Windows Server 2022
Monthly
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged attacker who already holds an interactive or authenticated session on a Windows host to trigger an out-of-bounds read in the compositor and elevate to a higher-integrity context. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): no user interaction or remote reach is required, but the local authenticated session is a hard prerequisite, which confines exposure to hosts where an attacker has already gained an initial foothold. Microsoft has released patch builds for all affected servicing branches and there is no public exploit code identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, making this a credible but not emergency-grade priority rather than an actively exploited Windows elevation-of-privilege bug.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated local user who already has low-privileged code execution on a Windows host to elevate their privileges (CVSS 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-125 out-of-bounds read). Affected are unpatched Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H2) and Windows Server 2019/2022/2025 installations, including Server Core builds, since the DWM Core Library is present and active by default on every supported installation. Exploitation status: no public exploit identified at time of analysis, CISA SSVC rates Exploitation as none and Automatable as no, and the attack is per-host, requires prior local code execution, and is not remote or network-facing; a vendor patch is available and hosts updated to the fixed builds are not affected.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged user who already has code execution on the host to trigger an out-of-bounds read in the compositor and, per the assessed CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H), achieve high confidentiality, integrity and availability impact in DWM's more privileged context. Every default installation of the affected Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025 builds - including Server Core - carries the vulnerable component, but the flaw is not remotely reachable and requires an existing local foothold as an authenticated user. No public exploit code has been identified at time of analysis and CISA's SSVC records no observed exploitation, making this a post-compromise escalation step rather than an initial-access vector; Microsoft has shipped patched builds and a fix is available via the MSRC update guide.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
Local privilege escalation in the Windows Bind Filter Driver (BindFlt), a kernel-mode component shipped by default across supported Windows client and server editions, lets an already-authenticated low-privileged attacker trigger a heap-based buffer overflow and gain elevated (SYSTEM) code execution on the host. Exploitation requires a pre-existing local foothold - the CVSS vector is AV:L/PR:L/UI:N - so this is a post-compromise escalation primitive rather than a remotely reachable entry point, and it carries a high technical impact (total loss of confidentiality, integrity and availability on the affected machine). No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', so this is a credible but not emergency-tier patching priority; Microsoft has released fixed builds for every affected edition and organizations should fold them into normal cumulative-update cycles, prioritizing multi-user and high-value hosts.
An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.
Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) affects a default-enabled component present on Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), an attacker who already holds a low-privilege account or foothold can send crafted requests to BITS over the network without user interaction and achieve high confidentiality, integrity, and availability impact within the service's own privilege context (scope unchanged); note that the vendor description's 'unauthorized attacker' phrasing conflicts with the PR:L rating and should be reconciled against the MSRC advisory. There is no confirmed active exploitation and no public exploit identified at time of analysis (CISA SSVC exploitation: none, automatable: no), but technical impact is rated total and a vendor patch is available, making this a high-priority patch target.
Heap-based buffer overflow in OpenSSH for Windows can let an unauthenticated network attacker execute code, but the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the independent assessment indicate the victim must initiate the vulnerable SSH operation, likely by using an affected Windows OpenSSH client against an attacker-controlled or compromised SSH server. Affected builds span Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 as enumerated in EUVD-2026-99587; Microsoft has released patched builds through the MSRC update guide. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none and Automatable as no, so risk is gated by user interaction and the need for the victim to connect to attacker-influenced infrastructure.
A use-after-free in the Windows Background Intelligent Transfer Service (BITS) lets an attacker who already holds low-privilege local code execution on a Windows host elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The service ships by default on every supported Windows client and server edition, but the flaw is a post-compromise escalation primitive rather than an initial-access vector - there is no remote or network-reachable path and no victim interaction is required, so exploitation is limited to hosts where an attacker or malware is already running as a standard user on a pre-patch build. Microsoft has released fixes; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), making this a genuine patch-priority item rather than an emergency. Patched builds are enumerated per Windows version (for example Windows 11 24H2 fixed in 10.0.26100.9711, Windows Server 2022 in 10.0.20348.5761), so only unpatched systems remain exposed.
Local privilege escalation in Microsoft Windows through the Ancillary Function Driver for WinSock (afd.sys) lets an attacker who already holds low-privileged local code execution corrupt kernel pool memory and raise privileges to SYSTEM, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by valid local credentials (PR:L, authenticated) and is further constrained by high attack complexity (AC:H), because the CWE-415 double free depends on winning a non-deterministic kernel memory race that may require repeated attempts; there is no network vector and no victim interaction (UI:N). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the exposure is broad - Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - with vendor patches available.
Local privilege escalation in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authenticated, low-privileged user on an affected host to trigger a heap-based buffer overflow and obtain high-integrity code execution in the context of the vulnerable service (CVSS 7.8, CWE-122). Exploitation requires a pre-existing local foothold with valid low-privileged credentials (AV:L/PR:L) and no user interaction (UI:N), so the flaw functions as a privilege-escalation link in a post-compromise chain rather than a remote entry point; there is no CISA KEV listing and no public exploit code identified at time of analysis. Microsoft has shipped a vendor patch, and ENISA EUVD tracks the issue as EUVD-2026-100095, making this a moderate-but-real priority concentrated on multi-user, RDP/terminal, and Windows Server hosts where untrusted local principals exist.
Local privilege escalation in Windows BITS allows an authenticated attacker with low-level privileges to exploit a race condition and elevate to higher integrity on affected Windows 10, 11, and Server systems. Exploitation requires a pre-existing local foothold and winning a narrow timing window, making success probabilistic; no public exploit has been identified. Microsoft has released patches for all supported versions.
Local privilege escalation in Windows Storage Spaces allows an authenticated standard user to trigger a heap-based buffer overflow in the Storage Spaces Controller and gain elevated code execution on affected Windows 10, Windows 11, and Windows Server hosts. The flaw is not remotely reachable and requires prior local access (CVSS AV:L/PR:L), so it is most relevant as a post-compromise escalation step; EPSS is 0.26% and no public exploit has been identified at time of analysis. Microsoft has released updates for the affected Windows builds.
Memory corruption in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged attacker to execute arbitrary code over the network, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. Because BITS is a default-enabled core component of every supported Windows client and server edition listed in the EUVD data, no feature toggle has to be turned on for exposure - but the CVSS vector's PR:L metric means the attacker must already hold a low-privileged foothold, and CISA's SSVC assessment marks the flaw as not automatable, so no wormable mass-exploitation path is indicated. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available, making this a high-priority but not emergency-outbreak patching target.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already has low-privileged code execution on the host win a use-after-free race condition to obtain SYSTEM-level rights, yielding full compromise of confidentiality, integrity, and availability (CVSS 7.0, CWE-416). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds in the ranges listed by Microsoft are affected; the flaw is not remotely reachable, requires local authenticated access, and carries high attack complexity, so exploitation is likely unreliable and may need repeated attempts. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, not in KEV), and vendor patches are available, making this a credible but not top-tier priority for most environments.
Local privilege escalation in the Microsoft Windows Kernel lets an attacker who already holds authenticated, low-privileged local code execution on a target host elevate to SYSTEM-level rights by triggering a use-after-free memory corruption condition. The flaw affects a broad range of unpatched Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - and Microsoft has published a fixing update via its MSRC advisory. No public exploit code or active exploitation has been identified at time of analysis: CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so this is a genuine but moderate-priority, patch-now issue rather than a top-tier emergency.
Local privilege escalation in the Windows Portable Device Enumerator Service (WPDBusEnum) allows an authenticated, low-privileged user on an affected Windows host to redirect a privileged file-system operation and elevate to a higher-integrity context, with high confidentiality, integrity and availability impact (CVSS 7.8, CWE-59 link following). Exploitation is strictly local (AV:L, PR:L, UI:N) and hinges on planting a symbolic link or junction so that a privileged file operation follows it - typically requiring a race to be won, which is why CISA's SSVC rates the issue non-automatable with exploitation observed as none. Microsoft has published a remediating update, and no public exploit identified at time of analysis; no confirmed actively exploited (CISA KEV) status is associated with this issue.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker with low-privileged local access to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction (UI:N), and is not remotely reachable or automatable at scale per CISA SSVC (Automatable: no). Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none).
Local privilege escalation in the Windows SMB Server allows an authenticated, low-privileged user with local logon rights to trigger a use-after-free in the SMB server component and obtain code execution at a higher integrity level, with high impact across confidentiality, integrity and availability. The flaw spans a wide range of Windows client and server branches - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - and is constrained by the local vector (AV:L, PR:L) plus a non-default timing/memory precondition (AC:H), meaning the freed object must be won through a race or specific reuse state rather than reliably on a first attempt. Vendor patches are available for every affected branch and no public exploit code had been identified at time of analysis; this is a moderate-priority local escalation rather than a top-tier emergency, since it presupposes an existing foothold and an unreliable exploitation window.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free inside the installer service and gain elevated (SYSTEM-level) code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0): the attacker must win a non-deterministic race/heap-grooming window to reclaim the freed object, so the technique is not consistently reliable, and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation: none and Automatable: no. Vendor patches are available for the full affected build matrix spanning Windows 10 and Windows 11 (through 26H2) as well as Windows Server 2012 through Windows Server 2025, so this is a genuine but second-tier priority relative to remotely exploitable or actively exploited issues.
Code execution in the Windows Background Intelligent Transfer Service (BITS) lets a network-positioned attacker with low privileges trigger a use-after-free and run arbitrary code on unpatched Windows 10, Windows 11 and Windows Server systems. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact to confidentiality, integrity and availability is high but confined to the vulnerable host. No public exploit code and no active exploitation are confirmed at time of analysis (SSVC exploitation: none), and EPSS is modest at 0.49% (40th percentile), making this a serious but not emergency-grade issue that should be handled in the current patch cycle.
Remote code execution in the Windows DHCP Server role allows an unauthenticated attacker who can reach the service on UDP port 67 to corrupt memory via a use-after-free and potentially execute code with the privileges of the DHCP service. Affected builds span Windows Server 2012 through Windows Server 2025, including Server Core installations, below the fixed versions published by Microsoft; the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no authentication or user interaction is required, but the high attack complexity reflects a race-condition-style heap corruption that is not guaranteed to succeed on a single attempt. There is no public exploit identified at time of analysis and no confirmed active exploitation, so risk is driven primarily by the total technical impact (memory corruption with full confidentiality, integrity and availability loss) rather than by observed attacker activity.
Unauthenticated remote code execution in Microsoft's Windows DHCP Server affects Windows Server 2012 through Windows Server 2025 (including Server Core installations) that have the DHCP Server role installed and reachable over the network. A use-after-free (CWE-416) in the DHCP service lets a network attacker corrupt memory and potentially execute code, but the CVSS AC:H rating reflects a race/timing-dependent condition that makes reliable exploitation harder than a deterministic request. No public exploit code was identified at time of analysis, and vendor patches are available; the DHCP role is non-default and typically only present on infrastructure servers acting as DHCP providers.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker with low-level privileges to exploit a memory corruption flaw and gain higher privileges on affected Windows client and server systems. The vulnerable BITS component is default-enabled and reachable without non-default configuration, but exploitation requires a pre-existing local foothold and no user interaction, with no remote or network vector. Vendor patch is available; no public exploit identified at time of analysis, and the independent assessment rates this as a credible but not emergency-level priority.
Remote code execution in Windows DHCP Server is possible through a use-after-free that can be triggered by unauthenticated, network-adjacent attackers against Windows Server systems where the optional DHCP Server role is enabled and reachable. The assessed CVSS vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, and affected builds include Windows Server 2012 through Server 2025, including Server Core installations. Vendor patches are available, and available intelligence indicates no public exploit identified at time of analysis and no confirmed active exploitation, so this is a credible high-priority patching target rather than an emergency under active attack.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
An out-of-bounds read (CWE-125) in Microsoft's Windows Server 'Server for NFS' role can be triggered by a remote, unauthenticated attacker sending crafted network requests, and Microsoft rates it as potentially leading to remote code execution with full confidentiality and integrity impact. The flaw affects the optional NFS server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 as well as Windows 10 1607 and 1809 builds below the patched revisions, so hosts that have never installed the Server for NFS feature are not exposed. No public exploit code has been identified and CISA SSVC records exploitation as 'none' and automatable as 'no', which is consistent with the CVSS UI:R requirement for user interaction; the high base score (8.8) alongside those low exploitation signals is a conflict that defenders should weigh when prioritising, with patched builds available from Microsoft.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Privilege escalation on supported Windows 10, Windows 11, and Windows Server builds stems from a use-after-free in the Cloud Files Mini Filter Driver (cldflt.sys), the component that services OneDrive-style cloud placeholder files. An attacker who already holds local, authenticated access to the host (CVSS PR:L, AC:H) and can drive concurrent cloud-file operations may win a narrow race window (CWE-362) and corrupt driver memory, ultimately gaining SYSTEM-level code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is not confirmed actively exploited (CISA KEV) and no public exploit code was identified at time of analysis; the local foothold requirement, the timing-dependent nature of the race, and the need for repeated attempts keep realistic risk below the raw score. Vendor patches are available from Microsoft.
A use-after-free in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets a locally authenticated attacker on a vulnerable Windows host elevate privileges to SYSTEM by winning a narrow timing window in which a freed kernel object is reclaimed before deletion completes. Because exploitation requires the attacker to already hold low-privileged local access (PR:L), it is a post-compromise privilege-escalation primitive rather than a remote entry point, and the high attack complexity (AC:H) means success is neither trivial nor deterministic. Microsoft has released fixes for all affected Windows 10, Windows 11, Windows Server 2019/2022/2025 builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote code execution is possible against Windows Failover Cluster through a use-after-free in the cluster service, affecting Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations, whenever the Failover Clustering role is installed and running. Signals diverge sharply: Microsoft and NVD publish a 9.8 score with AV:N/AC:L/PR:N/UI:N, while the independent assessment re-scores attack complexity as High (AC:H) because the clustering role is not a default configuration, the service normally lives on segmented management/heartbeat networks rather than exposed public interfaces, and reliably converting a freed object into controlled execution requires precise timing. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" while rating the flaw fully automatable with total technical impact if the service is reachable; if that reachability exists, impact is complete loss of confidentiality, integrity, and availability.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.
Double free in the Windows Hyper-V hypervisor component allows an authenticated local attacker to corrupt memory in a privileged context and elevate to SYSTEM on affected Windows 11 (23H2, 24H2, 25H2, 26H2) and Windows Server 2022/2025 hosts, including Server Core installations, with the Hyper-V role present. Exploitation requires that the attacker already hold local code execution on the host (CVSS AV:L/PR:L, no user interaction), so this is a privilege-escalation primitive rather than a remote entry point, and hosts without the Hyper-V role are not exposed. No public exploit code or active exploitation has been identified at time of analysis - CISA SSVC reports exploitation none and automatable no - and vendor patches are available, making this a genuine but second-tier priority relative to remotely reachable or actively exploited Hyper-V flaws.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Local privilege escalation in Microsoft's Windows Installer service lets an attacker who already holds authenticated low-privilege local access free and then reuse a memory object, potentially seizing control of the SYSTEM-level installer process. Exploitation hinges on winning a non-deterministic race/timing window (AC:H, PR:L, AV:L), so CISA's SSVC rates exploitation as 'none' and automatable as 'no'; no public exploit identified at time of analysis and the flaw is not in CISA KEV, though the technical impact if successfully triggered is total (full confidentiality, integrity and availability loss). Microsoft has released vendor patches covering all affected Windows 10, Windows 11 and Windows Server builds.
Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.
Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, letting an unauthenticated attacker on an adjacent network bypass a Hyper-V security feature. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates high confidentiality impact that crosses a security scope boundary, but with no integrity or availability impact; the practical prerequisite is that the attacker already occupies a position on the adjacent layer-2 / virtual-switch segment, such as a co-resident guest VM or a host on the same segment, rather than reaching the target from the internet. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no' (the adjacency requirement prevents trivial mass exploitation), and vendor patches are available. This is a moderate-priority hardening issue rather than an emergency, but it is worth treating seriously in multi-tenant or high-density virtualization environments where untrusted guests may share a virtual switch with sensitive workloads.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already possesses low-privilege code execution on a Windows host to corrupt memory via a use-after-free and elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is not remotely reachable and needs pre-existing local access; the high attack complexity reflects a race/heap-reuse condition that makes exploitation timing-dependent, and no public exploit identified at time of analysis. Microsoft has released a vendor patch.
Local privilege escalation in Microsoft's Windows Resource Management (MRM) component lets an authenticated attacker who already holds low-level privileges on a host trigger an integer overflow (CWE-190) and elevate to higher integrity, with full impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote - it requires an existing local foothold - but needs no user interaction and has low attack complexity, so once any code execution or interactive access is obtained on an unpatched build, escalation is straightforward. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds below the vendor's fixed revision levels are affected; there is no public exploit code identified and no confirmed active exploitation (no CISA KEV listing) at time of analysis, although vendor patches are available.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated, low-privileged code execution on a host to trigger a use-after-free in the installer service and execute code in a higher-privileged context. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-416), the flaw requires an existing foothold and is therefore a second-stage escalation primitive rather than a remotely reachable or pre-authentication vector, with no user interaction needed once that local access exists. No public exploit code has been identified at time of analysis, and no confirmed active exploitation has been reported; Microsoft has released fixes covering all supported Windows client and server branches, including fixed builds such as 10.0.26100.9711 for Windows 11 24H2 and 10.0.26100.33650 for Windows Server 2025.
Local privilege escalation in Windows Winlogon (CVE-2026-87699) allows an attacker who already holds an authenticated low-privileged session on a target machine to trigger a heap-based buffer overflow in the Winlogon process and elevate to full SYSTEM-level privileges, yielding high confidentiality, integrity, and availability impact on that host. The flaw affects a broad set of Windows 10, Windows 11, and Windows Server 2012 through Server 2025 builds below the fixed revisions published by Microsoft (for example Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, and Windows Server 2016 below 10.0.14393.9612), and the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores it 7.8. There is no public exploit identified at time of analysis, and CISA's SSVC records exploitation as 'none', but the fully local, no-user-interaction attack path makes this an effective post-compromise escalation step for an attacker already present on a host.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to elevate to higher integrity - ultimately SYSTEM-level privileges - by triggering a use-after-free (CWE-416) in the packaging/installation code path, achieving full loss of confidentiality, integrity, and availability for the affected host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a broad set of supported Windows client and server platforms, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, all default installations of the core OS component. Because the vector requires AV:L and PR:L, this is a post-compromise escalation step rather than an initial-access vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; Microsoft has published vendor fixes as part of its monthly security update.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authorized low-privilege user elevate to SYSTEM by triggering a use-after-free memory-corruption condition in the installer service. Exploitation is confined to unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 hosts, and requires a valid local account plus high attack complexity because the primitive depends on precise object-lifetime/timing conditions (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, 7.0); no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Microsoft has released patched builds for every affected branch, so exposure is limited to systems that have not yet applied the current cumulative updates.
Use-after-free in the Windows Kernel allows an authenticated, low-privileged local attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to escalate privileges to SYSTEM-level, delivering high confidentiality, integrity and availability impact as a post-compromise LPE primitive. Affected systems are unpatched builds of Windows 10, Windows 11 and Windows Server 2012 through 2025 that fall below the fixed revisions in the vendor advisory. A vendor patch is available per the Microsoft MSRC update guide; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Installer (CVSS 7.0) lets an attacker who already holds low-privilege, local access on a Windows host escalate to SYSTEM by winning a race condition in the service's handling of a shared resource during concurrent execution. The flaw is CWE-362 and carries AC:H in the assessed vector, so the timing window is narrow and exploitation may require repeated attempts; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has published fixed builds for the affected Windows 10, Windows 11 and Windows Server releases via the MSRC update guide for CVE-2026-85941, making prompt patching the definitive mitigation.
Heap corruption in the Microsoft Windows Shell allows an unauthenticated remote attacker to execute arbitrary code in the context of a user who opens or interacts with attacker-supplied Shell content, such as a crafted file, link, or shell item. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is gated by mandatory user interaction and CISA's SSVC assessment records exploitation as 'none' and the attack as not automatable, so it is best suited to targeted social-engineering delivery rather than unattended mass exploitation; no public exploit identified at time of analysis. The affected build range is broad, covering Windows 10, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) on supported Windows 10, Windows 11 and Windows Server builds allows a low-privileged, locally logged-on user (PR:L, AV:L, UI:N) to win a use-after-free race inside the service and execute code in a higher-privileged service context. The issue is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with high attack complexity reflecting the difficulty of reliably triggering and winning the memory-reuse race, and CISA's SSVC assessment records no exploitation, no automatable path and no public exploit identified at time of analysis. Because AppXSvc is default-enabled and the vector is strictly local, residual risk is concentrated on unpatched multi-user, shared or kiosk Windows hosts where any interactive account could repeatedly attempt the race; vendor patches are available and materially reduce that risk.
Local privilege escalation in the Windows Print Spooler allows an attacker who already holds an authenticated, low-privileged foothold on a Windows host to elevate to SYSTEM-level code execution. The root cause is a use-after-free memory corruption flaw (CWE-416) that requires no user interaction and has low attack complexity, so it can be triggered reliably once local code execution is obtained; the local-only vector means it is a post-compromise escalation primitive rather than an initial-access path. Microsoft has released patched builds for all affected client and server versions, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.
Local privilege escalation in Microsoft's Windows Image Acquisition (WIA) service lets an attacker who already holds low-privileged authenticated access on a Windows host corrupt memory in the WIA component and run code with higher - ultimately SYSTEM-level - privileges. Exploitation is confined to the local machine (AV:L), requires a pre-existing foothold (PR:L), and hinges on winning a use-after-free timing window rated high complexity (AC:H), so it is not remotely reachable, cannot be reliably automated, and needs no victim interaction. Microsoft has released a vendor fix per its update guide and no public exploit code or active exploitation has been identified at time of analysis, making this a credible but not top-tier priority patch - the real-world risk comes from attackers who have already landed on a box and want to finish escalating.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver lets an unauthenticated remote attacker execute code in kernel context on affected default Windows installations, scoring CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released a vendor patch, and CISA's SSVC assessment rates the flaw as automatable with total technical impact, but no exploitation has been observed and no public exploit code exists - so the practical risk hinges on whether a reachable network path to the driver actually exists, since a storage/volume driver is not inherently internet-facing. Every supported Windows client and server branch from Windows 10 1607 through Windows 11 26H2, plus Server 2012 through Server 2025, is enumerated as affected below the fixed build numbers.
Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Clipboard User Service allows an attacker who already holds a low-privileged, authenticated session on a Windows host to win a race condition on an improperly synchronized shared resource and elevate their privileges on that machine. Only local access is viable (AV:L, PR:L) with no user interaction required, and the timing-dependent nature of the flaw (AC:H, SSVC Automatable=no) means exploitation is non-deterministic and typically requires many repeated attempts rather than a reliable one-shot trigger. There is confirmed publicly documented vendor patching but no public exploit identified at time of analysis, and the race-condition reliability plus the prerequisite foothold make practical risk more moderate than the 7.0 severity score alone suggests.
Local privilege escalation in the Windows StateRepository API lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a use-after-free (CWE-416) in the state store used by the AppX/UWP deployment stack, corrupting memory and gaining higher privileges up to the level of the affected component, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity, and availability for the vulnerable component. The issue spans a wide set of Windows 10, Windows 11, and Windows Server builds (per EUVD-2026-100050), and a vendor fix is available per the Microsoft advisory; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Because exploitation is gated on a pre-existing local foothold rather than on any non-default configuration, it should be treated as a post-compromise escalation step rather than a remote entry point, making it a credible but not emergency priority.
Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.
Local privilege escalation in the Windows Direct Composition (dcomp) compositor lets a low-privileged, already-authenticated local attacker drive a use-after-free (CWE-416) and gain high-integrity code execution (C:H/I:H) on affected Windows 10, Windows 11 and Windows Server builds. Exploitation is post-foothold only: the CVSS vector (AV:L, PR:L, UI:N) requires the attacker to already hold local code execution, so this is not a remotely reachable entry point and no user interaction is needed once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a patch-now local escalation rather than a drop-everything emergency; fully patched systems at or above the fixed builds are unaffected.
Local privilege escalation in the Windows UI Immersive Server component allows an attacker who already holds a low-privileged local account on a Windows host to corrupt heap memory via a crafted input and elevate to a higher-integrity context, including SYSTEM. Affected systems are all supported Windows client and server editions running builds below the fixed patch level, ranging from Windows 10 1607 and Windows Server 2012 up through Windows 11 26H2 and Windows Server 2025; patched builds are not exploitable, and there is no remote or unauthenticated path. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and non-automatable, and no EPSS score was supplied, so the practical risk is a serious but post-compromise local escalation flaw rather than an emergency-grade, mass-exploitable issue; a vendor patch is available.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged attacker who already holds an interactive or authenticated session on a Windows host to trigger an out-of-bounds read in the compositor and elevate to a higher-integrity context. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): no user interaction or remote reach is required, but the local authenticated session is a hard prerequisite, which confines exposure to hosts where an attacker has already gained an initial foothold. Microsoft has released patch builds for all affected servicing branches and there is no public exploit code identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, making this a credible but not emergency-grade priority rather than an actively exploited Windows elevation-of-privilege bug.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated local user who already has low-privileged code execution on a Windows host to elevate their privileges (CVSS 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-125 out-of-bounds read). Affected are unpatched Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H2) and Windows Server 2019/2022/2025 installations, including Server Core builds, since the DWM Core Library is present and active by default on every supported installation. Exploitation status: no public exploit identified at time of analysis, CISA SSVC rates Exploitation as none and Automatable as no, and the attack is per-host, requires prior local code execution, and is not remote or network-facing; a vendor patch is available and hosts updated to the fixed builds are not affected.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged user who already has code execution on the host to trigger an out-of-bounds read in the compositor and, per the assessed CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H), achieve high confidentiality, integrity and availability impact in DWM's more privileged context. Every default installation of the affected Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025 builds - including Server Core - carries the vulnerable component, but the flaw is not remotely reachable and requires an existing local foothold as an authenticated user. No public exploit code has been identified at time of analysis and CISA's SSVC records no observed exploitation, making this a post-compromise escalation step rather than an initial-access vector; Microsoft has shipped patched builds and a fix is available via the MSRC update guide.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
Local privilege escalation in the Windows Bind Filter Driver (BindFlt), a kernel-mode component shipped by default across supported Windows client and server editions, lets an already-authenticated low-privileged attacker trigger a heap-based buffer overflow and gain elevated (SYSTEM) code execution on the host. Exploitation requires a pre-existing local foothold - the CVSS vector is AV:L/PR:L/UI:N - so this is a post-compromise escalation primitive rather than a remotely reachable entry point, and it carries a high technical impact (total loss of confidentiality, integrity and availability on the affected machine). No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', so this is a credible but not emergency-tier patching priority; Microsoft has released fixed builds for every affected edition and organizations should fold them into normal cumulative-update cycles, prioritizing multi-user and high-value hosts.
An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.
Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) affects a default-enabled component present on Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), an attacker who already holds a low-privilege account or foothold can send crafted requests to BITS over the network without user interaction and achieve high confidentiality, integrity, and availability impact within the service's own privilege context (scope unchanged); note that the vendor description's 'unauthorized attacker' phrasing conflicts with the PR:L rating and should be reconciled against the MSRC advisory. There is no confirmed active exploitation and no public exploit identified at time of analysis (CISA SSVC exploitation: none, automatable: no), but technical impact is rated total and a vendor patch is available, making this a high-priority patch target.
Heap-based buffer overflow in OpenSSH for Windows can let an unauthenticated network attacker execute code, but the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the independent assessment indicate the victim must initiate the vulnerable SSH operation, likely by using an affected Windows OpenSSH client against an attacker-controlled or compromised SSH server. Affected builds span Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 as enumerated in EUVD-2026-99587; Microsoft has released patched builds through the MSRC update guide. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none and Automatable as no, so risk is gated by user interaction and the need for the victim to connect to attacker-influenced infrastructure.
A use-after-free in the Windows Background Intelligent Transfer Service (BITS) lets an attacker who already holds low-privilege local code execution on a Windows host elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The service ships by default on every supported Windows client and server edition, but the flaw is a post-compromise escalation primitive rather than an initial-access vector - there is no remote or network-reachable path and no victim interaction is required, so exploitation is limited to hosts where an attacker or malware is already running as a standard user on a pre-patch build. Microsoft has released fixes; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), making this a genuine patch-priority item rather than an emergency. Patched builds are enumerated per Windows version (for example Windows 11 24H2 fixed in 10.0.26100.9711, Windows Server 2022 in 10.0.20348.5761), so only unpatched systems remain exposed.
Local privilege escalation in Microsoft Windows through the Ancillary Function Driver for WinSock (afd.sys) lets an attacker who already holds low-privileged local code execution corrupt kernel pool memory and raise privileges to SYSTEM, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by valid local credentials (PR:L, authenticated) and is further constrained by high attack complexity (AC:H), because the CWE-415 double free depends on winning a non-deterministic kernel memory race that may require repeated attempts; there is no network vector and no victim interaction (UI:N). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the exposure is broad - Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - with vendor patches available.
Local privilege escalation in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authenticated, low-privileged user on an affected host to trigger a heap-based buffer overflow and obtain high-integrity code execution in the context of the vulnerable service (CVSS 7.8, CWE-122). Exploitation requires a pre-existing local foothold with valid low-privileged credentials (AV:L/PR:L) and no user interaction (UI:N), so the flaw functions as a privilege-escalation link in a post-compromise chain rather than a remote entry point; there is no CISA KEV listing and no public exploit code identified at time of analysis. Microsoft has shipped a vendor patch, and ENISA EUVD tracks the issue as EUVD-2026-100095, making this a moderate-but-real priority concentrated on multi-user, RDP/terminal, and Windows Server hosts where untrusted local principals exist.
Local privilege escalation in Windows BITS allows an authenticated attacker with low-level privileges to exploit a race condition and elevate to higher integrity on affected Windows 10, 11, and Server systems. Exploitation requires a pre-existing local foothold and winning a narrow timing window, making success probabilistic; no public exploit has been identified. Microsoft has released patches for all supported versions.
Local privilege escalation in Windows Storage Spaces allows an authenticated standard user to trigger a heap-based buffer overflow in the Storage Spaces Controller and gain elevated code execution on affected Windows 10, Windows 11, and Windows Server hosts. The flaw is not remotely reachable and requires prior local access (CVSS AV:L/PR:L), so it is most relevant as a post-compromise escalation step; EPSS is 0.26% and no public exploit has been identified at time of analysis. Microsoft has released updates for the affected Windows builds.
Memory corruption in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged attacker to execute arbitrary code over the network, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. Because BITS is a default-enabled core component of every supported Windows client and server edition listed in the EUVD data, no feature toggle has to be turned on for exposure - but the CVSS vector's PR:L metric means the attacker must already hold a low-privileged foothold, and CISA's SSVC assessment marks the flaw as not automatable, so no wormable mass-exploitation path is indicated. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available, making this a high-priority but not emergency-outbreak patching target.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already has low-privileged code execution on the host win a use-after-free race condition to obtain SYSTEM-level rights, yielding full compromise of confidentiality, integrity, and availability (CVSS 7.0, CWE-416). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds in the ranges listed by Microsoft are affected; the flaw is not remotely reachable, requires local authenticated access, and carries high attack complexity, so exploitation is likely unreliable and may need repeated attempts. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, not in KEV), and vendor patches are available, making this a credible but not top-tier priority for most environments.
Local privilege escalation in the Microsoft Windows Kernel lets an attacker who already holds authenticated, low-privileged local code execution on a target host elevate to SYSTEM-level rights by triggering a use-after-free memory corruption condition. The flaw affects a broad range of unpatched Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - and Microsoft has published a fixing update via its MSRC advisory. No public exploit code or active exploitation has been identified at time of analysis: CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so this is a genuine but moderate-priority, patch-now issue rather than a top-tier emergency.
Local privilege escalation in the Windows Portable Device Enumerator Service (WPDBusEnum) allows an authenticated, low-privileged user on an affected Windows host to redirect a privileged file-system operation and elevate to a higher-integrity context, with high confidentiality, integrity and availability impact (CVSS 7.8, CWE-59 link following). Exploitation is strictly local (AV:L, PR:L, UI:N) and hinges on planting a symbolic link or junction so that a privileged file operation follows it - typically requiring a race to be won, which is why CISA's SSVC rates the issue non-automatable with exploitation observed as none. Microsoft has published a remediating update, and no public exploit identified at time of analysis; no confirmed actively exploited (CISA KEV) status is associated with this issue.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker with low-privileged local access to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction (UI:N), and is not remotely reachable or automatable at scale per CISA SSVC (Automatable: no). Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none).
Local privilege escalation in the Windows SMB Server allows an authenticated, low-privileged user with local logon rights to trigger a use-after-free in the SMB server component and obtain code execution at a higher integrity level, with high impact across confidentiality, integrity and availability. The flaw spans a wide range of Windows client and server branches - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - and is constrained by the local vector (AV:L, PR:L) plus a non-default timing/memory precondition (AC:H), meaning the freed object must be won through a race or specific reuse state rather than reliably on a first attempt. Vendor patches are available for every affected branch and no public exploit code had been identified at time of analysis; this is a moderate-priority local escalation rather than a top-tier emergency, since it presupposes an existing foothold and an unreliable exploitation window.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free inside the installer service and gain elevated (SYSTEM-level) code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0): the attacker must win a non-deterministic race/heap-grooming window to reclaim the freed object, so the technique is not consistently reliable, and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation: none and Automatable: no. Vendor patches are available for the full affected build matrix spanning Windows 10 and Windows 11 (through 26H2) as well as Windows Server 2012 through Windows Server 2025, so this is a genuine but second-tier priority relative to remotely exploitable or actively exploited issues.
Code execution in the Windows Background Intelligent Transfer Service (BITS) lets a network-positioned attacker with low privileges trigger a use-after-free and run arbitrary code on unpatched Windows 10, Windows 11 and Windows Server systems. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact to confidentiality, integrity and availability is high but confined to the vulnerable host. No public exploit code and no active exploitation are confirmed at time of analysis (SSVC exploitation: none), and EPSS is modest at 0.49% (40th percentile), making this a serious but not emergency-grade issue that should be handled in the current patch cycle.
Remote code execution in the Windows DHCP Server role allows an unauthenticated attacker who can reach the service on UDP port 67 to corrupt memory via a use-after-free and potentially execute code with the privileges of the DHCP service. Affected builds span Windows Server 2012 through Windows Server 2025, including Server Core installations, below the fixed versions published by Microsoft; the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no authentication or user interaction is required, but the high attack complexity reflects a race-condition-style heap corruption that is not guaranteed to succeed on a single attempt. There is no public exploit identified at time of analysis and no confirmed active exploitation, so risk is driven primarily by the total technical impact (memory corruption with full confidentiality, integrity and availability loss) rather than by observed attacker activity.
Unauthenticated remote code execution in Microsoft's Windows DHCP Server affects Windows Server 2012 through Windows Server 2025 (including Server Core installations) that have the DHCP Server role installed and reachable over the network. A use-after-free (CWE-416) in the DHCP service lets a network attacker corrupt memory and potentially execute code, but the CVSS AC:H rating reflects a race/timing-dependent condition that makes reliable exploitation harder than a deterministic request. No public exploit code was identified at time of analysis, and vendor patches are available; the DHCP role is non-default and typically only present on infrastructure servers acting as DHCP providers.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker with low-level privileges to exploit a memory corruption flaw and gain higher privileges on affected Windows client and server systems. The vulnerable BITS component is default-enabled and reachable without non-default configuration, but exploitation requires a pre-existing local foothold and no user interaction, with no remote or network vector. Vendor patch is available; no public exploit identified at time of analysis, and the independent assessment rates this as a credible but not emergency-level priority.
Remote code execution in Windows DHCP Server is possible through a use-after-free that can be triggered by unauthenticated, network-adjacent attackers against Windows Server systems where the optional DHCP Server role is enabled and reachable. The assessed CVSS vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, and affected builds include Windows Server 2012 through Server 2025, including Server Core installations. Vendor patches are available, and available intelligence indicates no public exploit identified at time of analysis and no confirmed active exploitation, so this is a credible high-priority patching target rather than an emergency under active attack.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
An out-of-bounds read (CWE-125) in Microsoft's Windows Server 'Server for NFS' role can be triggered by a remote, unauthenticated attacker sending crafted network requests, and Microsoft rates it as potentially leading to remote code execution with full confidentiality and integrity impact. The flaw affects the optional NFS server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 as well as Windows 10 1607 and 1809 builds below the patched revisions, so hosts that have never installed the Server for NFS feature are not exposed. No public exploit code has been identified and CISA SSVC records exploitation as 'none' and automatable as 'no', which is consistent with the CVSS UI:R requirement for user interaction; the high base score (8.8) alongside those low exploitation signals is a conflict that defenders should weigh when prioritising, with patched builds available from Microsoft.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Privilege escalation on supported Windows 10, Windows 11, and Windows Server builds stems from a use-after-free in the Cloud Files Mini Filter Driver (cldflt.sys), the component that services OneDrive-style cloud placeholder files. An attacker who already holds local, authenticated access to the host (CVSS PR:L, AC:H) and can drive concurrent cloud-file operations may win a narrow race window (CWE-362) and corrupt driver memory, ultimately gaining SYSTEM-level code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is not confirmed actively exploited (CISA KEV) and no public exploit code was identified at time of analysis; the local foothold requirement, the timing-dependent nature of the race, and the need for repeated attempts keep realistic risk below the raw score. Vendor patches are available from Microsoft.
A use-after-free in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets a locally authenticated attacker on a vulnerable Windows host elevate privileges to SYSTEM by winning a narrow timing window in which a freed kernel object is reclaimed before deletion completes. Because exploitation requires the attacker to already hold low-privileged local access (PR:L), it is a post-compromise privilege-escalation primitive rather than a remote entry point, and the high attack complexity (AC:H) means success is neither trivial nor deterministic. Microsoft has released fixes for all affected Windows 10, Windows 11, Windows Server 2019/2022/2025 builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote code execution is possible against Windows Failover Cluster through a use-after-free in the cluster service, affecting Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations, whenever the Failover Clustering role is installed and running. Signals diverge sharply: Microsoft and NVD publish a 9.8 score with AV:N/AC:L/PR:N/UI:N, while the independent assessment re-scores attack complexity as High (AC:H) because the clustering role is not a default configuration, the service normally lives on segmented management/heartbeat networks rather than exposed public interfaces, and reliably converting a freed object into controlled execution requires precise timing. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" while rating the flaw fully automatable with total technical impact if the service is reachable; if that reachability exists, impact is complete loss of confidentiality, integrity, and availability.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.
Double free in the Windows Hyper-V hypervisor component allows an authenticated local attacker to corrupt memory in a privileged context and elevate to SYSTEM on affected Windows 11 (23H2, 24H2, 25H2, 26H2) and Windows Server 2022/2025 hosts, including Server Core installations, with the Hyper-V role present. Exploitation requires that the attacker already hold local code execution on the host (CVSS AV:L/PR:L, no user interaction), so this is a privilege-escalation primitive rather than a remote entry point, and hosts without the Hyper-V role are not exposed. No public exploit code or active exploitation has been identified at time of analysis - CISA SSVC reports exploitation none and automatable no - and vendor patches are available, making this a genuine but second-tier priority relative to remotely reachable or actively exploited Hyper-V flaws.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Local privilege escalation in Microsoft's Windows Installer service lets an attacker who already holds authenticated low-privilege local access free and then reuse a memory object, potentially seizing control of the SYSTEM-level installer process. Exploitation hinges on winning a non-deterministic race/timing window (AC:H, PR:L, AV:L), so CISA's SSVC rates exploitation as 'none' and automatable as 'no'; no public exploit identified at time of analysis and the flaw is not in CISA KEV, though the technical impact if successfully triggered is total (full confidentiality, integrity and availability loss). Microsoft has released vendor patches covering all affected Windows 10, Windows 11 and Windows Server builds.
Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.
Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, letting an unauthenticated attacker on an adjacent network bypass a Hyper-V security feature. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates high confidentiality impact that crosses a security scope boundary, but with no integrity or availability impact; the practical prerequisite is that the attacker already occupies a position on the adjacent layer-2 / virtual-switch segment, such as a co-resident guest VM or a host on the same segment, rather than reaching the target from the internet. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no' (the adjacency requirement prevents trivial mass exploitation), and vendor patches are available. This is a moderate-priority hardening issue rather than an emergency, but it is worth treating seriously in multi-tenant or high-density virtualization environments where untrusted guests may share a virtual switch with sensitive workloads.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already possesses low-privilege code execution on a Windows host to corrupt memory via a use-after-free and elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is not remotely reachable and needs pre-existing local access; the high attack complexity reflects a race/heap-reuse condition that makes exploitation timing-dependent, and no public exploit identified at time of analysis. Microsoft has released a vendor patch.
Local privilege escalation in Microsoft's Windows Resource Management (MRM) component lets an authenticated attacker who already holds low-level privileges on a host trigger an integer overflow (CWE-190) and elevate to higher integrity, with full impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote - it requires an existing local foothold - but needs no user interaction and has low attack complexity, so once any code execution or interactive access is obtained on an unpatched build, escalation is straightforward. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds below the vendor's fixed revision levels are affected; there is no public exploit code identified and no confirmed active exploitation (no CISA KEV listing) at time of analysis, although vendor patches are available.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated, low-privileged code execution on a host to trigger a use-after-free in the installer service and execute code in a higher-privileged context. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-416), the flaw requires an existing foothold and is therefore a second-stage escalation primitive rather than a remotely reachable or pre-authentication vector, with no user interaction needed once that local access exists. No public exploit code has been identified at time of analysis, and no confirmed active exploitation has been reported; Microsoft has released fixes covering all supported Windows client and server branches, including fixed builds such as 10.0.26100.9711 for Windows 11 24H2 and 10.0.26100.33650 for Windows Server 2025.
Local privilege escalation in Windows Winlogon (CVE-2026-87699) allows an attacker who already holds an authenticated low-privileged session on a target machine to trigger a heap-based buffer overflow in the Winlogon process and elevate to full SYSTEM-level privileges, yielding high confidentiality, integrity, and availability impact on that host. The flaw affects a broad set of Windows 10, Windows 11, and Windows Server 2012 through Server 2025 builds below the fixed revisions published by Microsoft (for example Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, and Windows Server 2016 below 10.0.14393.9612), and the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores it 7.8. There is no public exploit identified at time of analysis, and CISA's SSVC records exploitation as 'none', but the fully local, no-user-interaction attack path makes this an effective post-compromise escalation step for an attacker already present on a host.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to elevate to higher integrity - ultimately SYSTEM-level privileges - by triggering a use-after-free (CWE-416) in the packaging/installation code path, achieving full loss of confidentiality, integrity, and availability for the affected host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a broad set of supported Windows client and server platforms, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, all default installations of the core OS component. Because the vector requires AV:L and PR:L, this is a post-compromise escalation step rather than an initial-access vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; Microsoft has published vendor fixes as part of its monthly security update.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authorized low-privilege user elevate to SYSTEM by triggering a use-after-free memory-corruption condition in the installer service. Exploitation is confined to unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 hosts, and requires a valid local account plus high attack complexity because the primitive depends on precise object-lifetime/timing conditions (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, 7.0); no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Microsoft has released patched builds for every affected branch, so exposure is limited to systems that have not yet applied the current cumulative updates.
Use-after-free in the Windows Kernel allows an authenticated, low-privileged local attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to escalate privileges to SYSTEM-level, delivering high confidentiality, integrity and availability impact as a post-compromise LPE primitive. Affected systems are unpatched builds of Windows 10, Windows 11 and Windows Server 2012 through 2025 that fall below the fixed revisions in the vendor advisory. A vendor patch is available per the Microsoft MSRC update guide; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Installer (CVSS 7.0) lets an attacker who already holds low-privilege, local access on a Windows host escalate to SYSTEM by winning a race condition in the service's handling of a shared resource during concurrent execution. The flaw is CWE-362 and carries AC:H in the assessed vector, so the timing window is narrow and exploitation may require repeated attempts; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has published fixed builds for the affected Windows 10, Windows 11 and Windows Server releases via the MSRC update guide for CVE-2026-85941, making prompt patching the definitive mitigation.
Heap corruption in the Microsoft Windows Shell allows an unauthenticated remote attacker to execute arbitrary code in the context of a user who opens or interacts with attacker-supplied Shell content, such as a crafted file, link, or shell item. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is gated by mandatory user interaction and CISA's SSVC assessment records exploitation as 'none' and the attack as not automatable, so it is best suited to targeted social-engineering delivery rather than unattended mass exploitation; no public exploit identified at time of analysis. The affected build range is broad, covering Windows 10, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) on supported Windows 10, Windows 11 and Windows Server builds allows a low-privileged, locally logged-on user (PR:L, AV:L, UI:N) to win a use-after-free race inside the service and execute code in a higher-privileged service context. The issue is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with high attack complexity reflecting the difficulty of reliably triggering and winning the memory-reuse race, and CISA's SSVC assessment records no exploitation, no automatable path and no public exploit identified at time of analysis. Because AppXSvc is default-enabled and the vector is strictly local, residual risk is concentrated on unpatched multi-user, shared or kiosk Windows hosts where any interactive account could repeatedly attempt the race; vendor patches are available and materially reduce that risk.
Local privilege escalation in the Windows Print Spooler allows an attacker who already holds an authenticated, low-privileged foothold on a Windows host to elevate to SYSTEM-level code execution. The root cause is a use-after-free memory corruption flaw (CWE-416) that requires no user interaction and has low attack complexity, so it can be triggered reliably once local code execution is obtained; the local-only vector means it is a post-compromise escalation primitive rather than an initial-access path. Microsoft has released patched builds for all affected client and server versions, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.
Local privilege escalation in Microsoft's Windows Image Acquisition (WIA) service lets an attacker who already holds low-privileged authenticated access on a Windows host corrupt memory in the WIA component and run code with higher - ultimately SYSTEM-level - privileges. Exploitation is confined to the local machine (AV:L), requires a pre-existing foothold (PR:L), and hinges on winning a use-after-free timing window rated high complexity (AC:H), so it is not remotely reachable, cannot be reliably automated, and needs no victim interaction. Microsoft has released a vendor fix per its update guide and no public exploit code or active exploitation has been identified at time of analysis, making this a credible but not top-tier priority patch - the real-world risk comes from attackers who have already landed on a box and want to finish escalating.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver lets an unauthenticated remote attacker execute code in kernel context on affected default Windows installations, scoring CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released a vendor patch, and CISA's SSVC assessment rates the flaw as automatable with total technical impact, but no exploitation has been observed and no public exploit code exists - so the practical risk hinges on whether a reachable network path to the driver actually exists, since a storage/volume driver is not inherently internet-facing. Every supported Windows client and server branch from Windows 10 1607 through Windows 11 26H2, plus Server 2012 through Server 2025, is enumerated as affected below the fixed build numbers.
Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Clipboard User Service allows an attacker who already holds a low-privileged, authenticated session on a Windows host to win a race condition on an improperly synchronized shared resource and elevate their privileges on that machine. Only local access is viable (AV:L, PR:L) with no user interaction required, and the timing-dependent nature of the flaw (AC:H, SSVC Automatable=no) means exploitation is non-deterministic and typically requires many repeated attempts rather than a reliable one-shot trigger. There is confirmed publicly documented vendor patching but no public exploit identified at time of analysis, and the race-condition reliability plus the prerequisite foothold make practical risk more moderate than the 7.0 severity score alone suggests.
Local privilege escalation in the Windows StateRepository API lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a use-after-free (CWE-416) in the state store used by the AppX/UWP deployment stack, corrupting memory and gaining higher privileges up to the level of the affected component, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity, and availability for the vulnerable component. The issue spans a wide set of Windows 10, Windows 11, and Windows Server builds (per EUVD-2026-100050), and a vendor fix is available per the Microsoft advisory; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Because exploitation is gated on a pre-existing local foothold rather than on any non-default configuration, it should be treated as a post-compromise escalation step rather than a remote entry point, making it a credible but not emergency priority.
Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.
Local privilege escalation in the Windows Direct Composition (dcomp) compositor lets a low-privileged, already-authenticated local attacker drive a use-after-free (CWE-416) and gain high-integrity code execution (C:H/I:H) on affected Windows 10, Windows 11 and Windows Server builds. Exploitation is post-foothold only: the CVSS vector (AV:L, PR:L, UI:N) requires the attacker to already hold local code execution, so this is not a remotely reachable entry point and no user interaction is needed once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a patch-now local escalation rather than a drop-everything emergency; fully patched systems at or above the fixed builds are unaffected.
Local privilege escalation in the Windows UI Immersive Server component allows an attacker who already holds a low-privileged local account on a Windows host to corrupt heap memory via a crafted input and elevate to a higher-integrity context, including SYSTEM. Affected systems are all supported Windows client and server editions running builds below the fixed patch level, ranging from Windows 10 1607 and Windows Server 2012 up through Windows 11 26H2 and Windows Server 2025; patched builds are not exploitable, and there is no remote or unauthenticated path. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and non-automatable, and no EPSS score was supplied, so the practical risk is a serious but post-compromise local escalation flaw rather than an emergency-grade, mass-exploitable issue; a vendor patch is available.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.