Windows Server 2022
Monthly
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Guest-to-host code execution in Windows Hyper-V affects authorized guest VM users who can trigger an untrusted pointer dereference (CWE-822) to execute code in the hypervisor context, effectively escaping the VM sandbox. The CVSS scope-change metric (S:C) confirms this is a privilege escalation from guest to host, making it a hypervisor escape with full High C/I/A impact on the underlying host. Affected platforms span Windows Server 2022 and 2025 and multiple Windows 11 release channels (23H2 through 25H2). No public exploit or CISA KEV listing identified at time of analysis; vendor patch is available.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Guest-to-host code execution in Windows Hyper-V affects authorized guest VM users who can trigger an untrusted pointer dereference (CWE-822) to execute code in the hypervisor context, effectively escaping the VM sandbox. The CVSS scope-change metric (S:C) confirms this is a privilege escalation from guest to host, making it a hypervisor escape with full High C/I/A impact on the underlying host. Affected platforms span Windows Server 2022 and 2025 and multiple Windows 11 release channels (23H2 through 25H2). No public exploit or CISA KEV listing identified at time of analysis; vendor patch is available.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Remote code execution in the Microsoft Graphics Component (GDI/graphics stack) affects the full supported Windows line - Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025 - where a double free (CWE-415) lets a remote attacker corrupt memory and run arbitrary code. Microsoft rates it CVSS 9.8 with a fully unauthenticated network vector and full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the affected component and Patch-Tuesday-class severity make it a high-priority fix.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.