Windows Server 2019
Monthly
Out-of-bounds read in Windows DHCP Server (CWE-125) allows unauthenticated remote attackers to crash the DHCP service, denying IP address assignment to all clients on affected subnets. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds with the DHCP Server role enabled. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis, but the AV:N/PR:N attack surface on a critical network infrastructure service warrants prompt patching.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated local user to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-763 (Release of Invalid Pointer or Reference) - a memory-safety defect in the service's pointer lifecycle management that, when triggered, enables code execution at elevated privilege. No public exploit code or active exploitation has been identified at time of analysis, but the zero-interaction, low-complexity CVSS vector makes this a high-priority patching target for any organization running unpatched Windows endpoints or servers.
Type confusion (CWE-843) in the Windows DHCP Server service allows an unauthenticated remote attacker to crash the service, causing denial of service across the network. The flaw affects all major Windows Server generations from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809, wherever the DHCP Server role is active. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server role exposes all supported Windows Server versions - from Server 2012 through Server 2025 - to unauthenticated network-based denial of service. An attacker on the network can send a specially crafted DHCP packet that triggers the CWE-125 read violation, crashing or hanging the DHCP service and severing lease renewal for all network clients served by that instance. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Type confusion (CWE-843) in the Windows DHCP Server service allows unauthenticated remote attackers to crash the service, causing a denial of service across affected Windows Server deployments. The flaw spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds 1607 and 1809 that run the DHCP Server role. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Security feature bypass in Microsoft Windows iSCSI (Initiator/Target service) lets a remote, unauthenticated attacker defeat the protocol's weak authentication over the network, per Microsoft's advisory carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact. The flaw spans essentially the entire supported Windows Server line (2012 through 2025) plus Windows 10 (1607/1809), and a vendor patch is available. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privilege attacker to achieve full SYSTEM-level access via a use-after-free (CWE-416) memory corruption condition. The flaw spans an exceptionally broad surface - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making it relevant to virtually every supported enterprise Windows deployment using MDM enrollment. Vendor patches are available via the MSRC advisory; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Local privilege escalation in the Windows Data Sharing Service Client (DsSvc) enables a low-privileged authenticated local user to gain SYSTEM-level access across a sweeping range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-862 (Missing Authorization): the service client fails to enforce authorization checks on operations that should be restricted to higher-privilege callers, allowing a standard user account to invoke privileged service operations without additional conditions. Vendor-released patches are available via Microsoft's update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Authentication Methods affects all supported Windows 10, Windows 11, and Windows Server releases through a use-after-free condition triggered via a race condition (CWE-362). An attacker with low-privileged local access can win a timing window in the authentication subsystem, corrupt freed memory, and elevate to full SYSTEM-level privileges with complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions - spanning every major Windows release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - makes this a high-priority patch for any Windows fleet.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated attacker with low privileges to gain full system-level access via a use-after-free memory corruption condition. The vulnerability affects a broad surface of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Microsoft has released patches across all affected product lines; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WinBio) allows an authenticated low-privileged user to gain full system control via a heap-based buffer overflow. The flaw spans a broad surface - Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016 through 2025 - all pre-patched builds are affected. Microsoft has released security updates addressing the overflow; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service enables local privilege escalation to SYSTEM-level access across a wide range of Windows client and server releases. Any low-privileged, authorized local user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) affects the full current Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated local user can trigger the overflow to achieve full SYSTEM-level code execution, with complete confidentiality, integrity, and availability impact on the local machine. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build branches via the standard update guide.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Unauthenticated remote denial of service in Microsoft Active Directory Federation Services (AD FS) allows any network attacker who can reach a federation endpoint to exhaust server resources and degrade or halt authentication services on affected Windows builds. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials or user interaction are required, and Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 1607/1809 hosting the role are in scope; the flaw does not permit data theft, tampering, or code execution. There is no public exploit identified at time of analysis and CISA KEV does not list this CVE; EPSS is low (0.80%, 54th percentile) and CISA's SSVC rates Exploitation=none, Automatable=no, Technical Impact=partial, making this a genuine but moderate-priority availability risk, with the main caveat that only hosts actually running the optionally-installed AD FS role are exposed. Vendor patches are available.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Local privilege escalation in Microsoft's Windows DNS Server implementation allows an authenticated, low-privileged local user to seize higher privileges (up to SYSTEM) on hosts running the DNS Server role, including Active Directory domain controllers and the Windows Server 2012 through 2025 lines plus Windows 10 1607/1809 clients (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a relative path traversal (CWE-23) that a hands-on-keyboard attacker can exercise after already obtaining a foothold on the box; there is no remote or unauthenticated path and no user interaction is required. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis (EPSS 0.37%, 30th percentile; CISA SSVC Exploitation: none, Automatable: no), so this is a genuine but not top-tier priority that matters most for hardened, multi-tenant, or legacy servers where local-user-to-SYSTEM escalation is a meaningful boundary crossing.
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in Windows Winsock allows a locally authenticated, low-privileged attacker to elevate privileges to kernel level on unpatched Windows hosts. The flaw resides in the default-present Winsock socket stack and affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025, including Server Core installations; exploitation requires the attacker to already hold a foothold on the host (CVSS AV:L, PR:L, UI:N), making this a privilege-escalation primitive rather than a remotely reachable entry point. No public exploit code has been identified at time of analysis - EPSS is 0.26% (17th percentile) and CISA SSVC records exploitation as "none" - but vendor patches are available and the technical impact of a successful heap corruption is total (C:H/I:H/A:H).
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an authorized local attacker with low privileges to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) reflects that exploitation requires local access and elevated complexity, limiting opportunistic automated attacks but not targeted use. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Out-of-bounds read in Windows DHCP Server (CWE-125) allows unauthenticated remote attackers to crash the DHCP service, denying IP address assignment to all clients on affected subnets. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds with the DHCP Server role enabled. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis, but the AV:N/PR:N attack surface on a critical network infrastructure service warrants prompt patching.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated local user to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-763 (Release of Invalid Pointer or Reference) - a memory-safety defect in the service's pointer lifecycle management that, when triggered, enables code execution at elevated privilege. No public exploit code or active exploitation has been identified at time of analysis, but the zero-interaction, low-complexity CVSS vector makes this a high-priority patching target for any organization running unpatched Windows endpoints or servers.
Type confusion (CWE-843) in the Windows DHCP Server service allows an unauthenticated remote attacker to crash the service, causing denial of service across the network. The flaw affects all major Windows Server generations from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809, wherever the DHCP Server role is active. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server role exposes all supported Windows Server versions - from Server 2012 through Server 2025 - to unauthenticated network-based denial of service. An attacker on the network can send a specially crafted DHCP packet that triggers the CWE-125 read violation, crashing or hanging the DHCP service and severing lease renewal for all network clients served by that instance. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Type confusion (CWE-843) in the Windows DHCP Server service allows unauthenticated remote attackers to crash the service, causing a denial of service across affected Windows Server deployments. The flaw spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds 1607 and 1809 that run the DHCP Server role. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Security feature bypass in Microsoft Windows iSCSI (Initiator/Target service) lets a remote, unauthenticated attacker defeat the protocol's weak authentication over the network, per Microsoft's advisory carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact. The flaw spans essentially the entire supported Windows Server line (2012 through 2025) plus Windows 10 (1607/1809), and a vendor patch is available. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privilege attacker to achieve full SYSTEM-level access via a use-after-free (CWE-416) memory corruption condition. The flaw spans an exceptionally broad surface - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making it relevant to virtually every supported enterprise Windows deployment using MDM enrollment. Vendor patches are available via the MSRC advisory; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Local privilege escalation in the Windows Data Sharing Service Client (DsSvc) enables a low-privileged authenticated local user to gain SYSTEM-level access across a sweeping range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-862 (Missing Authorization): the service client fails to enforce authorization checks on operations that should be restricted to higher-privilege callers, allowing a standard user account to invoke privileged service operations without additional conditions. Vendor-released patches are available via Microsoft's update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Authentication Methods affects all supported Windows 10, Windows 11, and Windows Server releases through a use-after-free condition triggered via a race condition (CWE-362). An attacker with low-privileged local access can win a timing window in the authentication subsystem, corrupt freed memory, and elevate to full SYSTEM-level privileges with complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions - spanning every major Windows release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - makes this a high-priority patch for any Windows fleet.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated attacker with low privileges to gain full system-level access via a use-after-free memory corruption condition. The vulnerability affects a broad surface of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Microsoft has released patches across all affected product lines; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WinBio) allows an authenticated low-privileged user to gain full system control via a heap-based buffer overflow. The flaw spans a broad surface - Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016 through 2025 - all pre-patched builds are affected. Microsoft has released security updates addressing the overflow; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service enables local privilege escalation to SYSTEM-level access across a wide range of Windows client and server releases. Any low-privileged, authorized local user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) affects the full current Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated local user can trigger the overflow to achieve full SYSTEM-level code execution, with complete confidentiality, integrity, and availability impact on the local machine. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build branches via the standard update guide.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Unauthenticated remote denial of service in Microsoft Active Directory Federation Services (AD FS) allows any network attacker who can reach a federation endpoint to exhaust server resources and degrade or halt authentication services on affected Windows builds. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials or user interaction are required, and Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 1607/1809 hosting the role are in scope; the flaw does not permit data theft, tampering, or code execution. There is no public exploit identified at time of analysis and CISA KEV does not list this CVE; EPSS is low (0.80%, 54th percentile) and CISA's SSVC rates Exploitation=none, Automatable=no, Technical Impact=partial, making this a genuine but moderate-priority availability risk, with the main caveat that only hosts actually running the optionally-installed AD FS role are exposed. Vendor patches are available.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network-positioned attacker to execute arbitrary code with system privileges on affected Windows hosts by sending crafted requests to the RRAS service, a consequence of a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The exposure is conditioned on the host actually running the RRAS role: RRAS is not installed or enabled in default Windows and Windows Server configurations, so only machines explicitly deployed as routers, VPN concentrators, or remote-access gateways (and reachable from the attacker's network path) are at risk, which is consistent with the low EPSS score of 0.89% (57th percentile). Exploitation status at the time of analysis is "no public exploit identified at time of analysis" per CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total), and Microsoft has released vendor patches, making prompt patching of any internet- or WAN-exposed RRAS deployment the priority action.
Local privilege escalation in Microsoft's Windows DNS Server implementation allows an authenticated, low-privileged local user to seize higher privileges (up to SYSTEM) on hosts running the DNS Server role, including Active Directory domain controllers and the Windows Server 2012 through 2025 lines plus Windows 10 1607/1809 clients (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a relative path traversal (CWE-23) that a hands-on-keyboard attacker can exercise after already obtaining a foothold on the box; there is no remote or unauthenticated path and no user interaction is required. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis (EPSS 0.37%, 30th percentile; CISA SSVC Exploitation: none, Automatable: no), so this is a genuine but not top-tier priority that matters most for hardened, multi-tenant, or legacy servers where local-user-to-SYSTEM escalation is a meaningful boundary crossing.
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in Windows Winsock allows a locally authenticated, low-privileged attacker to elevate privileges to kernel level on unpatched Windows hosts. The flaw resides in the default-present Winsock socket stack and affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025, including Server Core installations; exploitation requires the attacker to already hold a foothold on the host (CVSS AV:L, PR:L, UI:N), making this a privilege-escalation primitive rather than a remotely reachable entry point. No public exploit code has been identified at time of analysis - EPSS is 0.26% (17th percentile) and CISA SSVC records exploitation as "none" - but vendor patches are available and the technical impact of a successful heap corruption is total (C:H/I:H/A:H).
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an authorized local attacker with low privileges to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) reflects that exploitation requires local access and elevated complexity, limiting opportunistic automated attacks but not targeted use. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.