Windows Server 2022
Monthly
Windows Kernel information disclosure across a broad range of Microsoft Windows 10, Windows 11, and Windows Server editions allows a locally authenticated low-privileged attacker to read sensitive kernel memory contents they are not authorized to access. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is confined to local exploitation with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing the issue across all affected version branches per EUVD-2026-43865.
Windows Cryptographic Services improperly validates certificates across multiple Windows 10, 11, and Server editions, enabling remote unauthenticated attackers to bypass security features enforced by the PKI/certificate trust chain over a network path. Affected platforms span Windows 10 21H2 and 22H2, Windows 11 24H2 through 26H1, and Windows Server 2022 and 2025 in both full and Server Core deployments. No public exploit identified at time of analysis; EPSS at 0.24% (15th percentile) and SSVC exploitation status of 'none' together indicate low near-term exploitation probability despite the broad product footprint.
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Integer underflow in the Windows Kernel enables a locally authenticated attacker to disclose sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server platforms. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privilege local user can trigger the flaw without special configuration or user interaction, yielding high confidentiality impact with no integrity or availability consequences. Microsoft has released a patch via the July 2026 Security Update Guide; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.
Sensitive information disclosure in the Windows Kernel affects Windows 10 (versions 21H2 and 22H2), Windows 11 (versions 24H2, 25H2, and 26H1), and Windows Server 2022 and 2025, where the kernel writes sensitive data into log files that a low-privileged local user can access. An authorized attacker with a standard local account can read these log files to obtain sensitive kernel-level information, yielding high confidentiality impact with no integrity or availability consequence. No public exploit has been identified at time of analysis, and the EPSS score of 0.36% at the 28th percentile corroborates low near-term exploitation likelihood; Microsoft has released patches addressing all affected versions.
Privilege escalation to SYSTEM level is achievable in Windows Spaceport.sys - the kernel-mode Storage Spaces port driver - across a wide range of Windows 10, Windows 11, and Windows Server releases, when an attacker has physical access to the target machine. An integer overflow or wraparound in the driver's arithmetic logic (CWE-190) can corrupt kernel memory structures, enabling full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and SSVC confirms exploitation status as none, but the Technical Impact rating is total, meaning successful exploitation fully compromises the affected system.
Local information disclosure in Windows DirectX exposes sensitive data to unauthorized local actors across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-200) achieves high confidentiality impact per the CVSS vector while producing no integrity or availability impact, meaning an attacker gains read access to protected data without disrupting system operation. No public exploit has been identified at time of analysis; EPSS at 0.38% (30th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability despite the wide affected surface.
Uninitialized memory disclosure in the Windows SMB implementation enables a locally authenticated, low-privileged attacker to read sensitive contents from uninitialized kernel or heap buffers, achieving high confidentiality impact within the affected system. The vulnerability spans Windows 10 (from version 1607 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2012 through 2025 across both full and Server Core installation types. No public exploit code has been identified and CISA SSVC assesses exploitation status as none, placing this firmly in the patch-and-monitor category rather than emergency response.
Windows Kernel information disclosure across a broad range of Microsoft Windows desktop and server editions allows a local, unprivileged attacker to read sensitive kernel memory or system state not intended for user-space access. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N confirms local code execution with no special privileges is sufficient to trigger the flaw. EPSS sits at 0.38% (30th percentile) with no CISA KEV listing and SSVC exploitation status of 'none,' indicating no confirmed or publicly observed active exploitation at time of analysis; however, kernel information leaks of this class are routinely used to stage ASLR-bypass steps in multi-stage privilege escalation chains.
Privilege escalation to SYSTEM level is achievable in the Windows USB Video Class (UVC) driver across a broad swath of Windows 10, 11, and Server editions via physical connection of a malicious USB device. The heap-based buffer overflow (CWE-122) is triggered when the driver processes attacker-controlled UVC descriptors from a crafted device, corrupting kernel heap memory. No active exploitation is confirmed (absent from CISA KEV, SSVC exploitation=none), and EPSS sits at 0.37% (29th percentile), consistent with the physical access barrier that makes mass exploitation impractical.
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Windows Event Logging Service across a wide range of Windows 10, Windows 11, and Windows Server versions fails to enforce its intended protection mechanisms, permitting any authenticated low-privileged network user to read information that should be access-controlled. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only a valid low-privilege account and network connectivity, with no user interaction and no elevated rights - making it a practical post-compromise lateral-movement or reconnaissance tool. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, but the ubiquitous deployment footprint across the Windows ecosystem elevates organizational exposure.
Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Windows Audio Service on multiple Windows desktop and server versions improperly exposes sensitive information to locally authenticated standard users, enabling information disclosure without requiring elevated privileges. Affecting Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 (with Server 2022 and 2025 referenced in tags), the flaw is exploitable post-foothold by any low-privileged local account, making it a realistic post-exploitation pivot rather than an initial access vector. No public exploit code has been identified at time of analysis, and a vendor-released patch is confirmed available via the Microsoft Security Response Center.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Windows Remote Desktop Protocol (RDP) client leaks sensitive memory contents due to use of an uninitialized resource (CWE-908), allowing a network-accessible attacker to disclose potentially high-value information from a victim's system. Exploitation requires user interaction - a victim must connect to an attacker-controlled RDP endpoint - making this a client-side information disclosure attack affecting Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2012 through 2025. No public exploit code has been identified and no active exploitation is confirmed; however, the CVSS confidentiality impact is rated High, meaning exposed memory could include credentials or session tokens.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Missing authentication enforcement in the Microsoft Windows DNS component allows a low-privileged local attacker to tamper with DNS configuration or records without requiring elevated credentials. Affected platforms span Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025 - a broad deployment footprint across enterprise environments. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' with partial technical impact, but the high integrity impact (CVSS I:H) warrants attention in multi-user environments and on DNS server infrastructure where record integrity is critical.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Windows Media on multiple Windows client and server editions exposes sensitive information to authenticated local users, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad footprint of Microsoft's supported OS ecosystem. No active exploitation has been identified at time of analysis - the vulnerability is absent from CISA KEV, EPSS sits at 0.36% (28th percentile), and SSVC assesses exploitation status as none - making this a patch-and-monitor priority rather than an emergency response.
BitLocker's protection mechanism on Windows fails to enforce a critical authentication or verification step, permitting a physically present attacker to bypass full-disk encryption without credentials, a recovery key, or elevated privileges. Despite a CVSS score of 6.8 (Medium) - moderated by the physical access requirement - the impact ratings are High across confidentiality, integrity, and availability, meaning successful exploitation grants complete access to encrypted data and the underlying system. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Security feature bypass in Microsoft Windows BitLocker allows an attacker with physical access to circumvent the drive encryption protection mechanism. Affected systems can have BitLocker-protected data accessed despite the encryption-at-rest control being enabled, undermining a core platform confidentiality boundary. There is no public exploit identified at time of analysis, but the vulnerability is reported by Microsoft (secure@microsoft.com) as a protection mechanism failure with high impact across confidentiality, integrity, and availability.
BitLocker drive encryption on Windows can be bypassed by a physically present, unauthenticated attacker, exposing protected volume contents with high confidentiality impact. Classified as CWE-693 (Protection Mechanism Failure), the flaw undermines BitLocker's core threat model - data-at-rest protection - across a wide range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions; however, the physical access requirement means organizations with mobile or physically accessible systems should treat this as a higher operational priority than the CVSS score alone implies.
Spoofing via improper input validation affects Microsoft Azure Attestation service and the Device Health Attestation Service component across a broad range of Windows OS versions, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. An authorized attacker with high privileges and physical access to the target device can manipulate attestation inputs to spoof device health or platform integrity status, achieving a high-integrity impact with no confidentiality or availability consequence. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the CVSS score of 3.9 (Low) reflects the significant physical and privilege barriers to exploitation.
Out-of-bounds read in the Windows DHCP Server service enables a locally authenticated, low-privileged attacker to disclose contents of process memory on affected systems. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges - no elevated rights or user interaction needed. Exploitation is constrained to hosts where the Windows DHCP Server role is actively installed and running, which significantly limits the attack surface to designated infrastructure servers rather than general workstations. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Out-of-bounds read in Windows DHCP Server exposes adjacent memory contents and can crash the service, yielding both information disclosure and a high-severity denial-of-service condition on affected Windows systems. The flaw (CWE-125) is exploitable locally with low attack complexity and no user interaction, targeting systems where the DHCP Server role is installed across a broad range of Windows 10, 11, and Server editions from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via the MSRC update guide (CVE-2026-45608).
Out-of-bounds read in Microsoft's UxTheme Library (uxtheme.dll) enables a locally authenticated attacker to crash the affected Windows system, resulting in denial of service. The vulnerability spans a broad swath of Windows releases - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management critical for enterprise environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Mark of the Web (MOTW) protection mechanism failure across a broad range of Windows client and server releases allows unauthenticated network-based attackers to deliver files that evade the Zone.Identifier security tag, bypassing downstream defenses such as SmartScreen and Office Protected View that depend on MOTW presence. User interaction is required to trigger the bypass, limiting automated mass exploitation. No public exploit code exists and CISA has not listed this in KEV; however, the breadth of affected Windows versions - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - gives this vulnerability significant surface area as a link in social-engineering attack chains.
Information disclosure in the Windows Application Identity (AppID) Subsystem exposes sensitive data to locally authenticated, low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires only a local session with standard user privileges - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide affected surface spanning consumer and server SKUs makes patching a meaningful priority in multi-user or shared-system environments.
Use-after-free in the Windows Network Controller (NC) Host Agent enables a locally authenticated attacker to crash the service, resulting in a denial of service on affected Windows Server deployments. The vulnerability carries a CVSS score of 5.5 (Medium) with local attack vector and low-privilege requirements, limiting its blast radius to service availability - confidentiality and integrity are unaffected. No public exploit code exists and CISA KEV listing is absent at time of analysis, though a vendor patch from Microsoft is available and should be prioritized on Windows Server deployments leveraging Software Defined Networking.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated attacker to read sensitive information from memory without elevation of privilege. Affecting a wide range of Windows 10, Windows 11, and Windows Server builds, the vulnerability requires only low-privilege local access and no user interaction to trigger. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact, placing this in a lower-urgency remediation band despite the High confidentiality rating in the CVSS vector.
Local information disclosure in Windows Hyper-V enables an authenticated low-privileged attacker to access sensitive data they are not authorized to read, without any user interaction. Affected systems span a broad range of Windows desktop and server editions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis and no CISA KEV listing; however, the high confidentiality impact (C:H) and breadth of affected versions make this a meaningful patching priority, particularly in multi-tenant virtualization environments.
Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory contents through an uninitialized resource condition, allowing a low-privileged local user to read high-confidentiality data without any user interaction. The CVSS vector (AV:L/PR:L) confirms this is strictly a local privilege issue - no remote attack path exists - limiting its practical blast radius to insider threats and post-compromise lateral reconnaissance. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local attackers to disclose sensitive information across a wide breadth of Microsoft Windows desktop and server platforms. Spanning Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, the vulnerability carries a CVSS 5.5 Medium score with high confidentiality impact (C:H) but no integrity or availability impact. Microsoft has released patches via the June 2026 Patch Tuesday cycle; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Windows Push Notifications on a broad range of Windows 10, Windows 11, and Windows Server editions leaks sensitive memory contents to locally authenticated low-privileged users through an uninitialized resource condition (CWE-908). The CVSS vector confirms local attack vector with low-privilege authentication requirement, no user interaction needed, and high confidentiality impact - meaning an attacker who has already obtained a standard user account can read residual memory data that could include tokens, credentials, or other sensitive artifacts. No public exploit code exists and no active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Out-of-bounds read in the Windows Telephony Service exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. The flaw (CWE-125) is exploitable with only low privileges and no user interaction, yielding high confidentiality impact while leaving integrity and availability unaffected. No public exploit code or active exploitation has been identified; CISA's SSVC framework rates this as non-automatable with partial technical impact, placing it at medium operational priority.
Denial-of-service in the Windows TCP/IP stack allows an authenticated attacker on an adjacent network to crash the networking subsystem of affected Windows hosts via an incorrect buffer size calculation. Affected systems span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 - all unpatched builds within Microsoft-documented version ranges. No public exploit identified at time of analysis, though Microsoft has released fixes addressable via Windows Update; the vulnerability is not listed in the CISA KEV catalog.
Windows Kerberos out-of-bounds read (CWE-125) allows a low-privilege network attacker to crash the Kerberos authentication service across all actively supported Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. The attack requires prior domain authentication and high-complexity triggering conditions (CVSS AC:H), limiting opportunistic mass exploitation, though a successful attack against a domain controller can deny authentication domain-wide by crashing the KDC. Vendor patches are available via the Microsoft MSRC advisory; no public exploit code exists and SSVC confirms no observed exploitation at time of analysis.
Information disclosure in Windows Shell exposes sensitive data to authenticated low-privileged attackers, with a confirmed vendor patch available. The vulnerability stems from CWE-200 improper information exposure within the Windows Shell component, allowing confidentiality compromise with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact score (C:H) and low attack complexity elevate practical concern for environments where lateral movement or credential harvesting are threat vectors.
Windows Shell exposes sensitive information to locally authenticated, low-privileged attackers without requiring user interaction or elevated privileges. The vulnerability (CWE-200) results in high confidentiality impact, allowing disclosure of sensitive data accessible through the Shell component. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the Microsoft Security Response Center (MSRC) has acknowledged the issue via advisory.
Null pointer dereference in Windows Kerberos enables an authenticated network attacker to crash the Kerberos service, causing denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is achievable over the network by any low-privilege authenticated user with no user interaction required, resulting in high availability impact (A:H) with no confidentiality or integrity consequences. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.
Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim
Unauthorized disclosure of sensitive information in Windows Accessibility Infrastructure (ATBroker.exe) affects Windows Server 2019, 2025, Windows 10 22h2, and Windows 11 25h2, allowing local authenticated attackers to read confidential data. The vulnerability requires user privileges and local access but poses no risk to system integrity or availability. No patch is currently available for this issue.
Windows Shell Link Processing leaks sensitive information over the network in Windows Server 2012, 2019, and 2022, enabling remote spoofing attacks without authentication or user interaction. An unauthenticated attacker can exploit this information disclosure to conduct spoofing attacks against affected systems. No patch is currently available.
A division by zero flaw in the Microsoft Graphics Component on Windows 10 and Windows 11 systems enables local attackers to trigger a denial of service condition without requiring special privileges or user interaction. The vulnerability affects multiple Windows versions including Windows 10 1607, 22h2 and Windows 11 25h2, 26h1, with no patch currently available.
Microsoft Graphics Component on Windows 10 21H2, Windows Server 2016, and Windows 11 25H2 is vulnerable to a null pointer dereference that enables local denial of service attacks. An attacker with local access can trigger the vulnerability without requiring elevated privileges or user interaction to crash the graphics component and render the system unavailable. No patch is currently available for this medium-severity vulnerability.
Windows Kernel inadvertently logs sensitive information accessible to authenticated local users, enabling information disclosure attacks. This medium-severity vulnerability affects Windows 10 22H2, Windows 11 23H2, and 24H2, as well as Linux systems, allowing authorized attackers with local access to retrieve confidential data. No patch is currently available for this issue.
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. [CVSS 6.4 MEDIUM]
Uninitialized memory in the Dynamic Root of Trust for Measurement (DRTM) component of Windows 11 25h2, Windows Server 2019, Windows 10 22h2, Windows 10 1809, and Windows 11 23h2 allows a high-privileged local attacker to read sensitive information from kernel memory. The vulnerability requires administrative or equivalent privileges to exploit and carries no patch availability. This issue is tracked under CWE-908 with a CVSS score of 4.4.
Windows File Explorer information disclosure affects Windows 10 and 11 systems, allowing local authenticated attackers to access sensitive data through improper access controls. The vulnerability requires valid user credentials and local system access, posing a risk in multi-user or shared computing environments where sensitive files may be exposed to other authorized users.
Windows File Explorer improperly restricts access to sensitive information, enabling authenticated local users to read confidential data without authorization. This vulnerability affects Windows 10 across multiple versions (1607, 1809, 21H2, 22H2) and requires valid user credentials and local system access to exploit. Currently, no patch is available to remediate this information disclosure issue.
Information disclosure in Windows NDIS allows a privileged local attacker with physical access to read sensitive kernel memory regions on Windows 10 and Windows 11 systems. The vulnerability requires both authentication and direct hardware interaction, limiting its practical exploitation to scenarios where an attacker has already compromised system access. No patch is currently available for affected Windows versions including 10 (21h2, 22h2) and 11 (25h2).
Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.
Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.
Windows NTLM authentication across multiple Windows versions (10, Server 2008/2019) allows remote attackers to manipulate file name or path parameters without authentication, enabling network-based identity spoofing attacks. The vulnerability requires user interaction and has no available patch, affecting systems still running older Windows Server editions alongside current Windows 10 releases. An attacker could impersonate legitimate services or users to compromise trust in networked communications.
Windows NTLM authentication is vulnerable to path manipulation attacks that enable network-based spoofing when users interact with malicious content, affecting Windows 10 22H2 and Windows Server editions 2008-2016. An unauthenticated attacker can exploit improper file name or path validation to impersonate legitimate systems or services, potentially redirecting authentication requests to attacker-controlled resources. No patch is currently available for this vulnerability.
Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.
Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.
Information disclosure in Windows Client-Side Caching Service allows authenticated local users to read sensitive data on affected systems including Windows 10, Windows 11, and Windows Server editions. An attacker with valid credentials can exploit improper access controls to access cached information without additional user interaction. No patch is currently available for this vulnerability.
Sensitive information disclosure in the Windows Kernel error message handling allows local authenticated users to read confidential data they shouldn't have access to. The vulnerability affects Windows and Windows Server 2022/2025 platforms and requires valid credentials to exploit, limiting its attack surface. No patch is currently available for this medium-severity issue.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Windows Server 2008 versions up to - is affected by use of a broken or risky cryptographic algorithm (CVSS 5.5).
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Windows Kernel inadvertently logs sensitive information to accessible log files, enabling local attackers to read confidential data on affected Windows and Linux systems. This information disclosure vulnerability requires no privileges or user interaction to exploit and impacts Windows Server 2016, 2022, and 2025 along with standard Windows installations. No patch is currently available for this medium-severity issue.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Windows Kernel information disclosure across a broad range of Microsoft Windows 10, Windows 11, and Windows Server editions allows a locally authenticated low-privileged attacker to read sensitive kernel memory contents they are not authorized to access. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is confined to local exploitation with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing the issue across all affected version branches per EUVD-2026-43865.
Windows Cryptographic Services improperly validates certificates across multiple Windows 10, 11, and Server editions, enabling remote unauthenticated attackers to bypass security features enforced by the PKI/certificate trust chain over a network path. Affected platforms span Windows 10 21H2 and 22H2, Windows 11 24H2 through 26H1, and Windows Server 2022 and 2025 in both full and Server Core deployments. No public exploit identified at time of analysis; EPSS at 0.24% (15th percentile) and SSVC exploitation status of 'none' together indicate low near-term exploitation probability despite the broad product footprint.
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Integer underflow in the Windows Kernel enables a locally authenticated attacker to disclose sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server platforms. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privilege local user can trigger the flaw without special configuration or user interaction, yielding high confidentiality impact with no integrity or availability consequences. Microsoft has released a patch via the July 2026 Security Update Guide; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.
Sensitive information disclosure in the Windows Kernel affects Windows 10 (versions 21H2 and 22H2), Windows 11 (versions 24H2, 25H2, and 26H1), and Windows Server 2022 and 2025, where the kernel writes sensitive data into log files that a low-privileged local user can access. An authorized attacker with a standard local account can read these log files to obtain sensitive kernel-level information, yielding high confidentiality impact with no integrity or availability consequence. No public exploit has been identified at time of analysis, and the EPSS score of 0.36% at the 28th percentile corroborates low near-term exploitation likelihood; Microsoft has released patches addressing all affected versions.
Privilege escalation to SYSTEM level is achievable in Windows Spaceport.sys - the kernel-mode Storage Spaces port driver - across a wide range of Windows 10, Windows 11, and Windows Server releases, when an attacker has physical access to the target machine. An integer overflow or wraparound in the driver's arithmetic logic (CWE-190) can corrupt kernel memory structures, enabling full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and SSVC confirms exploitation status as none, but the Technical Impact rating is total, meaning successful exploitation fully compromises the affected system.
Local information disclosure in Windows DirectX exposes sensitive data to unauthorized local actors across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-200) achieves high confidentiality impact per the CVSS vector while producing no integrity or availability impact, meaning an attacker gains read access to protected data without disrupting system operation. No public exploit has been identified at time of analysis; EPSS at 0.38% (30th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability despite the wide affected surface.
Uninitialized memory disclosure in the Windows SMB implementation enables a locally authenticated, low-privileged attacker to read sensitive contents from uninitialized kernel or heap buffers, achieving high confidentiality impact within the affected system. The vulnerability spans Windows 10 (from version 1607 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2012 through 2025 across both full and Server Core installation types. No public exploit code has been identified and CISA SSVC assesses exploitation status as none, placing this firmly in the patch-and-monitor category rather than emergency response.
Windows Kernel information disclosure across a broad range of Microsoft Windows desktop and server editions allows a local, unprivileged attacker to read sensitive kernel memory or system state not intended for user-space access. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N confirms local code execution with no special privileges is sufficient to trigger the flaw. EPSS sits at 0.38% (30th percentile) with no CISA KEV listing and SSVC exploitation status of 'none,' indicating no confirmed or publicly observed active exploitation at time of analysis; however, kernel information leaks of this class are routinely used to stage ASLR-bypass steps in multi-stage privilege escalation chains.
Privilege escalation to SYSTEM level is achievable in the Windows USB Video Class (UVC) driver across a broad swath of Windows 10, 11, and Server editions via physical connection of a malicious USB device. The heap-based buffer overflow (CWE-122) is triggered when the driver processes attacker-controlled UVC descriptors from a crafted device, corrupting kernel heap memory. No active exploitation is confirmed (absent from CISA KEV, SSVC exploitation=none), and EPSS sits at 0.37% (29th percentile), consistent with the physical access barrier that makes mass exploitation impractical.
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Windows Event Logging Service across a wide range of Windows 10, Windows 11, and Windows Server versions fails to enforce its intended protection mechanisms, permitting any authenticated low-privileged network user to read information that should be access-controlled. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only a valid low-privilege account and network connectivity, with no user interaction and no elevated rights - making it a practical post-compromise lateral-movement or reconnaissance tool. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, but the ubiquitous deployment footprint across the Windows ecosystem elevates organizational exposure.
Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Windows Audio Service on multiple Windows desktop and server versions improperly exposes sensitive information to locally authenticated standard users, enabling information disclosure without requiring elevated privileges. Affecting Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 (with Server 2022 and 2025 referenced in tags), the flaw is exploitable post-foothold by any low-privileged local account, making it a realistic post-exploitation pivot rather than an initial access vector. No public exploit code has been identified at time of analysis, and a vendor-released patch is confirmed available via the Microsoft Security Response Center.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Windows Remote Desktop Protocol (RDP) client leaks sensitive memory contents due to use of an uninitialized resource (CWE-908), allowing a network-accessible attacker to disclose potentially high-value information from a victim's system. Exploitation requires user interaction - a victim must connect to an attacker-controlled RDP endpoint - making this a client-side information disclosure attack affecting Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2012 through 2025. No public exploit code has been identified and no active exploitation is confirmed; however, the CVSS confidentiality impact is rated High, meaning exposed memory could include credentials or session tokens.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Missing authentication enforcement in the Microsoft Windows DNS component allows a low-privileged local attacker to tamper with DNS configuration or records without requiring elevated credentials. Affected platforms span Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025 - a broad deployment footprint across enterprise environments. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' with partial technical impact, but the high integrity impact (CVSS I:H) warrants attention in multi-user environments and on DNS server infrastructure where record integrity is critical.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Windows Media on multiple Windows client and server editions exposes sensitive information to authenticated local users, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad footprint of Microsoft's supported OS ecosystem. No active exploitation has been identified at time of analysis - the vulnerability is absent from CISA KEV, EPSS sits at 0.36% (28th percentile), and SSVC assesses exploitation status as none - making this a patch-and-monitor priority rather than an emergency response.
BitLocker's protection mechanism on Windows fails to enforce a critical authentication or verification step, permitting a physically present attacker to bypass full-disk encryption without credentials, a recovery key, or elevated privileges. Despite a CVSS score of 6.8 (Medium) - moderated by the physical access requirement - the impact ratings are High across confidentiality, integrity, and availability, meaning successful exploitation grants complete access to encrypted data and the underlying system. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Security feature bypass in Microsoft Windows BitLocker allows an attacker with physical access to circumvent the drive encryption protection mechanism. Affected systems can have BitLocker-protected data accessed despite the encryption-at-rest control being enabled, undermining a core platform confidentiality boundary. There is no public exploit identified at time of analysis, but the vulnerability is reported by Microsoft (secure@microsoft.com) as a protection mechanism failure with high impact across confidentiality, integrity, and availability.
BitLocker drive encryption on Windows can be bypassed by a physically present, unauthenticated attacker, exposing protected volume contents with high confidentiality impact. Classified as CWE-693 (Protection Mechanism Failure), the flaw undermines BitLocker's core threat model - data-at-rest protection - across a wide range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions; however, the physical access requirement means organizations with mobile or physically accessible systems should treat this as a higher operational priority than the CVSS score alone implies.
Spoofing via improper input validation affects Microsoft Azure Attestation service and the Device Health Attestation Service component across a broad range of Windows OS versions, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. An authorized attacker with high privileges and physical access to the target device can manipulate attestation inputs to spoof device health or platform integrity status, achieving a high-integrity impact with no confidentiality or availability consequence. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the CVSS score of 3.9 (Low) reflects the significant physical and privilege barriers to exploitation.
Out-of-bounds read in the Windows DHCP Server service enables a locally authenticated, low-privileged attacker to disclose contents of process memory on affected systems. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges - no elevated rights or user interaction needed. Exploitation is constrained to hosts where the Windows DHCP Server role is actively installed and running, which significantly limits the attack surface to designated infrastructure servers rather than general workstations. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Out-of-bounds read in Windows DHCP Server exposes adjacent memory contents and can crash the service, yielding both information disclosure and a high-severity denial-of-service condition on affected Windows systems. The flaw (CWE-125) is exploitable locally with low attack complexity and no user interaction, targeting systems where the DHCP Server role is installed across a broad range of Windows 10, 11, and Server editions from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via the MSRC update guide (CVE-2026-45608).
Out-of-bounds read in Microsoft's UxTheme Library (uxtheme.dll) enables a locally authenticated attacker to crash the affected Windows system, resulting in denial of service. The vulnerability spans a broad swath of Windows releases - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management critical for enterprise environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Mark of the Web (MOTW) protection mechanism failure across a broad range of Windows client and server releases allows unauthenticated network-based attackers to deliver files that evade the Zone.Identifier security tag, bypassing downstream defenses such as SmartScreen and Office Protected View that depend on MOTW presence. User interaction is required to trigger the bypass, limiting automated mass exploitation. No public exploit code exists and CISA has not listed this in KEV; however, the breadth of affected Windows versions - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - gives this vulnerability significant surface area as a link in social-engineering attack chains.
Information disclosure in the Windows Application Identity (AppID) Subsystem exposes sensitive data to locally authenticated, low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires only a local session with standard user privileges - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide affected surface spanning consumer and server SKUs makes patching a meaningful priority in multi-user or shared-system environments.
Use-after-free in the Windows Network Controller (NC) Host Agent enables a locally authenticated attacker to crash the service, resulting in a denial of service on affected Windows Server deployments. The vulnerability carries a CVSS score of 5.5 (Medium) with local attack vector and low-privilege requirements, limiting its blast radius to service availability - confidentiality and integrity are unaffected. No public exploit code exists and CISA KEV listing is absent at time of analysis, though a vendor patch from Microsoft is available and should be prioritized on Windows Server deployments leveraging Software Defined Networking.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated attacker to read sensitive information from memory without elevation of privilege. Affecting a wide range of Windows 10, Windows 11, and Windows Server builds, the vulnerability requires only low-privilege local access and no user interaction to trigger. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact, placing this in a lower-urgency remediation band despite the High confidentiality rating in the CVSS vector.
Local information disclosure in Windows Hyper-V enables an authenticated low-privileged attacker to access sensitive data they are not authorized to read, without any user interaction. Affected systems span a broad range of Windows desktop and server editions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis and no CISA KEV listing; however, the high confidentiality impact (C:H) and breadth of affected versions make this a meaningful patching priority, particularly in multi-tenant virtualization environments.
Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory contents through an uninitialized resource condition, allowing a low-privileged local user to read high-confidentiality data without any user interaction. The CVSS vector (AV:L/PR:L) confirms this is strictly a local privilege issue - no remote attack path exists - limiting its practical blast radius to insider threats and post-compromise lateral reconnaissance. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local attackers to disclose sensitive information across a wide breadth of Microsoft Windows desktop and server platforms. Spanning Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, the vulnerability carries a CVSS 5.5 Medium score with high confidentiality impact (C:H) but no integrity or availability impact. Microsoft has released patches via the June 2026 Patch Tuesday cycle; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Windows Push Notifications on a broad range of Windows 10, Windows 11, and Windows Server editions leaks sensitive memory contents to locally authenticated low-privileged users through an uninitialized resource condition (CWE-908). The CVSS vector confirms local attack vector with low-privilege authentication requirement, no user interaction needed, and high confidentiality impact - meaning an attacker who has already obtained a standard user account can read residual memory data that could include tokens, credentials, or other sensitive artifacts. No public exploit code exists and no active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Out-of-bounds read in the Windows Telephony Service exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. The flaw (CWE-125) is exploitable with only low privileges and no user interaction, yielding high confidentiality impact while leaving integrity and availability unaffected. No public exploit code or active exploitation has been identified; CISA's SSVC framework rates this as non-automatable with partial technical impact, placing it at medium operational priority.
Denial-of-service in the Windows TCP/IP stack allows an authenticated attacker on an adjacent network to crash the networking subsystem of affected Windows hosts via an incorrect buffer size calculation. Affected systems span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 - all unpatched builds within Microsoft-documented version ranges. No public exploit identified at time of analysis, though Microsoft has released fixes addressable via Windows Update; the vulnerability is not listed in the CISA KEV catalog.
Windows Kerberos out-of-bounds read (CWE-125) allows a low-privilege network attacker to crash the Kerberos authentication service across all actively supported Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. The attack requires prior domain authentication and high-complexity triggering conditions (CVSS AC:H), limiting opportunistic mass exploitation, though a successful attack against a domain controller can deny authentication domain-wide by crashing the KDC. Vendor patches are available via the Microsoft MSRC advisory; no public exploit code exists and SSVC confirms no observed exploitation at time of analysis.
Information disclosure in Windows Shell exposes sensitive data to authenticated low-privileged attackers, with a confirmed vendor patch available. The vulnerability stems from CWE-200 improper information exposure within the Windows Shell component, allowing confidentiality compromise with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact score (C:H) and low attack complexity elevate practical concern for environments where lateral movement or credential harvesting are threat vectors.
Windows Shell exposes sensitive information to locally authenticated, low-privileged attackers without requiring user interaction or elevated privileges. The vulnerability (CWE-200) results in high confidentiality impact, allowing disclosure of sensitive data accessible through the Shell component. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the Microsoft Security Response Center (MSRC) has acknowledged the issue via advisory.
Null pointer dereference in Windows Kerberos enables an authenticated network attacker to crash the Kerberos service, causing denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is achievable over the network by any low-privilege authenticated user with no user interaction required, resulting in high availability impact (A:H) with no confidentiality or integrity consequences. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.
Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.
Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.
Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim
Unauthorized disclosure of sensitive information in Windows Accessibility Infrastructure (ATBroker.exe) affects Windows Server 2019, 2025, Windows 10 22h2, and Windows 11 25h2, allowing local authenticated attackers to read confidential data. The vulnerability requires user privileges and local access but poses no risk to system integrity or availability. No patch is currently available for this issue.
Windows Shell Link Processing leaks sensitive information over the network in Windows Server 2012, 2019, and 2022, enabling remote spoofing attacks without authentication or user interaction. An unauthenticated attacker can exploit this information disclosure to conduct spoofing attacks against affected systems. No patch is currently available.
A division by zero flaw in the Microsoft Graphics Component on Windows 10 and Windows 11 systems enables local attackers to trigger a denial of service condition without requiring special privileges or user interaction. The vulnerability affects multiple Windows versions including Windows 10 1607, 22h2 and Windows 11 25h2, 26h1, with no patch currently available.
Microsoft Graphics Component on Windows 10 21H2, Windows Server 2016, and Windows 11 25H2 is vulnerable to a null pointer dereference that enables local denial of service attacks. An attacker with local access can trigger the vulnerability without requiring elevated privileges or user interaction to crash the graphics component and render the system unavailable. No patch is currently available for this medium-severity vulnerability.
Windows Kernel inadvertently logs sensitive information accessible to authenticated local users, enabling information disclosure attacks. This medium-severity vulnerability affects Windows 10 22H2, Windows 11 23H2, and 24H2, as well as Linux systems, allowing authorized attackers with local access to retrieve confidential data. No patch is currently available for this issue.
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. [CVSS 6.4 MEDIUM]
Uninitialized memory in the Dynamic Root of Trust for Measurement (DRTM) component of Windows 11 25h2, Windows Server 2019, Windows 10 22h2, Windows 10 1809, and Windows 11 23h2 allows a high-privileged local attacker to read sensitive information from kernel memory. The vulnerability requires administrative or equivalent privileges to exploit and carries no patch availability. This issue is tracked under CWE-908 with a CVSS score of 4.4.
Windows File Explorer information disclosure affects Windows 10 and 11 systems, allowing local authenticated attackers to access sensitive data through improper access controls. The vulnerability requires valid user credentials and local system access, posing a risk in multi-user or shared computing environments where sensitive files may be exposed to other authorized users.
Windows File Explorer improperly restricts access to sensitive information, enabling authenticated local users to read confidential data without authorization. This vulnerability affects Windows 10 across multiple versions (1607, 1809, 21H2, 22H2) and requires valid user credentials and local system access to exploit. Currently, no patch is available to remediate this information disclosure issue.
Information disclosure in Windows NDIS allows a privileged local attacker with physical access to read sensitive kernel memory regions on Windows 10 and Windows 11 systems. The vulnerability requires both authentication and direct hardware interaction, limiting its practical exploitation to scenarios where an attacker has already compromised system access. No patch is currently available for affected Windows versions including 10 (21h2, 22h2) and 11 (25h2).
Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.
Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.
Windows NTLM authentication across multiple Windows versions (10, Server 2008/2019) allows remote attackers to manipulate file name or path parameters without authentication, enabling network-based identity spoofing attacks. The vulnerability requires user interaction and has no available patch, affecting systems still running older Windows Server editions alongside current Windows 10 releases. An attacker could impersonate legitimate services or users to compromise trust in networked communications.
Windows NTLM authentication is vulnerable to path manipulation attacks that enable network-based spoofing when users interact with malicious content, affecting Windows 10 22H2 and Windows Server editions 2008-2016. An unauthenticated attacker can exploit improper file name or path validation to impersonate legitimate systems or services, potentially redirecting authentication requests to attacker-controlled resources. No patch is currently available for this vulnerability.
Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.
Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.
Information disclosure in Windows Client-Side Caching Service allows authenticated local users to read sensitive data on affected systems including Windows 10, Windows 11, and Windows Server editions. An attacker with valid credentials can exploit improper access controls to access cached information without additional user interaction. No patch is currently available for this vulnerability.
Sensitive information disclosure in the Windows Kernel error message handling allows local authenticated users to read confidential data they shouldn't have access to. The vulnerability affects Windows and Windows Server 2022/2025 platforms and requires valid credentials to exploit, limiting its attack surface. No patch is currently available for this medium-severity issue.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Windows Server 2008 versions up to - is affected by use of a broken or risky cryptographic algorithm (CVSS 5.5).
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Windows Kernel inadvertently logs sensitive information to accessible log files, enabling local attackers to read confidential data on affected Windows and Linux systems. This information disclosure vulnerability requires no privileges or user interaction to exploit and impacts Windows Server 2016, 2022, and 2025 along with standard Windows installations. No patch is currently available for this medium-severity issue.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.