Windows Server 2019
Monthly
Local privilege escalation in the Windows Partition Management Driver lets an already-authorized, low-privileged user who can execute code on the host elevate privileges by triggering an out-of-bounds read against malformed partition-related structures handled by the kernel driver. Microsoft rates it CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a CWE-125 root cause, and because the driver is a standard in-box Windows component, default installations are affected with no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limiter is the prerequisite local foothold, making this a credible, patch-worthy privilege-escalation building block rather than an emergency or an initial-access vector.
Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.
Out-of-bounds read in Windows Text Shaping allows a remote, unauthenticated attacker to execute code on affected Windows systems when a victim opens or renders attacker-controlled content (UI:R), such as a document, web page, email, or font. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but with a CVSS score of 8.8 and high impact to confidentiality, integrity, and availability, it represents a credible high-priority risk that is not a top-of-queue emergency on current signals.
Local privilege escalation in the Windows VHD miniport driver allows an authenticated attacker with low privileges to execute arbitrary code in kernel mode, resulting in full system compromise. This use-after-free (CWE-416) vulnerability requires the attacker to already possess low-privileged local access and the ability to interact with the virtual disk subsystem. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data is not available; the CVSS score is 7.8.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.
Authenticated privilege escalation in Microsoft WebDAV lets a low-privileged network user bypass authorization by supplying an alternate but equivalent path representation, causing access-control checks to be evaluated against the wrong canonical path; successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing authorized account on the target plus network reach to the WebDAV service - it is not exploitable by a fully unauthenticated attacker - but needs no user interaction and has low attack complexity. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; patch availability was not specified in the provided intelligence and should be confirmed against the Microsoft MSRC advisory.
Local privilege escalation in the Windows StateRepository API allows an attacker who already has code execution as a low-privileged, authenticated user to trigger a type-confusion condition and gain higher-integrity code execution on the same machine. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw is not reachable remotely and requires no user interaction, but it cannot serve as an initial-access vector - it is a post-compromise escalation primitive that assumes a local foothold and valid credentials. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); combined with the local-only attack path, this is a credible but not emergency-tier internet-facing threat.
Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.
Use-after-free memory corruption in Windows Hyper-V allows an authenticated low-privileged attacker who already has code execution inside a guest VM to trigger memory corruption in the hypervisor and, per the assessed scope change, likely cross the guest-to-host boundary with high confidentiality, integrity, and availability impact. The CVSS:3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, so the flaw is local, low-complexity, requires low privileges, needs no user interaction, and has Changed scope; it is not a remote unauthenticated network-reachable bug. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV active-exploitation entry was provided.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.
Privilege escalation in the Windows Win32k kernel subsystem lets an authenticated local attacker who already holds a low-privileged foothold (CVSS PR:L, AV:L) corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM-level code execution with high confidentiality, integrity, and availability impact. Because the vulnerability depends on a timing-sensitive race or a specific memory-reclamation state, the attack complexity is rated high (AC:H) and success is non-deterministic, confining this to post-compromise escalation rather than initial access; no user interaction is required (UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS base score of 7.0 reflects the local-only vector tempered by the unreliable race condition.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.
Denial of service in Windows Failover Cluster allows an unauthenticated remote attacker with network reachability to the cluster service communication interface to trigger an integer underflow (CWE-191) and disrupt cluster availability. The issue affects Windows Server systems where the Failover Clustering role or feature is installed and active; standalone Windows servers are not impacted. CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is availability-only, and no public exploit code or CISA KEV active exploitation is identified in the provided data.
Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.
Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.
Remote code execution in the Remote Desktop Gateway Service (Windows Server) via a use-after-free memory corruption flaw (CWE-416) allows an unauthenticated network attacker to execute code with high impact. Although the assessed vector (AV:N/AC:H/PR:N/UI:N) requires no authentication or user interaction, the high attack complexity means exploitation depends on winning a memory-reuse race, making success probabilistic. No public exploit code or confirmed active exploitation has been identified at time of analysis, and organizations that restrict RD Gateway exposure behind VPN/MFA or do not deploy the role are materially less exposed.
Local privilege escalation in Windows Group Policy allows an authenticated, low-privileged attacker who already has interactive or code-execution access on a Windows host to elevate privileges to a higher-integrity context. The flaw is an access-control weakness (CWE-862) in how a privileged Group Policy operation is authorized, requiring no user interaction (UI:N) and low attack complexity (AC:L) once a foothold exists, which makes it most impactful on shared multi-user systems such as terminal/RDS servers, VDI hosts, and domain-joined endpoints where untrusted users hold accounts. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is credited as the reporting vendor.
Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.
Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.
Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.
Unauthenticated remote code execution in Windows Message Queuing (MSMQ) Queue Manager affects systems where the optional MSMQ feature is installed and reachable. The use-after-free (CWE-416) in the Queue Manager allows an attacker to execute arbitrary code over the network without authentication, but the attack surface is significantly limited because MSMQ is not enabled by default and must be exposed on TCP port 1801 (or related ports). No public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) miniport driver (vhdmp.sys) allows an attacker who already holds local, low-privileged access on an affected Windows 10, Windows 11, or Windows Server build to corrupt kernel heap memory and potentially execute code in kernel context by triggering driver processing of a mounted VHD/VHDX virtual disk. The issue is rated 7.8 and was addressed by Microsoft as a kernel elevation-of-privilege fix; there is no public exploit identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.21% (12th percentile), indicating limited near-term exploitation likelihood. Independent assessment scores AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so this is a genuine but not high-urgency priority: exploitation requires pre-existing authenticated local access plus heap grooming to overcome high attack complexity, but the technical impact is total because success yields kernel-level control of the host.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Remote code execution via a use-after-free defect in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated network attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability resides in a kernel-mode multicast transport driver, and successful exploitation achieves full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
A use-after-free (CWE-416) in the Microsoft Windows Distributed File System (DFS) service lets an attacker who already holds low-privilege authorized access and can reach DFS over the network crash or destabilize the service, producing a denial-of-service condition on the affected host. Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 are in scope, and the attack surface only exists where DFS is enabled or in use. Exploitation is limited by the high attack complexity of the underlying memory-reuse race, no public exploit code has been identified at time of analysis, and EPSS is low at 0.61% (47th percentile), so this is a moderate-priority patch rather than an emergency. Vendor-released patches are available through Microsoft's update guide.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Remote code execution in Windows Failover Cluster allows an unauthenticated network attacker to fully compromise affected Windows Server systems by triggering an untrusted pointer dereference (CWE-822) over the network. Affected deployments span Windows Server 2019, 2022, and 2025 (including Server Core variants) and Windows 10 Version 1809, with vendor-released patches available via Microsoft Security Response Center. No public exploit has been identified at time of analysis, but the full C:H/I:H/A:H impact delivered without authentication makes this a high-priority patching target for any organization running Windows Server clustering.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows a remote unauthenticated attacker to crash the service over a network, resulting in denial of service for all DHCP-dependent clients on the affected segment. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 1607 and 1809, and reflects Microsoft's own reporting (secure@microsoft.com). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack surface and widespread deployment of Windows DHCP in enterprise environments elevate operational impact.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service enables an unauthenticated remote attacker to crash the service by sending a crafted network packet, resulting in denial of DHCP service to all network clients. All actively supported Windows Server releases from 2012 through 2025 are affected, as is Windows 10 versions 1607 and 1809 with the DHCP Server role installed. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote denial-of-service in the Windows DHCP Server service across a broad range of Windows Server builds (2012 through 2025) stems from a type confusion flaw (CWE-843) in packet-processing logic. A network-adjacent or remote attacker can send a malformed DHCP packet that causes the server process to access a resource using an incompatible type, crashing the DHCP service and halting IP address assignment for all dependent clients. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but the zero-authentication requirement and broad version footprint make this a practical target.
Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.
Type confusion (CWE-843) in Windows DHCP Server enables unauthenticated remote denial of service across an extensive range of Windows Server releases, from Windows Server 2012 through Windows Server 2025. An attacker on the network can send a malformed DHCP packet that triggers incompatible type access in the DHCP service, crashing it and disrupting IP address assignment for all network clients served by that host. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a straightforward network-reachable DoS.
Unauthenticated remote denial-of-service in the Windows DHCP Server role allows network-accessible attackers to crash the DHCP service by sending malformed packets that trigger an out-of-bounds read (CWE-125). Affected versions span Windows Server 2012 through Windows Server 2025, all requiring the DHCP Server role to be installed and running. Microsoft has released patches for all supported versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Remote code execution via a double-free memory corruption flaw (CWE-415) in Microsoft Office Word enables an unauthenticated network-reachable attacker to execute arbitrary code on a victim's machine when the victim opens or previews a specially crafted document (UI:R). The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full host compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.
Local privilege escalation in the Windows Partition Management Driver lets an already-authorized, low-privileged user who can execute code on the host elevate privileges by triggering an out-of-bounds read against malformed partition-related structures handled by the kernel driver. Microsoft rates it CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a CWE-125 root cause, and because the driver is a standard in-box Windows component, default installations are affected with no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limiter is the prerequisite local foothold, making this a credible, patch-worthy privilege-escalation building block rather than an emergency or an initial-access vector.
Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.
Out-of-bounds read in Windows Text Shaping allows a remote, unauthenticated attacker to execute code on affected Windows systems when a victim opens or renders attacker-controlled content (UI:R), such as a document, web page, email, or font. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but with a CVSS score of 8.8 and high impact to confidentiality, integrity, and availability, it represents a credible high-priority risk that is not a top-of-queue emergency on current signals.
Local privilege escalation in the Windows VHD miniport driver allows an authenticated attacker with low privileges to execute arbitrary code in kernel mode, resulting in full system compromise. This use-after-free (CWE-416) vulnerability requires the attacker to already possess low-privileged local access and the ability to interact with the virtual disk subsystem. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data is not available; the CVSS score is 7.8.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.
Authenticated privilege escalation in Microsoft WebDAV lets a low-privileged network user bypass authorization by supplying an alternate but equivalent path representation, causing access-control checks to be evaluated against the wrong canonical path; successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing authorized account on the target plus network reach to the WebDAV service - it is not exploitable by a fully unauthenticated attacker - but needs no user interaction and has low attack complexity. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; patch availability was not specified in the provided intelligence and should be confirmed against the Microsoft MSRC advisory.
Local privilege escalation in the Windows StateRepository API allows an attacker who already has code execution as a low-privileged, authenticated user to trigger a type-confusion condition and gain higher-integrity code execution on the same machine. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw is not reachable remotely and requires no user interaction, but it cannot serve as an initial-access vector - it is a post-compromise escalation primitive that assumes a local foothold and valid credentials. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); combined with the local-only attack path, this is a credible but not emergency-tier internet-facing threat.
Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.
Use-after-free memory corruption in Windows Hyper-V allows an authenticated low-privileged attacker who already has code execution inside a guest VM to trigger memory corruption in the hypervisor and, per the assessed scope change, likely cross the guest-to-host boundary with high confidentiality, integrity, and availability impact. The CVSS:3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, so the flaw is local, low-complexity, requires low privileges, needs no user interaction, and has Changed scope; it is not a remote unauthenticated network-reachable bug. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV active-exploitation entry was provided.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.
Privilege escalation in the Windows Win32k kernel subsystem lets an authenticated local attacker who already holds a low-privileged foothold (CVSS PR:L, AV:L) corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM-level code execution with high confidentiality, integrity, and availability impact. Because the vulnerability depends on a timing-sensitive race or a specific memory-reclamation state, the attack complexity is rated high (AC:H) and success is non-deterministic, confining this to post-compromise escalation rather than initial access; no user interaction is required (UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS base score of 7.0 reflects the local-only vector tempered by the unreliable race condition.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.
Denial of service in Windows Failover Cluster allows an unauthenticated remote attacker with network reachability to the cluster service communication interface to trigger an integer underflow (CWE-191) and disrupt cluster availability. The issue affects Windows Server systems where the Failover Clustering role or feature is installed and active; standalone Windows servers are not impacted. CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is availability-only, and no public exploit code or CISA KEV active exploitation is identified in the provided data.
Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.
Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.
Remote code execution in the Remote Desktop Gateway Service (Windows Server) via a use-after-free memory corruption flaw (CWE-416) allows an unauthenticated network attacker to execute code with high impact. Although the assessed vector (AV:N/AC:H/PR:N/UI:N) requires no authentication or user interaction, the high attack complexity means exploitation depends on winning a memory-reuse race, making success probabilistic. No public exploit code or confirmed active exploitation has been identified at time of analysis, and organizations that restrict RD Gateway exposure behind VPN/MFA or do not deploy the role are materially less exposed.
Local privilege escalation in Windows Group Policy allows an authenticated, low-privileged attacker who already has interactive or code-execution access on a Windows host to elevate privileges to a higher-integrity context. The flaw is an access-control weakness (CWE-862) in how a privileged Group Policy operation is authorized, requiring no user interaction (UI:N) and low attack complexity (AC:L) once a foothold exists, which makes it most impactful on shared multi-user systems such as terminal/RDS servers, VDI hosts, and domain-joined endpoints where untrusted users hold accounts. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is credited as the reporting vendor.
Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.
Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.
Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.
Unauthenticated remote code execution in Windows Message Queuing (MSMQ) Queue Manager affects systems where the optional MSMQ feature is installed and reachable. The use-after-free (CWE-416) in the Queue Manager allows an attacker to execute arbitrary code over the network without authentication, but the attack surface is significantly limited because MSMQ is not enabled by default and must be exposed on TCP port 1801 (or related ports). No public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) miniport driver (vhdmp.sys) allows an attacker who already holds local, low-privileged access on an affected Windows 10, Windows 11, or Windows Server build to corrupt kernel heap memory and potentially execute code in kernel context by triggering driver processing of a mounted VHD/VHDX virtual disk. The issue is rated 7.8 and was addressed by Microsoft as a kernel elevation-of-privilege fix; there is no public exploit identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.21% (12th percentile), indicating limited near-term exploitation likelihood. Independent assessment scores AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so this is a genuine but not high-urgency priority: exploitation requires pre-existing authenticated local access plus heap grooming to overcome high attack complexity, but the technical impact is total because success yields kernel-level control of the host.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Remote code execution via a use-after-free defect in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated network attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability resides in a kernel-mode multicast transport driver, and successful exploitation achieves full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
A use-after-free (CWE-416) in the Microsoft Windows Distributed File System (DFS) service lets an attacker who already holds low-privilege authorized access and can reach DFS over the network crash or destabilize the service, producing a denial-of-service condition on the affected host. Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 are in scope, and the attack surface only exists where DFS is enabled or in use. Exploitation is limited by the high attack complexity of the underlying memory-reuse race, no public exploit code has been identified at time of analysis, and EPSS is low at 0.61% (47th percentile), so this is a moderate-priority patch rather than an emergency. Vendor-released patches are available through Microsoft's update guide.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Remote code execution in Windows Failover Cluster allows an unauthenticated network attacker to fully compromise affected Windows Server systems by triggering an untrusted pointer dereference (CWE-822) over the network. Affected deployments span Windows Server 2019, 2022, and 2025 (including Server Core variants) and Windows 10 Version 1809, with vendor-released patches available via Microsoft Security Response Center. No public exploit has been identified at time of analysis, but the full C:H/I:H/A:H impact delivered without authentication makes this a high-priority patching target for any organization running Windows Server clustering.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows a remote unauthenticated attacker to crash the service over a network, resulting in denial of service for all DHCP-dependent clients on the affected segment. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 1607 and 1809, and reflects Microsoft's own reporting (secure@microsoft.com). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack surface and widespread deployment of Windows DHCP in enterprise environments elevate operational impact.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service enables an unauthenticated remote attacker to crash the service by sending a crafted network packet, resulting in denial of DHCP service to all network clients. All actively supported Windows Server releases from 2012 through 2025 are affected, as is Windows 10 versions 1607 and 1809 with the DHCP Server role installed. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote denial-of-service in the Windows DHCP Server service across a broad range of Windows Server builds (2012 through 2025) stems from a type confusion flaw (CWE-843) in packet-processing logic. A network-adjacent or remote attacker can send a malformed DHCP packet that causes the server process to access a resource using an incompatible type, crashing the DHCP service and halting IP address assignment for all dependent clients. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but the zero-authentication requirement and broad version footprint make this a practical target.
Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.
Type confusion (CWE-843) in Windows DHCP Server enables unauthenticated remote denial of service across an extensive range of Windows Server releases, from Windows Server 2012 through Windows Server 2025. An attacker on the network can send a malformed DHCP packet that triggers incompatible type access in the DHCP service, crashing it and disrupting IP address assignment for all network clients served by that host. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a straightforward network-reachable DoS.
Unauthenticated remote denial-of-service in the Windows DHCP Server role allows network-accessible attackers to crash the DHCP service by sending malformed packets that trigger an out-of-bounds read (CWE-125). Affected versions span Windows Server 2012 through Windows Server 2025, all requiring the DHCP Server role to be installed and running. Microsoft has released patches for all supported versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Remote code execution via a double-free memory corruption flaw (CWE-415) in Microsoft Office Word enables an unauthenticated network-reachable attacker to execute arbitrary code on a victim's machine when the victim opens or previews a specially crafted document (UI:R). The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full host compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.