Windows Server 2019
Monthly
Local privilege escalation in Microsoft Windows Search (CWE-59, link following) allows an authenticated low-privileged local user to elevate to a higher-integrity context by manipulating filesystem links that the Windows Search indexing component resolves before accessing a file, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a pre-existing local foothold and the ability to create symbolic links, junctions, or hard links in a location processed by the privileged Search service; no user interaction or network access is needed, and CISA SSVC rates it as not automatable, making this a post-compromise escalation step rather than an initial-access or wormable vector. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has released vendor updates, so affected systems should be patched on the normal monthly cadence rather than treated as an emergency.
Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.
Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.
Local privilege escalation in the Windows Now Playing Session Manager (NPSM) - a default component of supported Windows 10, Windows 11, and Windows Server builds - lets an attacker who already holds authenticated, interactive local access (CVSS 3.1 AV:L/PR:L/UI:N, score 7.8) corrupt memory via a use-after-free and execute code with elevated privileges. Exploitation is not automatable and requires the victim host to already be compromised or a low-privileged local user to be present; no public exploit code was identified at time of analysis and the CISA SSVC evaluation records exploitation as none, while CISA's technical-impact assessment is total (full loss of confidentiality, integrity, and availability on the vulnerable host). The flaw is a standard local privilege-escalation primitive rather than a remote entry point, and Microsoft has published fixed builds for every affected version.
A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.
Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already holds a low-privileged foothold on an affected Windows 10, Windows 11, or Windows Server build corrupt kernel memory and elevate to SYSTEM-level privileges. The defect is a use-after-free (CWE-416) that is reachable on default installations with no user interaction, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Microsoft has shipped a vendor patch through its Security Update Guide. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no, so this should be handled as a standard monthly-patching priority rather than an emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Authentication spoofing in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated remote attacker to impersonate or spoof identities through the federation service on affected, unpatched Windows builds, yielding high confidentiality, integrity, and availability impact (CVSS 8.1, AV:N/PR:N/UI:N, C:H/I:H/A:H). Only systems that run the AD FS role on Windows Server 2016, 2019, 2022, or 2025 (including Server Core installations) and the corresponding Windows 10 1607/1809 identity builds are exposed, and the service endpoint must be reachable over the network. The high attack-complexity rating and the CISA SSVC assessment (Exploitation: none, Automatable: no) indicate that reliable exploitation depends on specific, hard-to-control preconditions; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV).
Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.
Local privilege escalation in Windows Error Reporting (WER) allows an attacker who already holds low-privilege, authenticated access to a vulnerable Windows host to elevate to higher privileges, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use of uninitialized resource (CWE-908) inside the WER component, reachable without user interaction once the attacker can execute code or hold a session on the target; there is no remote vector, so prior local access is the key limiting factor. Unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 builds below the vendor-published fixed build numbers are affected; a vendor patch is available and no public exploit code or confirmed active exploitation has been identified at the time of analysis (CISA SSVC exploitation: none, automatable: no).
Local privilege escalation in Windows Active Directory Certificate Services (AD CS) arises from a race condition (CWE-362) on a shared resource, letting an attacker who already holds a low-privileged, locally authenticated account on an AD CS host gain elevated privileges with high impact to confidentiality, integrity, and availability. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable and requires no victim interaction, but its high attack complexity means success depends on winning a narrow, timing-dependent race, so exploitation is non-deterministic and may need many attempts rather than being cleanly automatable - consistent with CISA's SSVC rating of exploitation 'none' and automatable 'no'. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Microsoft has shipped a vendor update, making patching the definitive fix.
Denial of service in Windows DHCP Server allows unauthenticated remote attackers to crash the DHCP service via a null pointer dereference. Exploitation requires the DHCP Server role to be installed and running on affected builds of Windows Server 2012 through 2025 (including Server Core installations) and Windows 10 1607/1809, with the attacker able to reach the service over the network through UDP 67/68 or the RPC management interface. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the impact is availability-only with no confidentiality or integrity loss.
Local privilege escalation in the Windows User Profile Service (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets an attacker who already holds valid low-privileged local access redirect privileged file operations through attacker-created symbolic links, junctions, or hardlinks, yielding high-integrity file writes that can be leveraged for SYSTEM-level code execution. Affected are all currently supported Windows client and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - and default configurations are vulnerable with no special feature needing to be enabled. Vendor-released patches are available from Microsoft; no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so priority should track routine monthly patching rather than emergency response.
An out-of-bounds read in the Windows Network Policy Server (NPS) role lets unauthenticated remote attackers crash or degrade the service, producing a denial-of-service condition on hosts that expose NPS to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials, user interaction, or client-side conditions are required once NPS is reachable, and impact is confined to availability - no code execution, integrity, or confidentiality loss. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, though the flaw is rated Automatable: yes and affects a broad set of Windows client and server builds spanning Windows 10/11 and Windows Server 2012 through 2025; a vendor patch is available and should be prioritized on internet- or partner-facing RADIUS infrastructure.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
An out-of-bounds read in the Windows Graphics Device Interface (GDI) allows remote attackers to disclose information from process memory on affected Windows 10, Windows 11 and Windows Server builds. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, 7.5) rates it as a high-confidentiality, no-integrity, no-availability impact issue affecting the default graphics stack rather than an optional feature. Exploitation status is limited: CISA SSVC records no known exploitation, no public exploit code has been identified at time of analysis, EPSS is 0.94% (60th percentile), and Microsoft has released fixed builds for every affected branch, so the priority signals point to a moderate, non-emergency remediation within the current patch cycle.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
Unauthenticated remote attackers can exhaust service resources on internet-facing Microsoft Active Directory Federation Services (AD FS) deployments, causing denial of service to federated authentication. Tracked as CVE-2026-83645 (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-770), exploitation requires only network reachability to an AD FS federation endpoint - no credentials, privileges, or user interaction - and the affected scope covers Windows Server 2012 through 2025 plus Windows 10 1607/1809 where the AD FS role is installed. Impact is confined to availability of the federation service with no confidentiality or integrity loss, and there is no public exploit identified at time of analysis with CISA SSVC recording no observed exploitation, making this a genuine but moderate-priority availability issue rather than an emergency.
Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.
Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An out-of-bounds read in Windows kernel-mode drivers (CVE-2026-83637, CWE-125, CVSS 7.8) lets an attacker who already holds low-privileged local code execution on a Windows host escalate to full kernel privileges, yielding high confidentiality, integrity, and availability impact. Successful exploitation requires an existing local foothold and an authenticated session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); there is no remote or unauthenticated attack path and no user interaction is needed. No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not automatable), and Microsoft has released vendor patches for all affected Windows 10, Windows 11, and Windows Server editions.
Denial of service in Windows DNS Server: an unauthenticated, network-reachable attacker can send crafted DNS traffic to a host running the DNS Server role and trigger an out-of-bounds read (CWE-125) that disrupts or crashes the service, scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only). Unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 installations are affected, with Active Directory domain controllers and internet-facing resolvers carrying the greatest exposure because the DNS role must be listening by default; there is no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact. Microsoft has released fixes through the MSRC update guide, and the impact is confined to service disruption with no code execution or data disclosure resulting.
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in Windows Core Messaging lets an authenticated attacker who already holds low-privilege code execution on a host escalate to a higher-integrity, potentially SYSTEM-level context. The underlying defect is an untrusted pointer dereference (CWE-822) reached through a crafted program that calls into the Core Messaging user-mode code path; attack complexity is low and no user interaction is required, but the attacker must first be logged on locally (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), making this an EoP primitive usable only after an initial foothold, not a remote or unauthenticated vector. Per available intelligence there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), though SSVC rates the technical impact as total and fully patched systems are not exploitable. All supported Windows client and server builds below the vendor-patched build numbers - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - are affected.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.
Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Geotag Broker component of Microsoft Windows lets an authenticated low-privileged user already running code on a host elevate to a higher-integrity context, with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating high impact to confidentiality, integrity and availability and no user interaction required. Affected systems are unpatched Windows 10, Windows 11 and Windows Server builds below the fixed build numbers published by the vendor, including Server Core installations; exploitation requires local interactive or code-execution access (PR:L, AV:L), so risk is concentrated on multi-user hosts such as RDP/terminal servers, shared workstations and systems where untrusted users can run code. There is no public exploit identified at time of analysis and no CISA KEV listing, and Microsoft has released a vendor patch - this is a patch-priority issue rather than a remotely exploitable emergency.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.
Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Local privilege escalation in the Windows NTFS file-system driver (CVE-2026-83567) allows an authenticated attacker who can already execute code on a Windows host to trigger an out-of-bounds read, which Microsoft scores as a full compromise of confidentiality and integrity (CVSS 7.8, C:H/I:H/A:H). Affected builds span essentially the entire supported Windows estate - Windows 10 1607 through 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - all in default configuration. This is a genuine but not emergency-priority vulnerability: no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has published vendor patches, so the practical risk is bounded by the requirement for pre-existing local authenticated access and the absence of a remote vector.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.
Spoofing and authentication bypass in the Microsoft Windows IKE Extension allow an unauthenticated remote attacker to subvert a security decision made during Internet Key Exchange negotiation, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1). All supported Windows client and server branches that carry the IKE Extension are affected, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, with Server Core installations included. Exploitation is conditional rather than trivial: the CVSS vector is AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are required, but the target host must actually have IKE/IPsec configured and actively negotiating and the attacker must hold a network position capable of influencing the handshake (a man-in-the-middle vantage or race-window dependency). CISA's SSVC assessment rates Exploitation as none and Automatable as no while assigning total technical impact, and no public exploit code or in-the-wild activity has been identified - no public exploit identified at time of analysis. Vendor patches are published by Microsoft (EUVD-2026-99912 / CVE-2026-83522) and should be treated as a priority for any estate that runs IPsec.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Remote, unauthenticated denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows any network-reachable attacker to crash the process that handles logon, credential validation and authentication for the host. Affected builds span Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core installations); patched builds at or above the vendor-listed build numbers are not exploitable. The impact is availability-only - no code execution, no data disclosure and no integrity impact - so real-world exposure is mainly a concern where authentication ports are reachable and where a host reboot or loss of authentication services is operationally disruptive; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
Information disclosure in the Microsoft Windows RPC Runtime lets an unauthenticated remote attacker read data that should never leave the host, because the service can return the contents of an uninitialized resource to a caller. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the prerequisites: network reach to a Windows RPC endpoint, no credentials, no user interaction, and impact limited to confidentiality. Affected systems span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. No public exploit has been identified at time of analysis and CISA SSVC records exploitation as none; EPSS is 0.94% (60th percentile), so this is a real but non-emergency priority to be addressed in the current patch cycle rather than an emergency.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Spoofing of federated identities in Microsoft Active Directory Federation Services (AD FS) lets an unauthenticated network attacker impersonate a federated user by exploiting weak authentication logic (CWE-1390), with high confidentiality and integrity impact but no availability impact (CVSS 7.4). Exploitation requires a deployed AD FS role reachable over the network and is rated high complexity (AC:H) - CISA SSVC records no known exploitation and rates the flaw as not automatable, and no public exploit code has been identified at time of analysis. Organizations that do not run the AD FS server role are not exposed, and Microsoft has released vendor patches for the affected Windows Server builds and the corresponding Windows 10 client builds.
Local privilege escalation in the Windows Setup Files Cleanup component allows an attacker who already holds low-privileged, authenticated access to a vulnerable Windows host to win a time-of-check time-of-use race and gain SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, with CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote vector and no user interaction required, but exploitation demands an existing foothold plus a reliably won race, which CISA's SSVC assessment marks as not automatable and with no observed exploitation; no public exploit code has been identified at time of analysis and Patch is available from the vendor.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in Microsoft Windows NTFS stems from an out-of-bounds read (CWE-125) that an authenticated attacker who already holds a low-privileged foothold on the host can trigger to reach high-integrity code execution and to read beyond the bounds of a kernel buffer (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw touches the default Windows filesystem, so unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025 and their Server Core installations are all in scope, but the local attack vector (no remote, unauthenticated reach) confines it to post-compromise escalation rather than an initial access path. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and Microsoft has released vendor patches.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation exists in Microsoft's Windows Setup Files Cleanup component, where a time-of-check time-of-use race condition lets an authenticated, low-privileged user on the host escalate to higher (typically SYSTEM-level) privileges. The issue affects a broad range of Windows client and server releases, from Windows 10 version 1607 and Server 2016 through Windows 11 version 26H2/26H1 and Windows Server 2025. Exploitation requires prior local access and a low-privileged account (CVSS PR:L) and depends on winning a timing-dependent race, which makes it high-complexity (AC:H) and non-deterministic rather than a reliable, automatable attack - there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, though the technical impact is rated total. Vendor patches are available.
Local privilege escalation in Microsoft Windows Server Update Service (WSUS) allows an authenticated attacker who already holds a low-privileged foothold on a WSUS-enabled host to escalate to higher privileges, with total impact to confidentiality, integrity, and availability (CVSS 7.8, C:H/I:H/A:H). Only servers with the WSUS role installed are exposed, and only builds below the vendor-supplied fixed levels are affected (e.g., Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019 < 10.0.17763.9376, Server 2016 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434, plus Windows 10 1607/1809). There is no remote or unauthenticated path (AV:L/PR:L/UI:N), no public exploit identified at time of analysis per CISA SSVC (Exploitation: none) and no KEV listing; Microsoft has released patches.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
Local privilege escalation in the Windows Server Update Service (WSUS) lets an authenticated low-privileged user on a WSUS-enabled host gain elevated privileges, rooted in CWE-1220 (insufficient granularity of access control) and rated 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the WSUS role or component to be present on the target and the attacker to already hold local low-privileged access; no user interaction or unusual complexity is needed, but an unauthenticated or purely remote attacker cannot trigger it from this vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with non-automatable characteristics, and vendor patches are available from Microsoft for all affected builds.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated low-privileged local user to gain SYSTEM-level rights on unpatched hosts, with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity and availability within the affected machine. Exploitation is not remotely reachable - it requires an existing foothold on the host as an unprivileged user - and there is no public exploit code and no confirmed active exploitation (no CISA KEV listing; SSVC exploitation: none, automatable: no). Microsoft has released vendor patches covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so risk is concentrated in fleets still running builds below the fixed levels listed in the EUVD record.
A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.
Windows Credential Guard does not enforce authentication on a critical function, letting a local, already-authenticated low-privileged user on an affected Windows host perform spoofing (CVSS 7.8, CWE-306). Exploitation is strictly local and requires prior account access to the machine, so exposure is concentrated on multi-user, shared, or already-compromised endpoints running Credential Guard rather than internet-facing systems; the specific function or configuration state involved is not described in the available sources. Microsoft has released fixed builds for Windows 10, Windows 11 and Windows Server, and no public exploit or CISA KEV entry is associated with the CVE at time of analysis; EPSS is 0.30% (22nd percentile), consistent with a moderate, this-week priority rather than emergency response.
Local privilege escalation in Microsoft Windows Schannel allows an authenticated attacker who already holds low-privileged code execution on a host to leverage a null pointer dereference in the TLS/SSL security provider into full compromise of the machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds span Windows Server 2012 and 2012 R2 through Windows Server 2025, plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) below the fixed build numbers published by the vendor; because Schannel is present by default in all supported releases, there is no feature toggle that removes the exposure. No public exploit identified at time of analysis, and the local-only vector combined with the prerequisite of an existing foothold makes this a genuine patch-priority item rather than an emergency - though multi-user, terminal-services, and server hosts where untrusted parties can run code warrant scheduling priority.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Code execution risk in the Windows CD-ROM Driver arises when the driver processes attacker-controlled disc-image or CD-ROM data, leading to an untrusted pointer dereference (CWE-822) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixed builds for every listed branch, and the available data shows no public exploit or observed in-the-wild exploitation, with EPSS at 0.84% (57th percentile); the vendor vector is 9.8, but the independent assessment rates AC:H because the network delivery path to the driver is not described and SSVC marks exploitation as none and automatable as no. The priority label is act_now, and the technical impact is total.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.
Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.
Heap-based buffer overflow in the Windows WebDAV component allows remote attackers to elevate privileges and potentially achieve full compromise of confidentiality, integrity and availability (CVSS 9.8). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based with no authentication and no user interaction required, and the affected scope covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, below the per-branch fixed builds published by Microsoft. The signals are strongly mixed: there is no CISA KEV entry and SSVC records Exploitation: none with Automatable: no, so no public exploit has been identified at time of analysis, and EPSS is modest at 0.84% (57th percentile); nevertheless technical impact is rated total and the vuln.today decision label is act_now with a vendor-released patch available. Whether exploitation requires an enabled, reachable WebDAV listener rather than a client-side connect-back is not described in the available sources.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.
Use-after-free in the Windows DHCP Client service lets an unauthenticated attacker who is positioned on the same adjacent network segment (the same broadcast domain, for example via a rogue DHCP server) run code in the context of the DHCP client, with the affected platforms being Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 including their Server Core installations. Reaching the freed object requires triggering and winning a race condition (CWE-362) in the client's handling of DHCP traffic, so exploit reliability is timing-dependent; our independent assessment therefore scores this CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, treating attack complexity as High rather than the vendor-published Low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing confirming active exploitation, and no EPSS data was supplied with the source material.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.
Local code execution in Microsoft Windows HTTP.sys affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, including Server Core installations. An attacker who already holds a valid low-privilege authenticated session on the host (CVSS vector AV:L/PR:L/UI:N) can trigger an out-of-bounds read in the HTTP kernel driver with no user interaction, delivering high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixes; multi-user hosts such as RDP/terminal servers, where untrusted users hold local accounts, carry the highest realistic exposure.
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.
Local privilege escalation in Microsoft Windows Search (CWE-59, link following) allows an authenticated low-privileged local user to elevate to a higher-integrity context by manipulating filesystem links that the Windows Search indexing component resolves before accessing a file, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a pre-existing local foothold and the ability to create symbolic links, junctions, or hard links in a location processed by the privileged Search service; no user interaction or network access is needed, and CISA SSVC rates it as not automatable, making this a post-compromise escalation step rather than an initial-access or wormable vector. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has released vendor updates, so affected systems should be patched on the normal monthly cadence rather than treated as an emergency.
Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.
Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.
Local privilege escalation in the Windows Now Playing Session Manager (NPSM) - a default component of supported Windows 10, Windows 11, and Windows Server builds - lets an attacker who already holds authenticated, interactive local access (CVSS 3.1 AV:L/PR:L/UI:N, score 7.8) corrupt memory via a use-after-free and execute code with elevated privileges. Exploitation is not automatable and requires the victim host to already be compromised or a low-privileged local user to be present; no public exploit code was identified at time of analysis and the CISA SSVC evaluation records exploitation as none, while CISA's technical-impact assessment is total (full loss of confidentiality, integrity, and availability on the vulnerable host). The flaw is a standard local privilege-escalation primitive rather than a remote entry point, and Microsoft has published fixed builds for every affected version.
A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.
Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already holds a low-privileged foothold on an affected Windows 10, Windows 11, or Windows Server build corrupt kernel memory and elevate to SYSTEM-level privileges. The defect is a use-after-free (CWE-416) that is reachable on default installations with no user interaction, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Microsoft has shipped a vendor patch through its Security Update Guide. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no, so this should be handled as a standard monthly-patching priority rather than an emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Authentication spoofing in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated remote attacker to impersonate or spoof identities through the federation service on affected, unpatched Windows builds, yielding high confidentiality, integrity, and availability impact (CVSS 8.1, AV:N/PR:N/UI:N, C:H/I:H/A:H). Only systems that run the AD FS role on Windows Server 2016, 2019, 2022, or 2025 (including Server Core installations) and the corresponding Windows 10 1607/1809 identity builds are exposed, and the service endpoint must be reachable over the network. The high attack-complexity rating and the CISA SSVC assessment (Exploitation: none, Automatable: no) indicate that reliable exploitation depends on specific, hard-to-control preconditions; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV).
Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.
Local privilege escalation in Windows Error Reporting (WER) allows an attacker who already holds low-privilege, authenticated access to a vulnerable Windows host to elevate to higher privileges, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use of uninitialized resource (CWE-908) inside the WER component, reachable without user interaction once the attacker can execute code or hold a session on the target; there is no remote vector, so prior local access is the key limiting factor. Unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 builds below the vendor-published fixed build numbers are affected; a vendor patch is available and no public exploit code or confirmed active exploitation has been identified at the time of analysis (CISA SSVC exploitation: none, automatable: no).
Local privilege escalation in Windows Active Directory Certificate Services (AD CS) arises from a race condition (CWE-362) on a shared resource, letting an attacker who already holds a low-privileged, locally authenticated account on an AD CS host gain elevated privileges with high impact to confidentiality, integrity, and availability. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable and requires no victim interaction, but its high attack complexity means success depends on winning a narrow, timing-dependent race, so exploitation is non-deterministic and may need many attempts rather than being cleanly automatable - consistent with CISA's SSVC rating of exploitation 'none' and automatable 'no'. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Microsoft has shipped a vendor update, making patching the definitive fix.
Denial of service in Windows DHCP Server allows unauthenticated remote attackers to crash the DHCP service via a null pointer dereference. Exploitation requires the DHCP Server role to be installed and running on affected builds of Windows Server 2012 through 2025 (including Server Core installations) and Windows 10 1607/1809, with the attacker able to reach the service over the network through UDP 67/68 or the RPC management interface. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the impact is availability-only with no confidentiality or integrity loss.
Local privilege escalation in the Windows User Profile Service (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets an attacker who already holds valid low-privileged local access redirect privileged file operations through attacker-created symbolic links, junctions, or hardlinks, yielding high-integrity file writes that can be leveraged for SYSTEM-level code execution. Affected are all currently supported Windows client and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - and default configurations are vulnerable with no special feature needing to be enabled. Vendor-released patches are available from Microsoft; no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so priority should track routine monthly patching rather than emergency response.
An out-of-bounds read in the Windows Network Policy Server (NPS) role lets unauthenticated remote attackers crash or degrade the service, producing a denial-of-service condition on hosts that expose NPS to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials, user interaction, or client-side conditions are required once NPS is reachable, and impact is confined to availability - no code execution, integrity, or confidentiality loss. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, though the flaw is rated Automatable: yes and affects a broad set of Windows client and server builds spanning Windows 10/11 and Windows Server 2012 through 2025; a vendor patch is available and should be prioritized on internet- or partner-facing RADIUS infrastructure.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
An out-of-bounds read in the Windows Graphics Device Interface (GDI) allows remote attackers to disclose information from process memory on affected Windows 10, Windows 11 and Windows Server builds. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, 7.5) rates it as a high-confidentiality, no-integrity, no-availability impact issue affecting the default graphics stack rather than an optional feature. Exploitation status is limited: CISA SSVC records no known exploitation, no public exploit code has been identified at time of analysis, EPSS is 0.94% (60th percentile), and Microsoft has released fixed builds for every affected branch, so the priority signals point to a moderate, non-emergency remediation within the current patch cycle.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
Unauthenticated remote attackers can exhaust service resources on internet-facing Microsoft Active Directory Federation Services (AD FS) deployments, causing denial of service to federated authentication. Tracked as CVE-2026-83645 (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-770), exploitation requires only network reachability to an AD FS federation endpoint - no credentials, privileges, or user interaction - and the affected scope covers Windows Server 2012 through 2025 plus Windows 10 1607/1809 where the AD FS role is installed. Impact is confined to availability of the federation service with no confidentiality or integrity loss, and there is no public exploit identified at time of analysis with CISA SSVC recording no observed exploitation, making this a genuine but moderate-priority availability issue rather than an emergency.
Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.
Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An out-of-bounds read in Windows kernel-mode drivers (CVE-2026-83637, CWE-125, CVSS 7.8) lets an attacker who already holds low-privileged local code execution on a Windows host escalate to full kernel privileges, yielding high confidentiality, integrity, and availability impact. Successful exploitation requires an existing local foothold and an authenticated session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); there is no remote or unauthenticated attack path and no user interaction is needed. No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not automatable), and Microsoft has released vendor patches for all affected Windows 10, Windows 11, and Windows Server editions.
Denial of service in Windows DNS Server: an unauthenticated, network-reachable attacker can send crafted DNS traffic to a host running the DNS Server role and trigger an out-of-bounds read (CWE-125) that disrupts or crashes the service, scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only). Unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 installations are affected, with Active Directory domain controllers and internet-facing resolvers carrying the greatest exposure because the DNS role must be listening by default; there is no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact. Microsoft has released fixes through the MSRC update guide, and the impact is confined to service disruption with no code execution or data disclosure resulting.
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in Windows Core Messaging lets an authenticated attacker who already holds low-privilege code execution on a host escalate to a higher-integrity, potentially SYSTEM-level context. The underlying defect is an untrusted pointer dereference (CWE-822) reached through a crafted program that calls into the Core Messaging user-mode code path; attack complexity is low and no user interaction is required, but the attacker must first be logged on locally (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), making this an EoP primitive usable only after an initial foothold, not a remote or unauthenticated vector. Per available intelligence there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), though SSVC rates the technical impact as total and fully patched systems are not exploitable. All supported Windows client and server builds below the vendor-patched build numbers - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - are affected.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.
Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Geotag Broker component of Microsoft Windows lets an authenticated low-privileged user already running code on a host elevate to a higher-integrity context, with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating high impact to confidentiality, integrity and availability and no user interaction required. Affected systems are unpatched Windows 10, Windows 11 and Windows Server builds below the fixed build numbers published by the vendor, including Server Core installations; exploitation requires local interactive or code-execution access (PR:L, AV:L), so risk is concentrated on multi-user hosts such as RDP/terminal servers, shared workstations and systems where untrusted users can run code. There is no public exploit identified at time of analysis and no CISA KEV listing, and Microsoft has released a vendor patch - this is a patch-priority issue rather than a remotely exploitable emergency.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.
Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Local privilege escalation in the Windows NTFS file-system driver (CVE-2026-83567) allows an authenticated attacker who can already execute code on a Windows host to trigger an out-of-bounds read, which Microsoft scores as a full compromise of confidentiality and integrity (CVSS 7.8, C:H/I:H/A:H). Affected builds span essentially the entire supported Windows estate - Windows 10 1607 through 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - all in default configuration. This is a genuine but not emergency-priority vulnerability: no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has published vendor patches, so the practical risk is bounded by the requirement for pre-existing local authenticated access and the absence of a remote vector.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.
Spoofing and authentication bypass in the Microsoft Windows IKE Extension allow an unauthenticated remote attacker to subvert a security decision made during Internet Key Exchange negotiation, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1). All supported Windows client and server branches that carry the IKE Extension are affected, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, with Server Core installations included. Exploitation is conditional rather than trivial: the CVSS vector is AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are required, but the target host must actually have IKE/IPsec configured and actively negotiating and the attacker must hold a network position capable of influencing the handshake (a man-in-the-middle vantage or race-window dependency). CISA's SSVC assessment rates Exploitation as none and Automatable as no while assigning total technical impact, and no public exploit code or in-the-wild activity has been identified - no public exploit identified at time of analysis. Vendor patches are published by Microsoft (EUVD-2026-99912 / CVE-2026-83522) and should be treated as a priority for any estate that runs IPsec.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Remote, unauthenticated denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows any network-reachable attacker to crash the process that handles logon, credential validation and authentication for the host. Affected builds span Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core installations); patched builds at or above the vendor-listed build numbers are not exploitable. The impact is availability-only - no code execution, no data disclosure and no integrity impact - so real-world exposure is mainly a concern where authentication ports are reachable and where a host reboot or loss of authentication services is operationally disruptive; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
Information disclosure in the Microsoft Windows RPC Runtime lets an unauthenticated remote attacker read data that should never leave the host, because the service can return the contents of an uninitialized resource to a caller. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the prerequisites: network reach to a Windows RPC endpoint, no credentials, no user interaction, and impact limited to confidentiality. Affected systems span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. No public exploit has been identified at time of analysis and CISA SSVC records exploitation as none; EPSS is 0.94% (60th percentile), so this is a real but non-emergency priority to be addressed in the current patch cycle rather than an emergency.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Spoofing of federated identities in Microsoft Active Directory Federation Services (AD FS) lets an unauthenticated network attacker impersonate a federated user by exploiting weak authentication logic (CWE-1390), with high confidentiality and integrity impact but no availability impact (CVSS 7.4). Exploitation requires a deployed AD FS role reachable over the network and is rated high complexity (AC:H) - CISA SSVC records no known exploitation and rates the flaw as not automatable, and no public exploit code has been identified at time of analysis. Organizations that do not run the AD FS server role are not exposed, and Microsoft has released vendor patches for the affected Windows Server builds and the corresponding Windows 10 client builds.
Local privilege escalation in the Windows Setup Files Cleanup component allows an attacker who already holds low-privileged, authenticated access to a vulnerable Windows host to win a time-of-check time-of-use race and gain SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, with CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote vector and no user interaction required, but exploitation demands an existing foothold plus a reliably won race, which CISA's SSVC assessment marks as not automatable and with no observed exploitation; no public exploit code has been identified at time of analysis and Patch is available from the vendor.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in Microsoft Windows NTFS stems from an out-of-bounds read (CWE-125) that an authenticated attacker who already holds a low-privileged foothold on the host can trigger to reach high-integrity code execution and to read beyond the bounds of a kernel buffer (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw touches the default Windows filesystem, so unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025 and their Server Core installations are all in scope, but the local attack vector (no remote, unauthenticated reach) confines it to post-compromise escalation rather than an initial access path. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and Microsoft has released vendor patches.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation exists in Microsoft's Windows Setup Files Cleanup component, where a time-of-check time-of-use race condition lets an authenticated, low-privileged user on the host escalate to higher (typically SYSTEM-level) privileges. The issue affects a broad range of Windows client and server releases, from Windows 10 version 1607 and Server 2016 through Windows 11 version 26H2/26H1 and Windows Server 2025. Exploitation requires prior local access and a low-privileged account (CVSS PR:L) and depends on winning a timing-dependent race, which makes it high-complexity (AC:H) and non-deterministic rather than a reliable, automatable attack - there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, though the technical impact is rated total. Vendor patches are available.
Local privilege escalation in Microsoft Windows Server Update Service (WSUS) allows an authenticated attacker who already holds a low-privileged foothold on a WSUS-enabled host to escalate to higher privileges, with total impact to confidentiality, integrity, and availability (CVSS 7.8, C:H/I:H/A:H). Only servers with the WSUS role installed are exposed, and only builds below the vendor-supplied fixed levels are affected (e.g., Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019 < 10.0.17763.9376, Server 2016 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434, plus Windows 10 1607/1809). There is no remote or unauthenticated path (AV:L/PR:L/UI:N), no public exploit identified at time of analysis per CISA SSVC (Exploitation: none) and no KEV listing; Microsoft has released patches.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
Local privilege escalation in the Windows Server Update Service (WSUS) lets an authenticated low-privileged user on a WSUS-enabled host gain elevated privileges, rooted in CWE-1220 (insufficient granularity of access control) and rated 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the WSUS role or component to be present on the target and the attacker to already hold local low-privileged access; no user interaction or unusual complexity is needed, but an unauthenticated or purely remote attacker cannot trigger it from this vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with non-automatable characteristics, and vendor patches are available from Microsoft for all affected builds.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated low-privileged local user to gain SYSTEM-level rights on unpatched hosts, with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity and availability within the affected machine. Exploitation is not remotely reachable - it requires an existing foothold on the host as an unprivileged user - and there is no public exploit code and no confirmed active exploitation (no CISA KEV listing; SSVC exploitation: none, automatable: no). Microsoft has released vendor patches covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so risk is concentrated in fleets still running builds below the fixed levels listed in the EUVD record.
A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.
Windows Credential Guard does not enforce authentication on a critical function, letting a local, already-authenticated low-privileged user on an affected Windows host perform spoofing (CVSS 7.8, CWE-306). Exploitation is strictly local and requires prior account access to the machine, so exposure is concentrated on multi-user, shared, or already-compromised endpoints running Credential Guard rather than internet-facing systems; the specific function or configuration state involved is not described in the available sources. Microsoft has released fixed builds for Windows 10, Windows 11 and Windows Server, and no public exploit or CISA KEV entry is associated with the CVE at time of analysis; EPSS is 0.30% (22nd percentile), consistent with a moderate, this-week priority rather than emergency response.
Local privilege escalation in Microsoft Windows Schannel allows an authenticated attacker who already holds low-privileged code execution on a host to leverage a null pointer dereference in the TLS/SSL security provider into full compromise of the machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds span Windows Server 2012 and 2012 R2 through Windows Server 2025, plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) below the fixed build numbers published by the vendor; because Schannel is present by default in all supported releases, there is no feature toggle that removes the exposure. No public exploit identified at time of analysis, and the local-only vector combined with the prerequisite of an existing foothold makes this a genuine patch-priority item rather than an emergency - though multi-user, terminal-services, and server hosts where untrusted parties can run code warrant scheduling priority.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Code execution risk in the Windows CD-ROM Driver arises when the driver processes attacker-controlled disc-image or CD-ROM data, leading to an untrusted pointer dereference (CWE-822) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixed builds for every listed branch, and the available data shows no public exploit or observed in-the-wild exploitation, with EPSS at 0.84% (57th percentile); the vendor vector is 9.8, but the independent assessment rates AC:H because the network delivery path to the driver is not described and SSVC marks exploitation as none and automatable as no. The priority label is act_now, and the technical impact is total.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.
Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.
Heap-based buffer overflow in the Windows WebDAV component allows remote attackers to elevate privileges and potentially achieve full compromise of confidentiality, integrity and availability (CVSS 9.8). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is network-based with no authentication and no user interaction required, and the affected scope covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, below the per-branch fixed builds published by Microsoft. The signals are strongly mixed: there is no CISA KEV entry and SSVC records Exploitation: none with Automatable: no, so no public exploit has been identified at time of analysis, and EPSS is modest at 0.84% (57th percentile); nevertheless technical impact is rated total and the vuln.today decision label is act_now with a vendor-released patch available. Whether exploitation requires an enabled, reachable WebDAV listener rather than a client-side connect-back is not described in the available sources.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.
Use-after-free in the Windows DHCP Client service lets an unauthenticated attacker who is positioned on the same adjacent network segment (the same broadcast domain, for example via a rogue DHCP server) run code in the context of the DHCP client, with the affected platforms being Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 including their Server Core installations. Reaching the freed object requires triggering and winning a race condition (CWE-362) in the client's handling of DHCP traffic, so exploit reliability is timing-dependent; our independent assessment therefore scores this CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, treating attack complexity as High rather than the vendor-published Low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing confirming active exploitation, and no EPSS data was supplied with the source material.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.
Local code execution in Microsoft Windows HTTP.sys affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, including Server Core installations. An attacker who already holds a valid low-privilege authenticated session on the host (CVSS vector AV:L/PR:L/UI:N) can trigger an out-of-bounds read in the HTTP kernel driver with no user interaction, delivering high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixes; multi-user hosts such as RDP/terminal servers, where untrusted users hold local accounts, carry the highest realistic exposure.
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.