Windows Server 2019
Monthly
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to execute code on a Windows machine that connects to it, affecting builds across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation is client-side: an attacker must induce a victim to open a crafted .rdp file or otherwise initiate an outbound RDP session, and with AC:H plus mandatory UI:R, reliable code execution depends on winning a heap race rather than a single deterministic response, so mass opportunistic exploitation is unlikely while targeted social-engineering delivery is plausible. No public exploit identified at time of analysis; CISA's SSVC rates exploitation as none and automation as not automatable, and the PR:N vector means the victim need not authenticate to the attacker.
A use-after-free (CWE-416) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on the connecting client, as described in Microsoft's MSRC advisory for CVE-2026-69998. Exploitation is not passive: the victim must actively initiate an RDP session to the hostile endpoint (UI:R), and the unauthenticated attacker (PR:N) must still win a memory-management race or reliably groom the freed heap object to convert the corruption into code execution (AC:H), giving a CVSS 3.1 base score of 7.5. All supported Windows client and server builds below the patched build levels are affected; there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and CISA SSVC records exploitation as none and automatable as no, so the practical risk is driven by social engineering of an outbound RDP connection plus patch lag.
Use-after-free memory corruption in the Microsoft Windows Remote Desktop Client (mstsc.exe) can let an unauthenticated remote attacker execute arbitrary code on a vulnerable client, but only after the victim initiates an outbound RDP connection to an attacker-controlled, compromised, or spoofed RDP server. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) confirms the mandatory user interaction and high attack complexity, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'; no public exploit code has been identified at time of analysis. Microsoft has released fixes via the MSRC update guide, so the practical risk is moderate and concentrated on hosts that routinely open RDP sessions to untrusted or third-party endpoints.
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to corrupt memory and execute code on the machine that connects to it (CVSS 7.5, C:H/I:H/A:H, SSVC Technical Impact 'total'). The attack is client-initiated and outbound - it requires the victim to establish an RDP session to the hostile endpoint (UI:R) and a favorable memory/race condition to be won (AC:H) - so it does not target a listening RDP service, and no privileges are required on the client (PR:N, unauthenticated). Current intelligence indicates no public exploit code and no confirmed active exploitation (CISA SSVC Exploitation: none; Automatable: no), while Microsoft has released a vendor patch, making this a high-impact-but-not-urgent issue at time of analysis.
Code execution in the Windows Remote Desktop Client (mstsc) is possible when a user initiates an outbound RDP session to a malicious or attacker-controlled server, triggering a use-after-free that can be leveraged for arbitrary code in the client's context. Affected are unpatched Windows client and server builds below their fixed versions - including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012/2012 R2/2016/2019/2022/2025 - while the attacker requires no credentials (PR:N) and the flaw cannot be triggered against a listening host without the victim's outbound connection (UI:R). Exploitation is rated high-complexity (AC:H) because the attacker must reliably win the heap/timing-dependent memory corruption condition; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and Microsoft has released patched builds.
Use-after-free memory corruption in the Windows Remote Desktop Client allows an unauthenticated remote attacker to execute code in the context of the connecting user, but only after the victim initiates an outbound RDP session to an attacker-controlled or compromised server. Microsoft rates the issue 7.5 (High) under CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a total loss of confidentiality, integrity, and availability that is tempered by high attack complexity and mandatory user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis; Microsoft has released fixed builds through its update guide.
Remote code execution in Windows Remote Desktop Services is possible through a use-after-free (CWE-416) in the RDP component, rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can achieve high confidentiality, integrity, and availability impact, but exploitation is not reliable: the attacker must satisfy a race or heap-grooming condition (AC:H), and a victim must initiate or accept a Remote Desktop connection to an attacker-controlled endpoint (UI:R). No public exploit code is identified at time of analysis, CISA SSVC records exploitation as none, and Microsoft has released patches; hosts without the Remote Desktop/RDS role enabled are not exposed, so risk is concentrated on internet- or untrusted-network-facing RDP deployments.
Remote code execution in Microsoft's Windows Remote Desktop Client stems from a use-after-free (CWE-416) triggered when the client processes crafted data supplied by an RDP server. An unauthenticated attacker can exploit this over a network only by inducing a user to connect to an attacker-controlled or compromised RDP server - for example by opening a malicious .rdp file or link - after which heap corruption can lead to code execution in the context of the client. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting required user interaction and high attack complexity; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', no public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed actively exploited (CISA KEV). Vendor patches are available, so the practical risk is concentrated in unpatched Windows clients exposed to untrusted RDP endpoints.
Remote code execution affects the Windows Remote Desktop Client (mstsc) across a wide range of supported desktop and server builds, allowing an attacker who controls or manipulates an RDP endpoint to execute code in the context of the connecting user. The flaw is a use-after-free (CWE-416) rated CVSS 7.5; exploitation requires the victim to actively initiate an RDP session outward to the hostile server (UI:R), and high attack complexity (AC:H) reflects dependence on heap/race conditions rather than a deterministic trigger - no authentication is required of the attacker (PR:N). No public exploit code has been identified at time of analysis and CISA's SSVC records Exploitation=none with no KEV listing, so risk is driven by the breadth of affected Windows builds and the total technical impact should the memory-corruption primitive be reliably converted into code execution.
Outbound RDP sessions from the Windows Remote Desktop Client can be turned against the client itself: when a user connects to an attacker-controlled, compromised, or man-in-the-middle'd RDP server, crafted response data triggers a use-after-free (CWE-416) that can lead to code execution on the victim's machine, with total technical impact if the memory corruption is reliably steered. The attacker needs no credentials on the client (PR:N) and can operate remotely over the network (AV:N), but exploitation is gated by mandatory user interaction (the user must actively initiate the session, UI:R) and high attack complexity (AC:H) reflecting the precision required to trigger and control the freed allocation. Microsoft rates this CVSS 7.5 and has released vendor patches; there is no public exploit identified at time of analysis and no evidence of exploitation - CISA's SSVC assessment records Exploitation: none and Automatable: no.
A use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc.exe / RDP client stack) allows remote code execution in the security context of the connecting user when that user establishes an outbound RDP session to an attacker-controlled or compromised RDP server. Exploitation is unauthenticated with respect to the client (CVSS 3.1 PR:N) but requires user interaction (UI:R) and is rated high attack complexity (AC:H), because the attacker must deliver crafted server-side RDP protocol data and win a race condition over the freed object; the resulting impact is full compromise of confidentiality, integrity and availability within the user's own security scope (S:U, no privilege escalation to SYSTEM). Microsoft has released a vendor patch covering Windows 10, Windows 11 and Windows Server 2012 through 2025, exploitation has not been observed by CISA SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code was identified at the time of analysis.
Heap-based buffer overflow in the Windows Libarchive component - the library Windows uses to extract 7z, rar, tar, cab and similar archive formats - lets a remote attacker execute arbitrary code with the privileges of the user who opens a malicious archive. Because exploitation is delivered over the network (AV:N) with no authentication required (PR:N) but demands that the victim open or process the crafted file (UI:R), the realistic attack path is a phishing email attachment, a web download, or a hosted share rather than anything wormable; CISA's SSVC decision framework reflects this with Exploitation=none and Automatable=no. There is no public exploit identified at time of analysis and vendor patches are available, so the practical priority is patch deployment rather than emergency containment - while noting the CVSS 8.8 score masks that the mandatory user interaction is the single factor keeping risk below critical.
Use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc) allows remote code execution on a Windows client that connects out to a malicious or compromised RDP server, affecting all supported Windows 10, Windows 11, and Windows Server builds below the fixed patch levels listed in Microsoft's advisory. Exploitation is not opportunistic: it follows a reverse-RDP pattern in which the victim must initiate the session (UI:R) against attacker-controlled server infrastructure, and public exploitation is not confirmed - CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis. The negotiated CVSS of 7.5 is driven by high attack complexity (AC:H), reflecting the heap-state and timing control needed to win the use-after-free race, while requiring no privileges on the victim (PR:N) and impacting confidentiality, integrity, and availability equally.
Local privilege escalation in Microsoft's Quality Windows Audio/Video Experience (QWAVE) service stems from a use-after-free condition (CWE-416) that can let an already-authenticated local user execute code in the service's more privileged context, with high impact to confidentiality, integrity and availability (C:H/I:H/A:H). Rated CVSS 7.0 with a vector of AV:L/AC:H/PR:L/UI:N/S:U, exploitation requires an attacker who already holds a local account on the host and who can also win a timing or object-lifetime race - CISA's SSVC assessment records Exploitation=none and Automatable=no, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor-released patches for every affected branch, so this is best treated as a moderate-priority post-foothold escalation whose realistic risk is lower than the base score alone suggests, rather than an emergency to be handled outside the normal patch cycle.
Remote code execution in the Microsoft Remote Desktop Client (CWE-416) occurs when a user initiates an RDP connection to an attacker-controlled or compromised server that returns crafted responses, causing the client to reuse a freed memory object. The CVSS vector (AV:N/AC:H/PR:N/UI:R) shows an unauthenticated attacker is required to hold no credentials on the victim host, but must convince the user to start the session and satisfy high-complexity heap-timing conditions for reliable exploitation; impact is confined to the connecting user's security context with no privilege escalation implied. Exploitation only triggers on a client that actively connects outbound, and no public exploit identified at time of analysis.
Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.
Local privilege escalation in Microsoft Streaming Service on Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 allows an authenticated, low-privilege attacker who already has code execution on the host to exploit an integer wraparound and elevate privileges, with total impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is strictly local - the vector (AV:L/PR:L/UI:N) rules out remote or unauthenticated reach - and SSVC records exploitation as none with automatable set to no, so no public exploit code has been identified at time of analysis. This is a genuine patch-priority issue but not an emergency, and it matters most on multi-user, terminal-server and jump hosts where untrusted users can already run code.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.
Remote code execution in Windows iSCSI allows unauthenticated attackers to execute code over a network by exploiting a use-after-free (CWE-416) in the processing of crafted iSCSI protocol traffic. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, but the primary limiting factor is that the Microsoft iSCSI Initiator service and iSCSI Target Server role are not enabled by default, so exposure is largely confined to hosts configured for iSCSI storage such as SAN-backed servers. No public exploit identified at time of analysis, and reliable exploitation would require defeating Windows memory mitigations, raising practical difficulty beyond the AC:L rating.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Local privilege escalation in the Windows Certificates component allows an authenticated attacker who already holds a low-privileged session on a Windows host to trigger an untrusted pointer dereference (CWE-822) and gain full control of that system, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation is strictly local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), and does not change security scope (S:U), so it is a post-compromise escalation step rather than a remote entry point; default Windows installations carrying the affected component are exposed because no non-default configuration is indicated. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so it is not confirmed actively exploited; Microsoft's update guide is the authoritative remediation reference.
Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.
Unauthenticated remote code execution in the Microsoft Windows DHCP Server role is achievable when an attacker on a reachable network segment wins a race condition on a shared resource inside the DHCP service. The vulnerability is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with complete confidentiality, integrity and availability impact, but the high attack complexity reflects a narrow, non-deterministic synchronization window that makes exploitation unreliable and typically requires repeated concurrent DHCP requests, potentially combined with favorable server load conditions. No public exploit code was identified at time of analysis and there is no CISA KEV listing; hosts without the DHCP Server role installed, or where DHCP traffic cannot be reached from an untrusted segment, are not exposed.
Weak authentication in the Network Device Enrollment Service (NDES) of Active Directory Certificate Services (AD CS) allows a remote, unauthenticated attacker to execute code on affected Windows Server installations. Only servers that have the optional, non-default NDES role installed and whose SCEP enrollment endpoint is network-reachable are exposed; Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 are affected across both full and Server Core installations. The assessed vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact, meaning no credentials or user interaction are needed but successful exploitation depends on attacker-uncontrollable conditions (a weak-authentication edge case), consistent with CISA SSVC Exploitation=None and Automatable=no; no public exploit has been identified at the time of analysis, and EPSS/KEV data were not provided.
Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.
Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege elevation on supported Windows builds stems from the Windows Key Distribution Center (KDC) accepting cryptographic signatures it should have rejected, letting an attacker who already holds low-privileged credentials and local access to an affected host reach high integrity and confidentiality impact (CVSS 7.8, AV:L/PR:L/UI:N). The KDC role normally runs only on Windows Server Domain Controllers, although the vulnerable code ships across every client and server build enumerated in the EUVD data - Windows 10 1607/1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025. Microsoft has published a fix through the MSRC update guide; no public exploit code and no CISA KEV entry were identified at time of analysis, and the independent assessment rates this as a genuine but second-tier priority because exploitation requires a pre-existing foothold and validated credentials rather than a remote or unauthenticated path.
Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.
Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.
Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).
Unauthenticated remote attackers can disclose sensitive memory contents from Microsoft Azure Attestation and the Windows Server Device Health Attestation Service through an out-of-bounds read (CWE-125) triggered by a crafted request to an exposed attestation endpoint, rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The practical exposure is limited: on-premises Device Health Attestation is an optional Windows Server role, so only hosts where it is enabled and network-reachable are at risk, specifically Windows Server 2019 before 10.0.17763.9376, Windows Server 2022 before 10.0.20348.5761, and Windows Server 2025 before 10.0.26100.33650. Impact is confined to information disclosure with high confidentiality loss and no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.
Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.
Use-after-free in the Windows Enterprise App Management component lets an attacker with valid low-level credentials on a target machine, who can reach that machine over the network, corrupt freed memory and elevate to a higher-integrity context. Exploitation is gated by three limiters recorded in the assessed vector: the attacker must already hold a valid account on the target (PR:L), a victim user must perform an interaction (UI:R), and the memory-reuse race that gives an attacker control of the freed object is non-deterministic (AC:H) - so although the attack vector is network-reachable, real-world reliability and prerequisites keep this a moderate-priority issue rather than an emergency. Microsoft has released fixes in the current Windows cumulative updates, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.
Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.
Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.
Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.
Local privilege escalation in the Windows Perception Simulation Service allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The flaw is not remotely reachable: the attacker must first establish a foothold on the machine and be able to interact with the service so that the vulnerable memory is freed and then reused under attacker control. Exploitation reliability depends on winning the memory-reclamation race, and the Perception Simulation Service (a Windows Holographic / mixed-reality component) must be present and active in the target configuration for the vulnerable code path to be exercised. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H2, and Windows Server 2019, and a vendor fix is available; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.
Local security feature bypass in Windows UEFI (CVE-2026-49785) allows an authenticated attacker who already holds a low-privileged account on the host to defeat a boot/UEFI-related security feature, with the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) reflecting high confidentiality, integrity and availability impact once that local foothold exists. Exploitation is not remote and requires no user interaction, but it does require pre-existing local access and an account on the system; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as "none" with automation as "no", so this is a moderate-priority local hardening issue rather than an emergency. A vendor patch is available from Microsoft via the MSRC Security Update Guide, and the affected build ranges span most supported Windows client and server releases, including Server 2012 through Server 2025.
Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.
Local privilege escalation in the Microsoft Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low privileges on an affected host to execute against higher-integrity code inside the isolated secure environment, achieving elevated privileges locally. The defect is an untrusted pointer dereference (CWE-822) in the enclave interface, and because the code runs inside a security boundary the CVSS assessment is scope-changed (S:C) with high confidentiality, integrity and availability impact (CVSS 8.8, AV:L/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no', and a vendor patch is available, so this is a genuine but non-emergency priority that matters chiefly as a post-compromise escalation primitive on hosts where VBS is deployed.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.
Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.
Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.
Use-after-free in Windows Message Queuing (MSMQ) allows unauthenticated remote attackers to execute arbitrary code on systems where the optional MSMQ feature is installed and its listener is network-reachable, typically on TCP port 1801. Exploitation requires winning a memory race due to the high attack complexity (CVSS AC:H), and the feature is not enabled by default, which significantly limits real-world exposure; no public exploit identified at time of analysis.
Remote code execution in Microsoft Remote Desktop Client can be triggered when a victim connects to a malicious or compromised RDP server, exploiting a use-after-free (CWE-416) condition during processing of server responses. The vulnerability requires user interaction (UI:R) - the victim must initiate the RDP connection, for example via a malicious .rdp file or social engineering - but no authentication to the victim's system is needed (PR:N), and it is remotely exploitable with low complexity (AV:N/AC:L). CVSS 3.1 score is 8.8, reflecting high confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privileged attacker to gain elevated privileges by winning a time-of-check time-of-use race condition in the MDM component. The flaw is rated CVSS 7.0 (High) and requires local access and a narrow timing window (AC:H), with no public exploit identified at time of analysis. Affected are Windows hosts with the MDM component enabled, and successful exploitation could lead to complete compromise of confidentiality, integrity, and availability.
Local privilege escalation in the Microsoft Windows Search Component lets an authenticated, low-privileged attacker on a Windows host trigger a use-after-free (CWE-416) and gain elevated privileges, potentially SYSTEM, with high impact to confidentiality, integrity, and availability. Exploitation requires local access and a valid low-privilege account (CVSS PR:L/AV:L) and no user interaction; it cannot be triggered remotely and is therefore a post-compromise escalation step, especially risky on shared, multi-user, RDP, or terminal-server hosts. No public exploit was identified at time of analysis, and this is assessed as a credible but not emergency-tier patch priority.
Local privilege escalation in the Microsoft Windows Kerberos component lets an attacker who already holds low-privileged code execution on a target host trigger a double-free memory-corruption condition (CWE-415) and elevate to a higher-integrity context. Per the assessed vector (AV:L/AC:H/PR:L/UI:N), the attack is strictly local and requires an authenticated low-privileged foothold, with high complexity reflecting the need to win a race or reach a specific memory/timing state that is not reliably reproducible, which materially limits weaponization; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS signal was supplied. The flaw is present in default installations of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds below their patched levels, and Microsoft has released updates (MSRC update guide referenced for CVE-2026-108132).
An untrusted pointer dereference (CWE-822) in the Windows Distributed File System (DFS) component allows unauthenticated remote attackers to elevate privileges on affected, unpatched Windows and Windows Server builds, per the CVSS vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact (9.8). Every Windows 10 branch (1607 through 22H2), Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 - including Server Core installations - are listed as affected below their respective fixed builds. No public exploit code or active exploitation is confirmed at time of analysis (SSVC Exploitation: none), though EPSS is 1.15% (66th percentile), SSVC Automation: yes and Technical Impact: total, and the priority label is act_now; the practical limiting factor is network reachability of the DFS service.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Search component of Microsoft Windows allows unauthenticated remote attackers to elevate privileges, per a CVSS 3.1 score of 9.8. No public exploit code has been identified at time of analysis. However, the description's framing as privilege elevation-which typically requires a local foothold-conflicts with the network-unauthenticated vector; confirm exact preconditions via the MSRC advisory.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Spoofing in Windows Schannel allows an unauthenticated attacker positioned on the network path between a client and server to interfere with TLS session establishment, potentially bypassing authentication and compromising confidentiality and integrity. Microsoft rates this CVSS 9.0, while our independent assessment assigns a modified vector with no availability impact (A:N) and notes that exploitation requires high attack complexity (AC:H) due to the need for a man-in-the-middle position and specific handshake/timing conditions. No public exploit identified at time of analysis.
Elevation of privilege in Windows NDIS (ndis.sys) allows a local authenticated user to run processes in an elevated context by exploiting an out-of-bounds read caused by a missing buffer-length check. The vulnerability affects all Windows systems with the default NDIS driver, requiring the attacker to already have local access and the ability to execute a malicious application. No public exploit code has been identified at time of analysis, and Microsoft has released a security update to address the flaw.
Local privilege escalation in the Windows Overlay Filter (wof.sys) driver on affected Windows systems allows an authenticated attacker with low-privileged code execution to trigger an out-of-bounds read (CWE-125) and elevate privileges to a higher integrity level. The flaw is rated CVSS 7.8 (High) and requires no user interaction (UI:N), but the attacker must already have a local foothold (PR:L, AV:L). No public exploit code or active exploitation has been identified at time of analysis; a vendor advisory is available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.
Remote code execution in Remote Desktop Client can be triggered when a user connects to an attacker-controlled or compromised RDP server, due to a use-after-free in the client. The attacker does not need credentials (PR:N), but the victim must initiate the outbound RDP session (UI:R), so environments that restrict outbound RDP to trusted hosts are less exposed; successful exploitation runs code in the context of the connecting user. No public exploit identified at time of analysis; this is a serious client-side vulnerability but not an emergency because the attacker cannot reach the client unsolicited.
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to execute code on a Windows machine that connects to it, affecting builds across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation is client-side: an attacker must induce a victim to open a crafted .rdp file or otherwise initiate an outbound RDP session, and with AC:H plus mandatory UI:R, reliable code execution depends on winning a heap race rather than a single deterministic response, so mass opportunistic exploitation is unlikely while targeted social-engineering delivery is plausible. No public exploit identified at time of analysis; CISA's SSVC rates exploitation as none and automation as not automatable, and the PR:N vector means the victim need not authenticate to the attacker.
A use-after-free (CWE-416) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on the connecting client, as described in Microsoft's MSRC advisory for CVE-2026-69998. Exploitation is not passive: the victim must actively initiate an RDP session to the hostile endpoint (UI:R), and the unauthenticated attacker (PR:N) must still win a memory-management race or reliably groom the freed heap object to convert the corruption into code execution (AC:H), giving a CVSS 3.1 base score of 7.5. All supported Windows client and server builds below the patched build levels are affected; there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and CISA SSVC records exploitation as none and automatable as no, so the practical risk is driven by social engineering of an outbound RDP connection plus patch lag.
Use-after-free memory corruption in the Microsoft Windows Remote Desktop Client (mstsc.exe) can let an unauthenticated remote attacker execute arbitrary code on a vulnerable client, but only after the victim initiates an outbound RDP connection to an attacker-controlled, compromised, or spoofed RDP server. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) confirms the mandatory user interaction and high attack complexity, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'; no public exploit code has been identified at time of analysis. Microsoft has released fixes via the MSRC update guide, so the practical risk is moderate and concentrated on hosts that routinely open RDP sessions to untrusted or third-party endpoints.
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to corrupt memory and execute code on the machine that connects to it (CVSS 7.5, C:H/I:H/A:H, SSVC Technical Impact 'total'). The attack is client-initiated and outbound - it requires the victim to establish an RDP session to the hostile endpoint (UI:R) and a favorable memory/race condition to be won (AC:H) - so it does not target a listening RDP service, and no privileges are required on the client (PR:N, unauthenticated). Current intelligence indicates no public exploit code and no confirmed active exploitation (CISA SSVC Exploitation: none; Automatable: no), while Microsoft has released a vendor patch, making this a high-impact-but-not-urgent issue at time of analysis.
Code execution in the Windows Remote Desktop Client (mstsc) is possible when a user initiates an outbound RDP session to a malicious or attacker-controlled server, triggering a use-after-free that can be leveraged for arbitrary code in the client's context. Affected are unpatched Windows client and server builds below their fixed versions - including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012/2012 R2/2016/2019/2022/2025 - while the attacker requires no credentials (PR:N) and the flaw cannot be triggered against a listening host without the victim's outbound connection (UI:R). Exploitation is rated high-complexity (AC:H) because the attacker must reliably win the heap/timing-dependent memory corruption condition; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and Microsoft has released patched builds.
Use-after-free memory corruption in the Windows Remote Desktop Client allows an unauthenticated remote attacker to execute code in the context of the connecting user, but only after the victim initiates an outbound RDP session to an attacker-controlled or compromised server. Microsoft rates the issue 7.5 (High) under CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a total loss of confidentiality, integrity, and availability that is tempered by high attack complexity and mandatory user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis; Microsoft has released fixed builds through its update guide.
Remote code execution in Windows Remote Desktop Services is possible through a use-after-free (CWE-416) in the RDP component, rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can achieve high confidentiality, integrity, and availability impact, but exploitation is not reliable: the attacker must satisfy a race or heap-grooming condition (AC:H), and a victim must initiate or accept a Remote Desktop connection to an attacker-controlled endpoint (UI:R). No public exploit code is identified at time of analysis, CISA SSVC records exploitation as none, and Microsoft has released patches; hosts without the Remote Desktop/RDS role enabled are not exposed, so risk is concentrated on internet- or untrusted-network-facing RDP deployments.
Remote code execution in Microsoft's Windows Remote Desktop Client stems from a use-after-free (CWE-416) triggered when the client processes crafted data supplied by an RDP server. An unauthenticated attacker can exploit this over a network only by inducing a user to connect to an attacker-controlled or compromised RDP server - for example by opening a malicious .rdp file or link - after which heap corruption can lead to code execution in the context of the client. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting required user interaction and high attack complexity; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', no public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed actively exploited (CISA KEV). Vendor patches are available, so the practical risk is concentrated in unpatched Windows clients exposed to untrusted RDP endpoints.
Remote code execution affects the Windows Remote Desktop Client (mstsc) across a wide range of supported desktop and server builds, allowing an attacker who controls or manipulates an RDP endpoint to execute code in the context of the connecting user. The flaw is a use-after-free (CWE-416) rated CVSS 7.5; exploitation requires the victim to actively initiate an RDP session outward to the hostile server (UI:R), and high attack complexity (AC:H) reflects dependence on heap/race conditions rather than a deterministic trigger - no authentication is required of the attacker (PR:N). No public exploit code has been identified at time of analysis and CISA's SSVC records Exploitation=none with no KEV listing, so risk is driven by the breadth of affected Windows builds and the total technical impact should the memory-corruption primitive be reliably converted into code execution.
Outbound RDP sessions from the Windows Remote Desktop Client can be turned against the client itself: when a user connects to an attacker-controlled, compromised, or man-in-the-middle'd RDP server, crafted response data triggers a use-after-free (CWE-416) that can lead to code execution on the victim's machine, with total technical impact if the memory corruption is reliably steered. The attacker needs no credentials on the client (PR:N) and can operate remotely over the network (AV:N), but exploitation is gated by mandatory user interaction (the user must actively initiate the session, UI:R) and high attack complexity (AC:H) reflecting the precision required to trigger and control the freed allocation. Microsoft rates this CVSS 7.5 and has released vendor patches; there is no public exploit identified at time of analysis and no evidence of exploitation - CISA's SSVC assessment records Exploitation: none and Automatable: no.
A use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc.exe / RDP client stack) allows remote code execution in the security context of the connecting user when that user establishes an outbound RDP session to an attacker-controlled or compromised RDP server. Exploitation is unauthenticated with respect to the client (CVSS 3.1 PR:N) but requires user interaction (UI:R) and is rated high attack complexity (AC:H), because the attacker must deliver crafted server-side RDP protocol data and win a race condition over the freed object; the resulting impact is full compromise of confidentiality, integrity and availability within the user's own security scope (S:U, no privilege escalation to SYSTEM). Microsoft has released a vendor patch covering Windows 10, Windows 11 and Windows Server 2012 through 2025, exploitation has not been observed by CISA SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code was identified at the time of analysis.
Heap-based buffer overflow in the Windows Libarchive component - the library Windows uses to extract 7z, rar, tar, cab and similar archive formats - lets a remote attacker execute arbitrary code with the privileges of the user who opens a malicious archive. Because exploitation is delivered over the network (AV:N) with no authentication required (PR:N) but demands that the victim open or process the crafted file (UI:R), the realistic attack path is a phishing email attachment, a web download, or a hosted share rather than anything wormable; CISA's SSVC decision framework reflects this with Exploitation=none and Automatable=no. There is no public exploit identified at time of analysis and vendor patches are available, so the practical priority is patch deployment rather than emergency containment - while noting the CVSS 8.8 score masks that the mandatory user interaction is the single factor keeping risk below critical.
Use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc) allows remote code execution on a Windows client that connects out to a malicious or compromised RDP server, affecting all supported Windows 10, Windows 11, and Windows Server builds below the fixed patch levels listed in Microsoft's advisory. Exploitation is not opportunistic: it follows a reverse-RDP pattern in which the victim must initiate the session (UI:R) against attacker-controlled server infrastructure, and public exploitation is not confirmed - CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis. The negotiated CVSS of 7.5 is driven by high attack complexity (AC:H), reflecting the heap-state and timing control needed to win the use-after-free race, while requiring no privileges on the victim (PR:N) and impacting confidentiality, integrity, and availability equally.
Local privilege escalation in Microsoft's Quality Windows Audio/Video Experience (QWAVE) service stems from a use-after-free condition (CWE-416) that can let an already-authenticated local user execute code in the service's more privileged context, with high impact to confidentiality, integrity and availability (C:H/I:H/A:H). Rated CVSS 7.0 with a vector of AV:L/AC:H/PR:L/UI:N/S:U, exploitation requires an attacker who already holds a local account on the host and who can also win a timing or object-lifetime race - CISA's SSVC assessment records Exploitation=none and Automatable=no, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor-released patches for every affected branch, so this is best treated as a moderate-priority post-foothold escalation whose realistic risk is lower than the base score alone suggests, rather than an emergency to be handled outside the normal patch cycle.
Remote code execution in the Microsoft Remote Desktop Client (CWE-416) occurs when a user initiates an RDP connection to an attacker-controlled or compromised server that returns crafted responses, causing the client to reuse a freed memory object. The CVSS vector (AV:N/AC:H/PR:N/UI:R) shows an unauthenticated attacker is required to hold no credentials on the victim host, but must convince the user to start the session and satisfy high-complexity heap-timing conditions for reliable exploitation; impact is confined to the connecting user's security context with no privilege escalation implied. Exploitation only triggers on a client that actively connects outbound, and no public exploit identified at time of analysis.
Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.
Local privilege escalation in Microsoft Streaming Service on Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 allows an authenticated, low-privilege attacker who already has code execution on the host to exploit an integer wraparound and elevate privileges, with total impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is strictly local - the vector (AV:L/PR:L/UI:N) rules out remote or unauthenticated reach - and SSVC records exploitation as none with automatable set to no, so no public exploit code has been identified at time of analysis. This is a genuine patch-priority issue but not an emergency, and it matters most on multi-user, terminal-server and jump hosts where untrusted users can already run code.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.
Remote code execution in Windows iSCSI allows unauthenticated attackers to execute code over a network by exploiting a use-after-free (CWE-416) in the processing of crafted iSCSI protocol traffic. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, but the primary limiting factor is that the Microsoft iSCSI Initiator service and iSCSI Target Server role are not enabled by default, so exposure is largely confined to hosts configured for iSCSI storage such as SAN-backed servers. No public exploit identified at time of analysis, and reliable exploitation would require defeating Windows memory mitigations, raising practical difficulty beyond the AC:L rating.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Local privilege escalation in the Windows Certificates component allows an authenticated attacker who already holds a low-privileged session on a Windows host to trigger an untrusted pointer dereference (CWE-822) and gain full control of that system, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation is strictly local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), and does not change security scope (S:U), so it is a post-compromise escalation step rather than a remote entry point; default Windows installations carrying the affected component are exposed because no non-default configuration is indicated. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so it is not confirmed actively exploited; Microsoft's update guide is the authoritative remediation reference.
Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.
Unauthenticated remote code execution in the Microsoft Windows DHCP Server role is achievable when an attacker on a reachable network segment wins a race condition on a shared resource inside the DHCP service. The vulnerability is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with complete confidentiality, integrity and availability impact, but the high attack complexity reflects a narrow, non-deterministic synchronization window that makes exploitation unreliable and typically requires repeated concurrent DHCP requests, potentially combined with favorable server load conditions. No public exploit code was identified at time of analysis and there is no CISA KEV listing; hosts without the DHCP Server role installed, or where DHCP traffic cannot be reached from an untrusted segment, are not exposed.
Weak authentication in the Network Device Enrollment Service (NDES) of Active Directory Certificate Services (AD CS) allows a remote, unauthenticated attacker to execute code on affected Windows Server installations. Only servers that have the optional, non-default NDES role installed and whose SCEP enrollment endpoint is network-reachable are exposed; Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 are affected across both full and Server Core installations. The assessed vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact, meaning no credentials or user interaction are needed but successful exploitation depends on attacker-uncontrollable conditions (a weak-authentication edge case), consistent with CISA SSVC Exploitation=None and Automatable=no; no public exploit has been identified at the time of analysis, and EPSS/KEV data were not provided.
Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.
Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege elevation on supported Windows builds stems from the Windows Key Distribution Center (KDC) accepting cryptographic signatures it should have rejected, letting an attacker who already holds low-privileged credentials and local access to an affected host reach high integrity and confidentiality impact (CVSS 7.8, AV:L/PR:L/UI:N). The KDC role normally runs only on Windows Server Domain Controllers, although the vulnerable code ships across every client and server build enumerated in the EUVD data - Windows 10 1607/1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025. Microsoft has published a fix through the MSRC update guide; no public exploit code and no CISA KEV entry were identified at time of analysis, and the independent assessment rates this as a genuine but second-tier priority because exploitation requires a pre-existing foothold and validated credentials rather than a remote or unauthenticated path.
Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.
Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.
Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).
Unauthenticated remote attackers can disclose sensitive memory contents from Microsoft Azure Attestation and the Windows Server Device Health Attestation Service through an out-of-bounds read (CWE-125) triggered by a crafted request to an exposed attestation endpoint, rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The practical exposure is limited: on-premises Device Health Attestation is an optional Windows Server role, so only hosts where it is enabled and network-reachable are at risk, specifically Windows Server 2019 before 10.0.17763.9376, Windows Server 2022 before 10.0.20348.5761, and Windows Server 2025 before 10.0.26100.33650. Impact is confined to information disclosure with high confidentiality loss and no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.
Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.
Use-after-free in the Windows Enterprise App Management component lets an attacker with valid low-level credentials on a target machine, who can reach that machine over the network, corrupt freed memory and elevate to a higher-integrity context. Exploitation is gated by three limiters recorded in the assessed vector: the attacker must already hold a valid account on the target (PR:L), a victim user must perform an interaction (UI:R), and the memory-reuse race that gives an attacker control of the freed object is non-deterministic (AC:H) - so although the attack vector is network-reachable, real-world reliability and prerequisites keep this a moderate-priority issue rather than an emergency. Microsoft has released fixes in the current Windows cumulative updates, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.
Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.
Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.
Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.
Local privilege escalation in the Windows Perception Simulation Service allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The flaw is not remotely reachable: the attacker must first establish a foothold on the machine and be able to interact with the service so that the vulnerable memory is freed and then reused under attacker control. Exploitation reliability depends on winning the memory-reclamation race, and the Perception Simulation Service (a Windows Holographic / mixed-reality component) must be present and active in the target configuration for the vulnerable code path to be exercised. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H2, and Windows Server 2019, and a vendor fix is available; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.
Local security feature bypass in Windows UEFI (CVE-2026-49785) allows an authenticated attacker who already holds a low-privileged account on the host to defeat a boot/UEFI-related security feature, with the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) reflecting high confidentiality, integrity and availability impact once that local foothold exists. Exploitation is not remote and requires no user interaction, but it does require pre-existing local access and an account on the system; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as "none" with automation as "no", so this is a moderate-priority local hardening issue rather than an emergency. A vendor patch is available from Microsoft via the MSRC Security Update Guide, and the affected build ranges span most supported Windows client and server releases, including Server 2012 through Server 2025.
Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.
Local privilege escalation in the Microsoft Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low privileges on an affected host to execute against higher-integrity code inside the isolated secure environment, achieving elevated privileges locally. The defect is an untrusted pointer dereference (CWE-822) in the enclave interface, and because the code runs inside a security boundary the CVSS assessment is scope-changed (S:C) with high confidentiality, integrity and availability impact (CVSS 8.8, AV:L/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no', and a vendor patch is available, so this is a genuine but non-emergency priority that matters chiefly as a post-compromise escalation primitive on hosts where VBS is deployed.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.
Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.
Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.
Use-after-free in Windows Message Queuing (MSMQ) allows unauthenticated remote attackers to execute arbitrary code on systems where the optional MSMQ feature is installed and its listener is network-reachable, typically on TCP port 1801. Exploitation requires winning a memory race due to the high attack complexity (CVSS AC:H), and the feature is not enabled by default, which significantly limits real-world exposure; no public exploit identified at time of analysis.
Remote code execution in Microsoft Remote Desktop Client can be triggered when a victim connects to a malicious or compromised RDP server, exploiting a use-after-free (CWE-416) condition during processing of server responses. The vulnerability requires user interaction (UI:R) - the victim must initiate the RDP connection, for example via a malicious .rdp file or social engineering - but no authentication to the victim's system is needed (PR:N), and it is remotely exploitable with low complexity (AV:N/AC:L). CVSS 3.1 score is 8.8, reflecting high confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privileged attacker to gain elevated privileges by winning a time-of-check time-of-use race condition in the MDM component. The flaw is rated CVSS 7.0 (High) and requires local access and a narrow timing window (AC:H), with no public exploit identified at time of analysis. Affected are Windows hosts with the MDM component enabled, and successful exploitation could lead to complete compromise of confidentiality, integrity, and availability.
Local privilege escalation in the Microsoft Windows Search Component lets an authenticated, low-privileged attacker on a Windows host trigger a use-after-free (CWE-416) and gain elevated privileges, potentially SYSTEM, with high impact to confidentiality, integrity, and availability. Exploitation requires local access and a valid low-privilege account (CVSS PR:L/AV:L) and no user interaction; it cannot be triggered remotely and is therefore a post-compromise escalation step, especially risky on shared, multi-user, RDP, or terminal-server hosts. No public exploit was identified at time of analysis, and this is assessed as a credible but not emergency-tier patch priority.
Local privilege escalation in the Microsoft Windows Kerberos component lets an attacker who already holds low-privileged code execution on a target host trigger a double-free memory-corruption condition (CWE-415) and elevate to a higher-integrity context. Per the assessed vector (AV:L/AC:H/PR:L/UI:N), the attack is strictly local and requires an authenticated low-privileged foothold, with high complexity reflecting the need to win a race or reach a specific memory/timing state that is not reliably reproducible, which materially limits weaponization; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS signal was supplied. The flaw is present in default installations of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds below their patched levels, and Microsoft has released updates (MSRC update guide referenced for CVE-2026-108132).
An untrusted pointer dereference (CWE-822) in the Windows Distributed File System (DFS) component allows unauthenticated remote attackers to elevate privileges on affected, unpatched Windows and Windows Server builds, per the CVSS vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact (9.8). Every Windows 10 branch (1607 through 22H2), Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 - including Server Core installations - are listed as affected below their respective fixed builds. No public exploit code or active exploitation is confirmed at time of analysis (SSVC Exploitation: none), though EPSS is 1.15% (66th percentile), SSVC Automation: yes and Technical Impact: total, and the priority label is act_now; the practical limiting factor is network reachability of the DFS service.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows Search component of Microsoft Windows allows unauthenticated remote attackers to elevate privileges, per a CVSS 3.1 score of 9.8. No public exploit code has been identified at time of analysis. However, the description's framing as privilege elevation-which typically requires a local foothold-conflicts with the network-unauthenticated vector; confirm exact preconditions via the MSRC advisory.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Spoofing in Windows Schannel allows an unauthenticated attacker positioned on the network path between a client and server to interfere with TLS session establishment, potentially bypassing authentication and compromising confidentiality and integrity. Microsoft rates this CVSS 9.0, while our independent assessment assigns a modified vector with no availability impact (A:N) and notes that exploitation requires high attack complexity (AC:H) due to the need for a man-in-the-middle position and specific handshake/timing conditions. No public exploit identified at time of analysis.
Elevation of privilege in Windows NDIS (ndis.sys) allows a local authenticated user to run processes in an elevated context by exploiting an out-of-bounds read caused by a missing buffer-length check. The vulnerability affects all Windows systems with the default NDIS driver, requiring the attacker to already have local access and the ability to execute a malicious application. No public exploit code has been identified at time of analysis, and Microsoft has released a security update to address the flaw.
Local privilege escalation in the Windows Overlay Filter (wof.sys) driver on affected Windows systems allows an authenticated attacker with low-privileged code execution to trigger an out-of-bounds read (CWE-125) and elevate privileges to a higher integrity level. The flaw is rated CVSS 7.8 (High) and requires no user interaction (UI:N), but the attacker must already have a local foothold (PR:L, AV:L). No public exploit code or active exploitation has been identified at time of analysis; a vendor advisory is available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.
Remote code execution in Remote Desktop Client can be triggered when a user connects to an attacker-controlled or compromised RDP server, due to a use-after-free in the client. The attacker does not need credentials (PR:N), but the victim must initiate the outbound RDP session (UI:R), so environments that restrict outbound RDP to trusted hosts are less exposed; successful exploitation runs code in the context of the connecting user. No public exploit identified at time of analysis; this is a serious client-side vulnerability but not an emergency because the attacker cannot reach the client unsolicited.
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).