Windows Server 2019
Monthly
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library can be triggered by a local, authenticated low-privilege attacker to leak memory and, in the assessed worst case, achieve local privilege elevation on affected Windows 10, Windows 11, and Windows Server builds. This is a credible but not emergency-tier priority: exploitation demands a pre-existing local foothold and high attack complexity (race or precise memory/heap conditioning), and no public exploit or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft advisory, so affected fleets should be updated through normal patch cycles rather than treated as an emergency.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) allows an authenticated, low-privileged attacker who already has code execution on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to SYSTEM-level privileges by planting a symbolic link, junction, or hardlink at a path the service later resolves during a privileged file operation. The issue is a classic link-following flaw (CWE-59) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and no user interaction, and the affected service runs by default on all listed builds, so multi-user and shared hosts are the realistic exposure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); vendor patches are available, making this a credible operational priority but not an emergency.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in the Windows Modern Device Management (MDM) component allows an authenticated low-privileged user who already has code execution on a Windows host to gain SYSTEM-level privileges by triggering a use-after-free in the MDM code path. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning it is not remotely reachable, requires no victim interaction, and depends on the attacker already holding a local foothold; successful exploitation also requires winning the heap-reuse race to reclaim the freed object. Consistent with our independent assessment this is a moderate-priority local escalation issue, and no public exploit identified at time of analysis; Microsoft has released patches through its update guide.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
Local privilege escalation in the Microsoft Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged authenticated session on a Windows host to elevate to SYSTEM-level privileges by triggering a double-free memory corruption in the service. The flaw (CWE-415, CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affects the full range of supported Windows 10, Windows 11, and Windows Server releases enumerated in the EUVD data, including Server 2012 through Server 2025. Microsoft has published a vendor patch (MSRC update guide for CVE-2026-85829); CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so this is a post-access escalation risk rather than a wormable or remote-entry issue.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Performance Monitor (CWE-94 code injection) lets an attacker who already holds authenticated low-privileged access to a Windows host run code in a higher-privileged context, yielding full confidentiality, integrity and availability impact on that machine at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds include Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through Server 2025 (Server Core variants included) below their respective fixed build numbers. The attack is local-only and requires no victim interaction, so it is a post-compromise escalation path rather than an initial-access vector; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, though CISA rates the technical impact as total. Vendor patches are available from Microsoft via the MSRC update guide.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows Volume Manager Extension Driver (volmgrx) lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger an out-of-bounds read and escalate to full control of the machine, carrying a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected driver ships by default across an unusually wide range of releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, and Microsoft has published fixes through its MSRC Update Guide. Exploitation requires a pre-existing local foothold and cannot be triggered remotely, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates it Exploitation: none and Automatable: no, making this a moderate post-compromise hardening priority rather than an emergency.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.
An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.
Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.
A local privilege-escalation flaw in the Windows Hyper-V hypervisor's file-access path (CWE-59, improper link resolution) allows an attacker who already holds authenticated low-privileged code execution on a Hyper-V-enabled host to have a privileged operation follow an attacker-planted symbolic link, junction, or hard link, resulting in full loss of confidentiality and integrity (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H). Impact is limited to systems where the Hyper-V role is actually installed or enabled, since non-virtualization Windows installs do not expose the vulnerable component; exploitation is not remote and requires a pre-existing foothold. No public exploit was identified at time of analysis and CISA SSVC rates the issue as not automatable, though a vendor patch is available per Microsoft's advisory. Because the escalation yields SYSTEM-level access on virtualization hosts, the effective blast radius is high wherever Hyper-V underpins tenant or workload isolation.
Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated network requests to a reachable Active Directory Federation Services (AD FS) endpoint on unpatched Windows Server builds can drive excessive memory allocation and exhaust the service's resources, denying service to legitimate users. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, privileges, or user interaction are required, but the impact is confined to availability - no confidentiality or integrity loss and no code execution. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so this is a genuine but moderate-priority availability risk for organizations that actually run the AD FS role; Microsoft has published fixed builds for the affected Windows Server 2012 through 2025 and Server Core platforms.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Unauthenticated remote denial of service in the Active Directory Federation Services (AD FS) role on Windows Server: a network attacker who can reach the AD FS listener can drive unbounded resource allocation (CWE-770), exhausting memory/threads/connections and taking the federation service offline. Per the assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, privileges, or user interaction are required against a default-configured service; exploitability is gated purely by whether the AD FS endpoints are reachable by untrusted clients (internet-published or untrusted-segment federations are the exposed case, while non-exposed or AD FS-less hosts are not affected). Affected builds span Windows Server 2012 R2 through 2025 below their patched build levels, and the vendor has released patch data; no public exploit has been identified at time of analysis and CISA SSVC records Exploitation: none, so this is a genuine but bounded availability risk rather than an active campaign. Impact is confined to availability - there is no confidentiality or integrity loss.
Unbounded resource allocation in Microsoft Active Directory Federation Services (AD FS) lets an unauthenticated remote attacker consume server resources and degrade or deny service, with the AD FS authentication endpoint itself being the attack surface. Only hosts that actually run the AD FS role on the unpatched Windows Server 2012 through 2025 and Windows 10 1607/1809 builds listed in the vendor data are exposed, so environments that do not deploy AD FS or that keep its endpoints off the public internet are largely unaffected. The flaw is remote, low-complexity, and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and while CISA's SSVC assessment rates it automatable, exploitation has not been observed and no public exploit code or proof of concept was identified at time of analysis; the assessed impact is availability-only, with confidentiality and integrity untouched.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
Denial of service in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to crash the service by sending crafted network traffic that triggers a null pointer dereference, taking down routing, VPN, NAT, and dial-up functions on the host. Per the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), exploitation requires no credentials and no user interaction, and the impact is confined to availability with no confidentiality or integrity effect. The practical limitation is deployment: RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or NAT/dial-up endpoints with a reachable listener are exposed; CISA's SSVC assessment rates exploitation as 'none' and no public exploit has been identified at time of analysis, though the attack is automatable and a vendor patch is available.
Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Local privilege escalation in the Windows Telephony Server (TAPI) allows an authenticated, low-privileged local user to gain elevated rights - potentially SYSTEM - by triggering a use-after-free in the telephony stack. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the EUVD data below the vendor's patched build levels are affected, and because the vulnerable component is present by default, exposure is broad even though the attack is not remote. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier priority: it only becomes dangerous after an attacker has already obtained a foothold on the host and can interact with the TAPI service.
A double-free memory corruption flaw in Microsoft's Remote Desktop Gateway (RD Gateway) role service allows an unauthenticated remote attacker to execute code with high confidentiality and integrity impact on affected Windows Server builds (2012 through 2025, including Server Core installations) and on Windows 10 1607 and 1809. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms the flaw is remotely reachable without credentials or user interaction, but exploitation is gated by high attack complexity: reliably triggering the double free generally requires winning a race condition or hitting a precise memory/timing state, which is why CISA's SSVC rates the issue as not automatable with no observed exploitation. There is no KEV listing and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine high-priority issue for internet-facing RD Gateway hosts rather than a drop-everything emergency on current signals.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.
An out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows a network-positioned attacker to corrupt memory in a high-privilege system process and execute arbitrary code, with the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicating a low-privilege authenticated attacker, no user interaction, and full confidentiality, integrity, and availability impact. The affected surface spans essentially the entire supported Windows fleet, from Windows Server 2012/2012 R2 and Windows 10 1607 through Windows 11 26H2 and Windows Server 2025, so unpatched domain controllers and member servers are the highest-value targets. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none and the flaw as non-automatable, meaning exploitation is not trivial to script at scale; Microsoft has released fixed builds for all affected branches.
Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.
Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library can be triggered by a local, authenticated low-privilege attacker to leak memory and, in the assessed worst case, achieve local privilege elevation on affected Windows 10, Windows 11, and Windows Server builds. This is a credible but not emergency-tier priority: exploitation demands a pre-existing local foothold and high attack complexity (race or precise memory/heap conditioning), and no public exploit or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft advisory, so affected fleets should be updated through normal patch cycles rather than treated as an emergency.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) allows an authenticated, low-privileged attacker who already has code execution on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to SYSTEM-level privileges by planting a symbolic link, junction, or hardlink at a path the service later resolves during a privileged file operation. The issue is a classic link-following flaw (CWE-59) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and no user interaction, and the affected service runs by default on all listed builds, so multi-user and shared hosts are the realistic exposure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); vendor patches are available, making this a credible operational priority but not an emergency.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in the Windows Modern Device Management (MDM) component allows an authenticated low-privileged user who already has code execution on a Windows host to gain SYSTEM-level privileges by triggering a use-after-free in the MDM code path. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning it is not remotely reachable, requires no victim interaction, and depends on the attacker already holding a local foothold; successful exploitation also requires winning the heap-reuse race to reclaim the freed object. Consistent with our independent assessment this is a moderate-priority local escalation issue, and no public exploit identified at time of analysis; Microsoft has released patches through its update guide.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
Local privilege escalation in the Microsoft Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged authenticated session on a Windows host to elevate to SYSTEM-level privileges by triggering a double-free memory corruption in the service. The flaw (CWE-415, CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affects the full range of supported Windows 10, Windows 11, and Windows Server releases enumerated in the EUVD data, including Server 2012 through Server 2025. Microsoft has published a vendor patch (MSRC update guide for CVE-2026-85829); CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so this is a post-access escalation risk rather than a wormable or remote-entry issue.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Performance Monitor (CWE-94 code injection) lets an attacker who already holds authenticated low-privileged access to a Windows host run code in a higher-privileged context, yielding full confidentiality, integrity and availability impact on that machine at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds include Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through Server 2025 (Server Core variants included) below their respective fixed build numbers. The attack is local-only and requires no victim interaction, so it is a post-compromise escalation path rather than an initial-access vector; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, though CISA rates the technical impact as total. Vendor patches are available from Microsoft via the MSRC update guide.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows Volume Manager Extension Driver (volmgrx) lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger an out-of-bounds read and escalate to full control of the machine, carrying a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected driver ships by default across an unusually wide range of releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, and Microsoft has published fixes through its MSRC Update Guide. Exploitation requires a pre-existing local foothold and cannot be triggered remotely, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates it Exploitation: none and Automatable: no, making this a moderate post-compromise hardening priority rather than an emergency.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.
An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.
Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.
A local privilege-escalation flaw in the Windows Hyper-V hypervisor's file-access path (CWE-59, improper link resolution) allows an attacker who already holds authenticated low-privileged code execution on a Hyper-V-enabled host to have a privileged operation follow an attacker-planted symbolic link, junction, or hard link, resulting in full loss of confidentiality and integrity (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H). Impact is limited to systems where the Hyper-V role is actually installed or enabled, since non-virtualization Windows installs do not expose the vulnerable component; exploitation is not remote and requires a pre-existing foothold. No public exploit was identified at time of analysis and CISA SSVC rates the issue as not automatable, though a vendor patch is available per Microsoft's advisory. Because the escalation yields SYSTEM-level access on virtualization hosts, the effective blast radius is high wherever Hyper-V underpins tenant or workload isolation.
Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated network requests to a reachable Active Directory Federation Services (AD FS) endpoint on unpatched Windows Server builds can drive excessive memory allocation and exhaust the service's resources, denying service to legitimate users. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, privileges, or user interaction are required, but the impact is confined to availability - no confidentiality or integrity loss and no code execution. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so this is a genuine but moderate-priority availability risk for organizations that actually run the AD FS role; Microsoft has published fixed builds for the affected Windows Server 2012 through 2025 and Server Core platforms.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Unauthenticated remote denial of service in the Active Directory Federation Services (AD FS) role on Windows Server: a network attacker who can reach the AD FS listener can drive unbounded resource allocation (CWE-770), exhausting memory/threads/connections and taking the federation service offline. Per the assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, privileges, or user interaction are required against a default-configured service; exploitability is gated purely by whether the AD FS endpoints are reachable by untrusted clients (internet-published or untrusted-segment federations are the exposed case, while non-exposed or AD FS-less hosts are not affected). Affected builds span Windows Server 2012 R2 through 2025 below their patched build levels, and the vendor has released patch data; no public exploit has been identified at time of analysis and CISA SSVC records Exploitation: none, so this is a genuine but bounded availability risk rather than an active campaign. Impact is confined to availability - there is no confidentiality or integrity loss.
Unbounded resource allocation in Microsoft Active Directory Federation Services (AD FS) lets an unauthenticated remote attacker consume server resources and degrade or deny service, with the AD FS authentication endpoint itself being the attack surface. Only hosts that actually run the AD FS role on the unpatched Windows Server 2012 through 2025 and Windows 10 1607/1809 builds listed in the vendor data are exposed, so environments that do not deploy AD FS or that keep its endpoints off the public internet are largely unaffected. The flaw is remote, low-complexity, and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and while CISA's SSVC assessment rates it automatable, exploitation has not been observed and no public exploit code or proof of concept was identified at time of analysis; the assessed impact is availability-only, with confidentiality and integrity untouched.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
Denial of service in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to crash the service by sending crafted network traffic that triggers a null pointer dereference, taking down routing, VPN, NAT, and dial-up functions on the host. Per the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), exploitation requires no credentials and no user interaction, and the impact is confined to availability with no confidentiality or integrity effect. The practical limitation is deployment: RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or NAT/dial-up endpoints with a reachable listener are exposed; CISA's SSVC assessment rates exploitation as 'none' and no public exploit has been identified at time of analysis, though the attack is automatable and a vendor patch is available.
Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Local privilege escalation in the Windows Telephony Server (TAPI) allows an authenticated, low-privileged local user to gain elevated rights - potentially SYSTEM - by triggering a use-after-free in the telephony stack. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the EUVD data below the vendor's patched build levels are affected, and because the vulnerable component is present by default, exposure is broad even though the attack is not remote. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier priority: it only becomes dangerous after an attacker has already obtained a foothold on the host and can interact with the TAPI service.
A double-free memory corruption flaw in Microsoft's Remote Desktop Gateway (RD Gateway) role service allows an unauthenticated remote attacker to execute code with high confidentiality and integrity impact on affected Windows Server builds (2012 through 2025, including Server Core installations) and on Windows 10 1607 and 1809. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms the flaw is remotely reachable without credentials or user interaction, but exploitation is gated by high attack complexity: reliably triggering the double free generally requires winning a race condition or hitting a precise memory/timing state, which is why CISA's SSVC rates the issue as not automatable with no observed exploitation. There is no KEV listing and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine high-priority issue for internet-facing RD Gateway hosts rather than a drop-everything emergency on current signals.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.
An out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows a network-positioned attacker to corrupt memory in a high-privilege system process and execute arbitrary code, with the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicating a low-privilege authenticated attacker, no user interaction, and full confidentiality, integrity, and availability impact. The affected surface spans essentially the entire supported Windows fleet, from Windows Server 2012/2012 R2 and Windows 10 1607 through Windows 11 26H2 and Windows Server 2025, so unpatched domain controllers and member servers are the highest-value targets. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none and the flaw as non-automatable, meaning exploitation is not trivial to script at scale; Microsoft has released fixed builds for all affected branches.
Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.
Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.