliver a malicious script, file, or command and persuade the victim to execute it. It affects PowerShell as shipped by default across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 25H2), and Windows Server 2008 SP2 through 2025. EPSS is a modest 2.23% (82nd percentile), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis, making this actionable but not emergency-tier.