Windows Server 2025
Monthly
Information disclosure via uninitialized resource use in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to authenticated remote attackers across a wide range of Microsoft Windows desktop and server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is exploitable over the network by any low-privileged authenticated user with no complexity or interaction requirements, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation and the ubiquitous deployment of Windows RDP make this a meaningful patching priority.
Information disclosure in Windows Print Spooler Components exposes memory contents to locally authenticated attackers via an out-of-bounds read (CWE-125). The flaw affects a sweeping range of Windows releases from Server 2012 through Windows 11 26H1 and Server 2025, making the affected surface extremely broad. Microsoft has released patched builds and the SSVC assessment confirms no observed exploitation, with EPSS at 0.31% (22nd percentile) corroborating a low immediate threat posture; however, Print Spooler's historical exploitation history (PrintNightmare family) warrants prompt patching given attacker familiarity with the component.
Information disclosure in Windows File Explorer exposes sensitive memory contents to local attackers due to CWE-908 use of an uninitialized resource. Triggered when a local user interacts with File Explorer, the flaw allows memory contents - potentially including sensitive data from other processes or the OS - to be read without elevated privileges. No public exploit code has been identified and CISA has not listed this in KEV, but the breadth of affected platforms (Windows 10 through 11 and Windows Server 2012 through 2025) makes patching broadly applicable.
Uninitialized memory exposure in the Microsoft Windows Codecs Library enables a local attacker to disclose sensitive process memory contents on affected Windows systems. The flaw (CWE-908) requires user interaction - specifically opening or processing a specially crafted media file - but demands no elevated privileges. No public exploit code exists and no active exploitation is confirmed; EPSS sits at 0.51% (40th percentile), consistent with SSVC's 'Exploitation: none' assessment, making this a medium-severity, low-urgency issue relative to the breadth of affected platforms.
Information disclosure in Microsoft Windows Schannel (the Secure Channel TLS/SSL provider) lets an authenticated, network-adjacent attacker read memory beyond an allocated buffer and leak sensitive data across a network connection. The flaw spans nearly the entire supported Windows family - Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a fix available; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Null pointer dereference in the Windows SMB Server component allows an authenticated network attacker to crash the service across multiple Windows 10, 11, and Server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network exploitability with low-privilege credentials and complete availability impact, though confidentiality and integrity are unaffected. No public exploit identified at time of analysis; SSVC exploitation status is 'none' and EPSS sits at 0.79%, indicating low active exploitation pressure despite the broad product footprint.
Out-of-bounds read in the Windows Remote Desktop Protocol (RDP) stack enables unauthenticated network attackers to disclose high-confidentiality memory contents from affected Windows systems, contingent on user interaction during an RDP session. The flaw (CWE-125) spans Windows 10 builds 1607 through 22H2, Windows 11 24H2 through 26H1, and Windows Server 2012 through 2025. No active exploitation is confirmed by CISA KEV, SSVC rates it non-automatable with partial technical impact, and EPSS sits at 0.67% (48th percentile), indicating moderate-to-low near-term exploitation probability despite the high confidentiality impact in the CVSS score.
Uninitialized memory disclosure in the Windows SMB stack allows a locally authenticated attacker to read sensitive contents from uninitialized buffers, affecting Windows 10, Windows 11, and Windows Server 2012 through 2025. The flaw (CWE-908) resides in the SMB subsystem where a resource is consumed before being properly zeroed, leaking residual memory contents to a low-privileged local user. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; SSVC assessment places exploitation at none with partial technical impact, making this a standard patch-cycle priority rather than an emergency response item.
Windows Cryptographic Services on multiple Windows 10, Windows 11, and Windows Server editions contains a CWE-200 information disclosure flaw that allows a locally authenticated attacker with standard user privileges to read sensitive cryptographic material they should not be authorized to access. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is entirely local and requires a pre-existing low-privilege session, positioning this as an insider threat or post-compromise scenario rather than an initial access vector. No public exploit code has been identified, CISA SSVC rates exploitation as none, and EPSS sits at only 0.47%, collectively indicating low real-world exploitation activity at time of analysis.
Cross-site scripting in Active Directory Federation Services (AD FS) on Windows Server 2012 through 2025 enables an authorized, high-privileged attacker to inject malicious scripts into AD FS web pages, producing spoofing effects against users who interact with the affected portal. The CVSS vector (PR:H, UI:R, S:C) confirms this is a post-compromise capability requiring admin-level access and victim interaction, not an unauthenticated initial access vector. No active exploitation is confirmed - SSVC rates exploitation as 'none', EPSS sits at 0.38% (30th percentile), and the vulnerability is absent from CISA KEV - placing this firmly in the low-urgency category despite network reachability of the AD FS web interface.
Privilege escalation via heap-based buffer overflow in the Windows NTFS filesystem driver affects a broad range of Windows 10, Windows 11, and Windows Server versions, requiring only physical access to the target device - no OS credentials needed. An attacker with hands-on access to the hardware can trigger a heap overflow in NTFS processing to gain elevated privileges, potentially achieving full system compromise (High C/I/A). No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the combination of zero authentication requirements and critical-level impact makes it a realistic threat for physically accessible endpoints. A vendor-supplied patch is available via the Microsoft Security Response Center.
BitLocker encryption bypass on Windows enables an unauthenticated attacker with physical access to circumvent drive-level encryption protections and read confidential data from protected volumes. Affected platforms span Windows 10 (versions 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2016 through 2025, with a publicly available proof-of-concept exploit on GitHub lowering the bar for physical-access adversaries. No active exploitation is confirmed (not in CISA KEV; SSVC exploitation status: none), and EPSS sits at 0.38% (30th percentile), consistent with a targeted rather than opportunistic threat; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an unauthorized attacker with physical access to the target machine to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability spans a wide range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. No public exploit or active exploitation has been identified (SSVC: Exploitation none), and Microsoft has released patches; however, the physical attack vector (AV:P) is the dominant risk-shaping factor.
Denial of service in Windows Hyper-V allows an authorized, adjacent-network attacker to crash or disrupt the hypervisor by triggering a buffer over-read (CWE-126). Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, covering a broad slice of Microsoft's enterprise footprint. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but a vendor-issued patch is available via Microsoft MSRC.
Microsoft Graphics Component on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to locally authenticated standard users. Exploitation requires existing local access with at least user-level privileges (PR:L, AV:L), after which the attacker can extract sensitive data through the Graphics Component without any user interaction. No active exploitation has been confirmed - SSVC categorizes exploitation as 'none,' CISA KEV listing is absent, and EPSS of 0.35% (27th percentile) reflects low near-term exploitation probability.
Local tampering in Windows DNS via improper access control (CWE-284) allows a low-privilege authenticated local user to manipulate DNS configuration or records across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) confirms exploitation requires only a valid local account with no elevated privileges, yielding high integrity impact with minimal availability disruption and no direct confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' advisory tag suggests DNS tampering may enable downstream bypass of authentication mechanisms dependent on DNS resolution, potentially amplifying the effective impact beyond the raw CVSS score.
Buffer over-read in the Windows Kernel exposes kernel memory contents to locally authenticated, low-privilege attackers across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw (CWE-126) allows out-of-bounds memory reads within the kernel address space, resulting in high-confidence confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC assessment confirms no active exploitation at time of analysis, though the wide deployment footprint of affected Windows versions makes prompt patching a sensible priority.
Windows Media in Microsoft Windows exposes sensitive information to locally authenticated standard users, allowing disclosure of data the attacker is not authorized to access. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing a very broad installed base. No public exploit code has been identified and EPSS at 0.36% (28th percentile) reflects low opportunistic interest, though the local-access requirement is a weaker barrier in shared-access environments such as Remote Desktop Services or VDI deployments.
Out-of-bounds read in HTTP.sys, the Windows kernel-mode HTTP driver, enables a local low-privileged attacker to disclose sensitive kernel memory contents on Windows 11 and Windows Server 2025. The CVSS vector (AV:L/PR:L) confirms exploitation is strictly local and requires an authenticated session - no remote or unauthenticated attack path exists. Microsoft has released patched builds; no active exploitation has been identified (SSVC Exploitation: none; EPSS 0.41%, 33rd percentile), and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in usbaudio.sys (Windows USB Audio Class driver) exposes kernel memory contents to attackers with physical device access across Windows 10, Windows 11, and Windows Server 2012 through 2025. An attacker who can physically connect a crafted USB audio device causes the driver to read beyond an allocated buffer, potentially leaking sensitive kernel memory to the attacker. No public exploit exists and no active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, placing it firmly in the lower-urgency tier despite its wide platform coverage.
Information disclosure in the Windows Quality of Service (QoS) Packet Scheduler component exposes sensitive data to locally authenticated low-privileged users across a wide range of Windows client and server releases. The flaw (CWE-200) allows a local attacker with standard user access to read memory or network-related data that should be restricted to higher-privilege contexts. No public exploit exists and SSVC classifies exploitation as none with partial technical impact, but the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - makes patching a broad operational priority.
Use-after-free in the Windows Virtual Filtering Platform (VFP) enables authenticated network attackers to crash affected Windows endpoints and servers, resulting in a denial-of-service condition. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases through 2025, making patch prioritization important despite the medium CVSS score. No public exploit code or active exploitation has been identified at time of analysis, and SSVC classifies this as not automatable with partial technical impact.
Windows File Explorer on a wide range of Microsoft Windows client and server versions exposes sensitive information to locally authenticated standard users, achieving high confidentiality impact without requiring elevated privileges. The flaw (CWE-200) is confined to the local attack surface - CVSS AV:L/PR:L - meaning the attacker must already hold an interactive session on the target system. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch is available through Microsoft Security Response Center.
Windows File Explorer exposes sensitive information to low-privileged local authenticated users across a wide range of Windows 10, Windows 11, and Windows Server versions. Classified under CWE-200, the flaw enables an attacker already present on a system with standard user rights to access data they should not be permitted to view - no elevation of privilege or remote access is required. No public exploit code has been identified and CISA SSVC confirms no active exploitation, keeping real-world urgency moderate despite the broad affected product surface.
Windows File Explorer across all major Windows 10, Windows 11, and Windows Server releases exposes sensitive information to local authenticated users via a CWE-200 information disclosure flaw. An authorized attacker with low-privilege local access can read data they should not be permitted to access without any user interaction. No public exploit code has been identified at time of analysis and CISA SSVC confirms no observed exploitation, placing this squarely in routine patch-cycle priority despite the broad footprint of affected systems.
Windows File Explorer exposes sensitive information to locally authenticated, low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases. Classified under CWE-200, the flaw allows an authorized local attacker to read data they should not have access to through the File Explorer shell component. No public exploit code has been identified at time of analysis, EPSS sits at 0.36% (28th percentile), and CISA SSVC assesses exploitation as none and not automatable - indicating low urgency despite the high confidentiality impact recorded in the CVSS score.
Information disclosure in the Windows Overlay Filter (WofFilter) kernel-mode driver allows a locally authenticated low-privileged user to read sensitive data they are not authorized to access across Windows 10, Windows 11, and Windows Server 2016 through 2025. The flaw stems from CWE-200 (improper restriction of information to unauthorized actors) within the filter driver's handling of layered filesystem operations. No public exploit code has been identified and no active exploitation is confirmed; however, the high confidentiality impact (C:H) makes this a meaningful stepping stone in multi-stage attacks on shared or multi-tenant Windows systems.
Local information disclosure in Windows Universal Plug and Play (upnp.dll) exposes sensitive memory contents to authorized low-privilege users across a wide range of Windows 10, Windows 11, and Windows Server releases. The flaw stems from use of an uninitialized resource (CWE-908), meaning the UPnP service reads from memory that has not been properly initialized before use, potentially leaking stale heap or stack contents. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Windows Print Spooler Components on multiple Windows 10, 11, and Server editions contain a buffer over-read flaw (CWE-126) that allows a locally authenticated attacker with low privileges to disclose sensitive memory contents. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local access and a standard user account, limiting the attack surface to insiders or already-compromised endpoints. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.30% (22nd percentile) alongside SSVC exploitation status of 'none' together indicate low near-term exploitation probability.
Privilege escalation via physical attack in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects all major Windows 10, Windows 11, and Windows Server releases through 2025. The use-after-free memory corruption flaw (CWE-416) in the kernel-mode driver allows an attacker with physical access to the device to escalate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability compromise. No public exploit code has been identified and CISA has not listed this in KEV, but the SSVC assessment notes total technical impact - the physical access requirement is the primary limiting factor, not the vulnerability's severity once that barrier is cleared.
Remote code execution in the Windows DNS Server component allows an authorized, high-privileged attacker on an adjacent network to traverse outside intended directory boundaries and execute arbitrary code on the target host. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10 versions 1607 and 1809. No public exploit code exists and no active exploitation has been confirmed - CISA SSVC classifies exploitation as 'none' and EPSS sits at 0.37% (29th percentile) - however SSVC rates technical impact as 'total', consistent with the full C:H/I:H/A:H CVSS triad.
Out-of-bounds memory read in the Windows Desktop Window Manager (DWM) Core Library enables a locally authenticated, low-privileged user to disclose sensitive memory contents across a wide range of Windows client and server versions. The flaw is reachable by any standard user account without administrative rights, making it relevant in multi-user, shared workstation, and terminal services environments. No active exploitation is confirmed - CISA SSVC rates exploitation as 'none', EPSS sits at 0.31% (22nd percentile), and no KEV listing exists - but the broad affected surface spanning Windows 10 through Windows 11 and Server 2025 warrants timely patching.
Windows Cryptographic Services across all supported Microsoft Windows client and server editions exposes sensitive cryptographic material to locally authenticated low-privilege users through a CWE-200 information disclosure flaw. Spanning Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, the vulnerability allows an attacker with a standard local account to read confidential data - likely cryptographic keys, certificates, or intermediate cryptographic state - without any user interaction. SSVC rates exploitation as none, EPSS at 0.47% (38th percentile) indicates low near-term exploitation probability, and no active exploitation has been confirmed by CISA KEV, positioning this as a routine patch-cycle priority rather than an emergency response.
Local information disclosure in Windows Notification affects authenticated users across a wide range of Microsoft Windows 10, Windows 11, and Windows Server releases. An attacker with low-privilege local access can exploit this CWE-200 flaw to read sensitive data that should be inaccessible to their account, with no user interaction required. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patched builds addressing all affected versions.
Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to network-adjacent attackers due to use of an uninitialized resource (CWE-908), resulting in high-confidentiality information disclosure. The flaw affects a broad swath of supported Windows client and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - and requires victim user interaction (UI:R per CVSS) to trigger, limiting automated mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation as 'none' with non-automatable technical impact, suggesting this is a real but not imminently weaponized risk.
Out-of-bounds read in the Windows Cloud Files Mini Filter Driver (cldflt.sys) exposes kernel memory contents to local attackers with standard user privileges. Affected across Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019 through 2025, the vulnerability allows an authorized local account to read beyond allocated buffer boundaries in the driver that underpins cloud sync features such as OneDrive Files On-Demand. No public exploit identified at time of analysis; EPSS is 0.31% (22nd percentile) and SSVC rates exploitation as none, making this a moderate patch priority rather than an emergency response.
Security feature bypass in the Windows System component on Windows 11 and Windows Server allows an authenticated local attacker with standard user privileges to circumvent an access control protection, yielding high confidentiality exposure and limited integrity impact. Affected platforms span Windows 11 versions 24H2 through 26H1 and Windows Server 2022 and 2025. No public exploit has been identified and CISA SSVC rates exploitation as none with non-automatable delivery, making this a moderate-priority local threat despite the high confidentiality impact signal in the CVSS vector.
Windows Win32K in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to local authenticated attackers through an information disclosure flaw classified as CWE-200. The vulnerability requires only low-privilege local access and yields partial confidentiality impact with no integrity or availability consequences, consistent with the CVSS 3.3 Low rating. No public exploit identified at time of analysis, and CISA SSVC assessment confirms no known exploitation, non-automatable attack pattern, and only partial technical impact - making this a low real-world priority outside multi-tenant or shared-access environments.
Null pointer dereference in Active Directory Domain Services (AD DS) on Windows allows an authenticated, network-adjacent attacker to crash the service and deny domain authentication to all dependent users and systems. Affecting Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2025, this vulnerability carries a CVSS 6.5 with high availability impact. No public exploit identified at time of analysis and CISA SSVC assesses exploitation as none with non-automatable attack path, keeping real-world urgency at moderate despite the breadth of affected platforms.
Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 platforms contains an infinite loop flaw (CWE-835) that a remote unauthenticated attacker can trigger to exhaust service resources and cause a sustained denial of service. The attack requires high complexity (CVSS AC:H) but no authentication, targeting organizations that expose AD FS endpoints to the network. No public exploit code exists and CISA SSVC confirms no known exploitation at time of analysis; Microsoft has released patches across all affected platforms.
Integer overflow in the Windows Devices Human Interface (HID) subsystem enables a local, low-privileged attacker to disclose sensitive information on affected systems. The vulnerability spans Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025, representing a broad attack surface across Microsoft's supported OS portfolio. No public exploit code exists and CISA SSVC rates current exploitation as none, with an EPSS score of 0.30% (22nd percentile) confirming very low near-term exploitation probability.
Windows Push Notifications on multiple Windows 10, 11, and Server editions exposes sensitive information to low-privileged local attackers, who can read notification content or related data scoped to other users or higher-privilege contexts without any user interaction. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, with vendor-confirmed fixed build versions available via Microsoft Update. No public exploit exists and no active exploitation is confirmed - SSVC rates exploitation as none and EPSS sits at 0.36% (28th percentile) - making this a secondary patching priority unless operating shared multi-user Windows environments.
Sensitive information disclosure in Windows Push Notifications (WPN) permits a locally authenticated, low-privileged attacker to read confidential data they are not authorized to access. Affected systems span Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer footprint. No public exploit identified at time of analysis, EPSS sits at 0.36% (28th percentile), and CISA SSVC rates exploitation as none with non-automatable attack paths.
Sensitive information disclosure in Windows Push Notifications allows a locally authenticated standard user to access notification data they are not authorized to view across Windows 10, Windows 11, and Windows Server 2022/2025 platforms. The flaw (CWE-200) requires only low-privilege local access - no elevated rights or user interaction - making it exploitable by any interactive user on a vulnerable host. No public exploit code exists at time of analysis, and both EPSS (0.36%, 28th percentile) and SSVC (exploitation: none, automatable: no) signals indicate low near-term weaponization risk despite the high confidentiality impact rating.
Buffer over-read in the Windows NTFS kernel driver exposes adjacent memory contents to a local attacker holding a standard user account across a broad range of Windows 10, 11, and Server releases. Exploitation is constrained to AV:L/PR:L, meaning an attacker must already have interactive or programmatic local access before triggering the CWE-126 condition - making this a post-compromise reconnaissance primitive rather than an initial-access vector. EPSS stands at 0.31% (22nd percentile) and SSVC confirms no known exploitation activity, placing this at low operational urgency despite the High confidentiality impact rating.
Windows Kernel information disclosure across a broad range of Microsoft Windows 10, Windows 11, and Windows Server editions allows a locally authenticated low-privileged attacker to read sensitive kernel memory contents they are not authorized to access. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is confined to local exploitation with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing the issue across all affected version branches per EUVD-2026-43865.
Windows Cryptographic Services improperly validates certificates across multiple Windows 10, 11, and Server editions, enabling remote unauthenticated attackers to bypass security features enforced by the PKI/certificate trust chain over a network path. Affected platforms span Windows 10 21H2 and 22H2, Windows 11 24H2 through 26H1, and Windows Server 2022 and 2025 in both full and Server Core deployments. No public exploit identified at time of analysis; EPSS at 0.24% (15th percentile) and SSVC exploitation status of 'none' together indicate low near-term exploitation probability despite the broad product footprint.
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Integer underflow in the Windows Kernel enables a locally authenticated attacker to disclose sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server platforms. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privilege local user can trigger the flaw without special configuration or user interaction, yielding high confidentiality impact with no integrity or availability consequences. Microsoft has released a patch via the July 2026 Security Update Guide; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.
Sensitive information disclosure in the Windows Trusted Runtime Interface Driver permits a locally authenticated, low-privileged attacker to read protected data from the affected system. The flaw impacts Windows 10 (21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2025 across both full and Server Core installations. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; Microsoft has released patches resolving the issue.
Security feature bypass via improper privilege management (CWE-269) in Microsoft Windows DNS grants a locally authenticated attacker the ability to circumvent an unspecified security control, resulting in high integrity impact on affected Windows 11 and Windows Server 2025 systems. Affected platforms include Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No active exploitation has been confirmed by CISA KEV, EPSS probability is very low at 0.22% (13th percentile), and SSVC rates exploitation status as none - indicating this is a patched local-only issue without known active abuse.
Sensitive information disclosure in the Windows Kernel affects Windows 10 (versions 21H2 and 22H2), Windows 11 (versions 24H2, 25H2, and 26H1), and Windows Server 2022 and 2025, where the kernel writes sensitive data into log files that a low-privileged local user can access. An authorized attacker with a standard local account can read these log files to obtain sensitive kernel-level information, yielding high confidentiality impact with no integrity or availability consequence. No public exploit has been identified at time of analysis, and the EPSS score of 0.36% at the 28th percentile corroborates low near-term exploitation likelihood; Microsoft has released patches addressing all affected versions.
Privilege escalation to SYSTEM level is achievable in Windows Spaceport.sys - the kernel-mode Storage Spaces port driver - across a wide range of Windows 10, Windows 11, and Windows Server releases, when an attacker has physical access to the target machine. An integer overflow or wraparound in the driver's arithmetic logic (CWE-190) can corrupt kernel memory structures, enabling full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and SSVC confirms exploitation status as none, but the Technical Impact rating is total, meaning successful exploitation fully compromises the affected system.
Local information disclosure in Windows DirectX exposes sensitive data to unauthorized local actors across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-200) achieves high confidentiality impact per the CVSS vector while producing no integrity or availability impact, meaning an attacker gains read access to protected data without disrupting system operation. No public exploit has been identified at time of analysis; EPSS at 0.38% (30th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability despite the wide affected surface.
Uninitialized memory disclosure in the Windows SMB implementation enables a locally authenticated, low-privileged attacker to read sensitive contents from uninitialized kernel or heap buffers, achieving high confidentiality impact within the affected system. The vulnerability spans Windows 10 (from version 1607 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2012 through 2025 across both full and Server Core installation types. No public exploit code has been identified and CISA SSVC assesses exploitation status as none, placing this firmly in the patch-and-monitor category rather than emergency response.
Windows Kernel information disclosure across a broad range of Microsoft Windows desktop and server editions allows a local, unprivileged attacker to read sensitive kernel memory or system state not intended for user-space access. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N confirms local code execution with no special privileges is sufficient to trigger the flaw. EPSS sits at 0.38% (30th percentile) with no CISA KEV listing and SSVC exploitation status of 'none,' indicating no confirmed or publicly observed active exploitation at time of analysis; however, kernel information leaks of this class are routinely used to stage ASLR-bypass steps in multi-stage privilege escalation chains.
Privilege escalation to SYSTEM level is achievable in the Windows USB Video Class (UVC) driver across a broad swath of Windows 10, 11, and Server editions via physical connection of a malicious USB device. The heap-based buffer overflow (CWE-122) is triggered when the driver processes attacker-controlled UVC descriptors from a crafted device, corrupting kernel heap memory. No active exploitation is confirmed (absent from CISA KEV, SSVC exploitation=none), and EPSS sits at 0.37% (29th percentile), consistent with the physical access barrier that makes mass exploitation impractical.
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Windows Event Logging Service across a wide range of Windows 10, Windows 11, and Windows Server versions fails to enforce its intended protection mechanisms, permitting any authenticated low-privileged network user to read information that should be access-controlled. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only a valid low-privilege account and network connectivity, with no user interaction and no elevated rights - making it a practical post-compromise lateral-movement or reconnaissance tool. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, but the ubiquitous deployment footprint across the Windows ecosystem elevates organizational exposure.
Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Windows Audio Service on multiple Windows desktop and server versions improperly exposes sensitive information to locally authenticated standard users, enabling information disclosure without requiring elevated privileges. Affecting Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 (with Server 2022 and 2025 referenced in tags), the flaw is exploitable post-foothold by any low-privileged local account, making it a realistic post-exploitation pivot rather than an initial access vector. No public exploit code has been identified at time of analysis, and a vendor-released patch is confirmed available via the Microsoft Security Response Center.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Windows Remote Desktop Protocol (RDP) client leaks sensitive memory contents due to use of an uninitialized resource (CWE-908), allowing a network-accessible attacker to disclose potentially high-value information from a victim's system. Exploitation requires user interaction - a victim must connect to an attacker-controlled RDP endpoint - making this a client-side information disclosure attack affecting Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2012 through 2025. No public exploit code has been identified and no active exploitation is confirmed; however, the CVSS confidentiality impact is rated High, meaning exposed memory could include credentials or session tokens.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Privilege escalation via use-after-free in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, requiring physical access to exploit. An attacker with hands-on access to a target machine can trigger a memory corruption condition through the USB print subsystem to achieve full local privilege escalation - High confidentiality, integrity, and availability impact per CVSS. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Missing authentication enforcement in the Microsoft Windows DNS component allows a low-privileged local attacker to tamper with DNS configuration or records without requiring elevated credentials. Affected platforms span Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025 - a broad deployment footprint across enterprise environments. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' with partial technical impact, but the high integrity impact (CVSS I:H) warrants attention in multi-user environments and on DNS server infrastructure where record integrity is critical.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Windows Media on multiple Windows client and server editions exposes sensitive information to authenticated local users, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad footprint of Microsoft's supported OS ecosystem. No active exploitation has been identified at time of analysis - the vulnerability is absent from CISA KEV, EPSS sits at 0.36% (28th percentile), and SSVC assesses exploitation status as none - making this a patch-and-monitor priority rather than an emergency response.
BitLocker's protection mechanism on Windows fails to enforce a critical authentication or verification step, permitting a physically present attacker to bypass full-disk encryption without credentials, a recovery key, or elevated privileges. Despite a CVSS score of 6.8 (Medium) - moderated by the physical access requirement - the impact ratings are High across confidentiality, integrity, and availability, meaning successful exploitation grants complete access to encrypted data and the underlying system. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library exposes sensitive memory contents to locally authenticated, low-privileged attackers on Windows 11 and Windows Server 2025. The flaw (CWE-125) allows a standard user to read beyond an allocated buffer boundary within the DWM process, resulting in high-confidence information disclosure with no integrity or availability impact. Microsoft has released patches covering all affected build ranges; no public exploit code has been identified at time of analysis.
Security feature bypass in Microsoft Windows BitLocker allows an attacker with physical access to circumvent the drive encryption protection mechanism. Affected systems can have BitLocker-protected data accessed despite the encryption-at-rest control being enabled, undermining a core platform confidentiality boundary. There is no public exploit identified at time of analysis, but the vulnerability is reported by Microsoft (secure@microsoft.com) as a protection mechanism failure with high impact across confidentiality, integrity, and availability.
BitLocker drive encryption on Windows can be bypassed by a physically present, unauthenticated attacker, exposing protected volume contents with high confidentiality impact. Classified as CWE-693 (Protection Mechanism Failure), the flaw undermines BitLocker's core threat model - data-at-rest protection - across a wide range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions; however, the physical access requirement means organizations with mobile or physically accessible systems should treat this as a higher operational priority than the CVSS score alone implies.
Spoofing via improper input validation affects Microsoft Azure Attestation service and the Device Health Attestation Service component across a broad range of Windows OS versions, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. An authorized attacker with high privileges and physical access to the target device can manipulate attestation inputs to spoof device health or platform integrity status, achieving a high-integrity impact with no confidentiality or availability consequence. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the CVSS score of 3.9 (Low) reflects the significant physical and privilege barriers to exploitation.
Out-of-bounds read in the Windows DHCP Server service enables a locally authenticated, low-privileged attacker to disclose contents of process memory on affected systems. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges - no elevated rights or user interaction needed. Exploitation is constrained to hosts where the Windows DHCP Server role is actively installed and running, which significantly limits the attack surface to designated infrastructure servers rather than general workstations. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Out-of-bounds read in Windows DHCP Server exposes adjacent memory contents and can crash the service, yielding both information disclosure and a high-severity denial-of-service condition on affected Windows systems. The flaw (CWE-125) is exploitable locally with low attack complexity and no user interaction, targeting systems where the DHCP Server role is installed across a broad range of Windows 10, 11, and Server editions from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via the MSRC update guide (CVE-2026-45608).
Out-of-bounds read in Microsoft's UxTheme Library (uxtheme.dll) enables a locally authenticated attacker to crash the affected Windows system, resulting in denial of service. The vulnerability spans a broad swath of Windows releases - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management critical for enterprise environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds read in the Windows Application Identity (AppID) Subsystem exposes sensitive kernel or process memory to a local authenticated attacker without requiring elevated privileges or user interaction. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2025, including Server Core installations. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog, though the high confidentiality impact (CVSS C:H) indicates meaningful data exposure potential when triggered.
Mark of the Web (MOTW) protection mechanism failure across a broad range of Windows client and server releases allows unauthenticated network-based attackers to deliver files that evade the Zone.Identifier security tag, bypassing downstream defenses such as SmartScreen and Office Protected View that depend on MOTW presence. User interaction is required to trigger the bypass, limiting automated mass exploitation. No public exploit code exists and CISA has not listed this in KEV; however, the breadth of affected Windows versions - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - gives this vulnerability significant surface area as a link in social-engineering attack chains.
Information disclosure in the Windows Application Identity (AppID) Subsystem exposes sensitive data to locally authenticated, low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires only a local session with standard user privileges - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide affected surface spanning consumer and server SKUs makes patching a meaningful priority in multi-user or shared-system environments.
Information disclosure via uninitialized resource use in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to authenticated remote attackers across a wide range of Microsoft Windows desktop and server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is exploitable over the network by any low-privileged authenticated user with no complexity or interaction requirements, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation and the ubiquitous deployment of Windows RDP make this a meaningful patching priority.
Information disclosure in Windows Print Spooler Components exposes memory contents to locally authenticated attackers via an out-of-bounds read (CWE-125). The flaw affects a sweeping range of Windows releases from Server 2012 through Windows 11 26H1 and Server 2025, making the affected surface extremely broad. Microsoft has released patched builds and the SSVC assessment confirms no observed exploitation, with EPSS at 0.31% (22nd percentile) corroborating a low immediate threat posture; however, Print Spooler's historical exploitation history (PrintNightmare family) warrants prompt patching given attacker familiarity with the component.
Information disclosure in Windows File Explorer exposes sensitive memory contents to local attackers due to CWE-908 use of an uninitialized resource. Triggered when a local user interacts with File Explorer, the flaw allows memory contents - potentially including sensitive data from other processes or the OS - to be read without elevated privileges. No public exploit code has been identified and CISA has not listed this in KEV, but the breadth of affected platforms (Windows 10 through 11 and Windows Server 2012 through 2025) makes patching broadly applicable.
Uninitialized memory exposure in the Microsoft Windows Codecs Library enables a local attacker to disclose sensitive process memory contents on affected Windows systems. The flaw (CWE-908) requires user interaction - specifically opening or processing a specially crafted media file - but demands no elevated privileges. No public exploit code exists and no active exploitation is confirmed; EPSS sits at 0.51% (40th percentile), consistent with SSVC's 'Exploitation: none' assessment, making this a medium-severity, low-urgency issue relative to the breadth of affected platforms.
Information disclosure in Microsoft Windows Schannel (the Secure Channel TLS/SSL provider) lets an authenticated, network-adjacent attacker read memory beyond an allocated buffer and leak sensitive data across a network connection. The flaw spans nearly the entire supported Windows family - Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Reported by Microsoft with a fix available; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Null pointer dereference in the Windows SMB Server component allows an authenticated network attacker to crash the service across multiple Windows 10, 11, and Server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network exploitability with low-privilege credentials and complete availability impact, though confidentiality and integrity are unaffected. No public exploit identified at time of analysis; SSVC exploitation status is 'none' and EPSS sits at 0.79%, indicating low active exploitation pressure despite the broad product footprint.
Out-of-bounds read in the Windows Remote Desktop Protocol (RDP) stack enables unauthenticated network attackers to disclose high-confidentiality memory contents from affected Windows systems, contingent on user interaction during an RDP session. The flaw (CWE-125) spans Windows 10 builds 1607 through 22H2, Windows 11 24H2 through 26H1, and Windows Server 2012 through 2025. No active exploitation is confirmed by CISA KEV, SSVC rates it non-automatable with partial technical impact, and EPSS sits at 0.67% (48th percentile), indicating moderate-to-low near-term exploitation probability despite the high confidentiality impact in the CVSS score.
Uninitialized memory disclosure in the Windows SMB stack allows a locally authenticated attacker to read sensitive contents from uninitialized buffers, affecting Windows 10, Windows 11, and Windows Server 2012 through 2025. The flaw (CWE-908) resides in the SMB subsystem where a resource is consumed before being properly zeroed, leaking residual memory contents to a low-privileged local user. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; SSVC assessment places exploitation at none with partial technical impact, making this a standard patch-cycle priority rather than an emergency response item.
Windows Cryptographic Services on multiple Windows 10, Windows 11, and Windows Server editions contains a CWE-200 information disclosure flaw that allows a locally authenticated attacker with standard user privileges to read sensitive cryptographic material they should not be authorized to access. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is entirely local and requires a pre-existing low-privilege session, positioning this as an insider threat or post-compromise scenario rather than an initial access vector. No public exploit code has been identified, CISA SSVC rates exploitation as none, and EPSS sits at only 0.47%, collectively indicating low real-world exploitation activity at time of analysis.
Cross-site scripting in Active Directory Federation Services (AD FS) on Windows Server 2012 through 2025 enables an authorized, high-privileged attacker to inject malicious scripts into AD FS web pages, producing spoofing effects against users who interact with the affected portal. The CVSS vector (PR:H, UI:R, S:C) confirms this is a post-compromise capability requiring admin-level access and victim interaction, not an unauthenticated initial access vector. No active exploitation is confirmed - SSVC rates exploitation as 'none', EPSS sits at 0.38% (30th percentile), and the vulnerability is absent from CISA KEV - placing this firmly in the low-urgency category despite network reachability of the AD FS web interface.
Privilege escalation via heap-based buffer overflow in the Windows NTFS filesystem driver affects a broad range of Windows 10, Windows 11, and Windows Server versions, requiring only physical access to the target device - no OS credentials needed. An attacker with hands-on access to the hardware can trigger a heap overflow in NTFS processing to gain elevated privileges, potentially achieving full system compromise (High C/I/A). No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the combination of zero authentication requirements and critical-level impact makes it a realistic threat for physically accessible endpoints. A vendor-supplied patch is available via the Microsoft Security Response Center.
BitLocker encryption bypass on Windows enables an unauthenticated attacker with physical access to circumvent drive-level encryption protections and read confidential data from protected volumes. Affected platforms span Windows 10 (versions 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2016 through 2025, with a publicly available proof-of-concept exploit on GitHub lowering the bar for physical-access adversaries. No active exploitation is confirmed (not in CISA KEV; SSVC exploitation status: none), and EPSS sits at 0.38% (30th percentile), consistent with a targeted rather than opportunistic threat; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an unauthorized attacker with physical access to the target machine to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability spans a wide range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. No public exploit or active exploitation has been identified (SSVC: Exploitation none), and Microsoft has released patches; however, the physical attack vector (AV:P) is the dominant risk-shaping factor.
Denial of service in Windows Hyper-V allows an authorized, adjacent-network attacker to crash or disrupt the hypervisor by triggering a buffer over-read (CWE-126). Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, covering a broad slice of Microsoft's enterprise footprint. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but a vendor-issued patch is available via Microsoft MSRC.
Microsoft Graphics Component on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to locally authenticated standard users. Exploitation requires existing local access with at least user-level privileges (PR:L, AV:L), after which the attacker can extract sensitive data through the Graphics Component without any user interaction. No active exploitation has been confirmed - SSVC categorizes exploitation as 'none,' CISA KEV listing is absent, and EPSS of 0.35% (27th percentile) reflects low near-term exploitation probability.
Local tampering in Windows DNS via improper access control (CWE-284) allows a low-privilege authenticated local user to manipulate DNS configuration or records across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) confirms exploitation requires only a valid local account with no elevated privileges, yielding high integrity impact with minimal availability disruption and no direct confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' advisory tag suggests DNS tampering may enable downstream bypass of authentication mechanisms dependent on DNS resolution, potentially amplifying the effective impact beyond the raw CVSS score.
Buffer over-read in the Windows Kernel exposes kernel memory contents to locally authenticated, low-privilege attackers across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw (CWE-126) allows out-of-bounds memory reads within the kernel address space, resulting in high-confidence confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC assessment confirms no active exploitation at time of analysis, though the wide deployment footprint of affected Windows versions makes prompt patching a sensible priority.
Windows Media in Microsoft Windows exposes sensitive information to locally authenticated standard users, allowing disclosure of data the attacker is not authorized to access. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing a very broad installed base. No public exploit code has been identified and EPSS at 0.36% (28th percentile) reflects low opportunistic interest, though the local-access requirement is a weaker barrier in shared-access environments such as Remote Desktop Services or VDI deployments.
Out-of-bounds read in HTTP.sys, the Windows kernel-mode HTTP driver, enables a local low-privileged attacker to disclose sensitive kernel memory contents on Windows 11 and Windows Server 2025. The CVSS vector (AV:L/PR:L) confirms exploitation is strictly local and requires an authenticated session - no remote or unauthenticated attack path exists. Microsoft has released patched builds; no active exploitation has been identified (SSVC Exploitation: none; EPSS 0.41%, 33rd percentile), and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in usbaudio.sys (Windows USB Audio Class driver) exposes kernel memory contents to attackers with physical device access across Windows 10, Windows 11, and Windows Server 2012 through 2025. An attacker who can physically connect a crafted USB audio device causes the driver to read beyond an allocated buffer, potentially leaking sensitive kernel memory to the attacker. No public exploit exists and no active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, placing it firmly in the lower-urgency tier despite its wide platform coverage.
Information disclosure in the Windows Quality of Service (QoS) Packet Scheduler component exposes sensitive data to locally authenticated low-privileged users across a wide range of Windows client and server releases. The flaw (CWE-200) allows a local attacker with standard user access to read memory or network-related data that should be restricted to higher-privilege contexts. No public exploit exists and SSVC classifies exploitation as none with partial technical impact, but the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - makes patching a broad operational priority.
Use-after-free in the Windows Virtual Filtering Platform (VFP) enables authenticated network attackers to crash affected Windows endpoints and servers, resulting in a denial-of-service condition. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases through 2025, making patch prioritization important despite the medium CVSS score. No public exploit code or active exploitation has been identified at time of analysis, and SSVC classifies this as not automatable with partial technical impact.
Windows File Explorer on a wide range of Microsoft Windows client and server versions exposes sensitive information to locally authenticated standard users, achieving high confidentiality impact without requiring elevated privileges. The flaw (CWE-200) is confined to the local attack surface - CVSS AV:L/PR:L - meaning the attacker must already hold an interactive session on the target system. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch is available through Microsoft Security Response Center.
Windows File Explorer exposes sensitive information to low-privileged local authenticated users across a wide range of Windows 10, Windows 11, and Windows Server versions. Classified under CWE-200, the flaw enables an attacker already present on a system with standard user rights to access data they should not be permitted to view - no elevation of privilege or remote access is required. No public exploit code has been identified and CISA SSVC confirms no active exploitation, keeping real-world urgency moderate despite the broad affected product surface.
Windows File Explorer across all major Windows 10, Windows 11, and Windows Server releases exposes sensitive information to local authenticated users via a CWE-200 information disclosure flaw. An authorized attacker with low-privilege local access can read data they should not be permitted to access without any user interaction. No public exploit code has been identified at time of analysis and CISA SSVC confirms no observed exploitation, placing this squarely in routine patch-cycle priority despite the broad footprint of affected systems.
Windows File Explorer exposes sensitive information to locally authenticated, low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases. Classified under CWE-200, the flaw allows an authorized local attacker to read data they should not have access to through the File Explorer shell component. No public exploit code has been identified at time of analysis, EPSS sits at 0.36% (28th percentile), and CISA SSVC assesses exploitation as none and not automatable - indicating low urgency despite the high confidentiality impact recorded in the CVSS score.
Information disclosure in the Windows Overlay Filter (WofFilter) kernel-mode driver allows a locally authenticated low-privileged user to read sensitive data they are not authorized to access across Windows 10, Windows 11, and Windows Server 2016 through 2025. The flaw stems from CWE-200 (improper restriction of information to unauthorized actors) within the filter driver's handling of layered filesystem operations. No public exploit code has been identified and no active exploitation is confirmed; however, the high confidentiality impact (C:H) makes this a meaningful stepping stone in multi-stage attacks on shared or multi-tenant Windows systems.
Local information disclosure in Windows Universal Plug and Play (upnp.dll) exposes sensitive memory contents to authorized low-privilege users across a wide range of Windows 10, Windows 11, and Windows Server releases. The flaw stems from use of an uninitialized resource (CWE-908), meaning the UPnP service reads from memory that has not been properly initialized before use, potentially leaking stale heap or stack contents. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Windows Print Spooler Components on multiple Windows 10, 11, and Server editions contain a buffer over-read flaw (CWE-126) that allows a locally authenticated attacker with low privileges to disclose sensitive memory contents. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local access and a standard user account, limiting the attack surface to insiders or already-compromised endpoints. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.30% (22nd percentile) alongside SSVC exploitation status of 'none' together indicate low near-term exploitation probability.
Privilege escalation via physical attack in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects all major Windows 10, Windows 11, and Windows Server releases through 2025. The use-after-free memory corruption flaw (CWE-416) in the kernel-mode driver allows an attacker with physical access to the device to escalate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability compromise. No public exploit code has been identified and CISA has not listed this in KEV, but the SSVC assessment notes total technical impact - the physical access requirement is the primary limiting factor, not the vulnerability's severity once that barrier is cleared.
Remote code execution in the Windows DNS Server component allows an authorized, high-privileged attacker on an adjacent network to traverse outside intended directory boundaries and execute arbitrary code on the target host. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10 versions 1607 and 1809. No public exploit code exists and no active exploitation has been confirmed - CISA SSVC classifies exploitation as 'none' and EPSS sits at 0.37% (29th percentile) - however SSVC rates technical impact as 'total', consistent with the full C:H/I:H/A:H CVSS triad.
Out-of-bounds memory read in the Windows Desktop Window Manager (DWM) Core Library enables a locally authenticated, low-privileged user to disclose sensitive memory contents across a wide range of Windows client and server versions. The flaw is reachable by any standard user account without administrative rights, making it relevant in multi-user, shared workstation, and terminal services environments. No active exploitation is confirmed - CISA SSVC rates exploitation as 'none', EPSS sits at 0.31% (22nd percentile), and no KEV listing exists - but the broad affected surface spanning Windows 10 through Windows 11 and Server 2025 warrants timely patching.
Windows Cryptographic Services across all supported Microsoft Windows client and server editions exposes sensitive cryptographic material to locally authenticated low-privilege users through a CWE-200 information disclosure flaw. Spanning Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, the vulnerability allows an attacker with a standard local account to read confidential data - likely cryptographic keys, certificates, or intermediate cryptographic state - without any user interaction. SSVC rates exploitation as none, EPSS at 0.47% (38th percentile) indicates low near-term exploitation probability, and no active exploitation has been confirmed by CISA KEV, positioning this as a routine patch-cycle priority rather than an emergency response.
Local information disclosure in Windows Notification affects authenticated users across a wide range of Microsoft Windows 10, Windows 11, and Windows Server releases. An attacker with low-privilege local access can exploit this CWE-200 flaw to read sensitive data that should be inaccessible to their account, with no user interaction required. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patched builds addressing all affected versions.
Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to network-adjacent attackers due to use of an uninitialized resource (CWE-908), resulting in high-confidentiality information disclosure. The flaw affects a broad swath of supported Windows client and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - and requires victim user interaction (UI:R per CVSS) to trigger, limiting automated mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation as 'none' with non-automatable technical impact, suggesting this is a real but not imminently weaponized risk.
Out-of-bounds read in the Windows Cloud Files Mini Filter Driver (cldflt.sys) exposes kernel memory contents to local attackers with standard user privileges. Affected across Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019 through 2025, the vulnerability allows an authorized local account to read beyond allocated buffer boundaries in the driver that underpins cloud sync features such as OneDrive Files On-Demand. No public exploit identified at time of analysis; EPSS is 0.31% (22nd percentile) and SSVC rates exploitation as none, making this a moderate patch priority rather than an emergency response.
Security feature bypass in the Windows System component on Windows 11 and Windows Server allows an authenticated local attacker with standard user privileges to circumvent an access control protection, yielding high confidentiality exposure and limited integrity impact. Affected platforms span Windows 11 versions 24H2 through 26H1 and Windows Server 2022 and 2025. No public exploit has been identified and CISA SSVC rates exploitation as none with non-automatable delivery, making this a moderate-priority local threat despite the high confidentiality impact signal in the CVSS vector.
Windows Win32K in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to local authenticated attackers through an information disclosure flaw classified as CWE-200. The vulnerability requires only low-privilege local access and yields partial confidentiality impact with no integrity or availability consequences, consistent with the CVSS 3.3 Low rating. No public exploit identified at time of analysis, and CISA SSVC assessment confirms no known exploitation, non-automatable attack pattern, and only partial technical impact - making this a low real-world priority outside multi-tenant or shared-access environments.
Null pointer dereference in Active Directory Domain Services (AD DS) on Windows allows an authenticated, network-adjacent attacker to crash the service and deny domain authentication to all dependent users and systems. Affecting Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2025, this vulnerability carries a CVSS 6.5 with high availability impact. No public exploit identified at time of analysis and CISA SSVC assesses exploitation as none with non-automatable attack path, keeping real-world urgency at moderate despite the breadth of affected platforms.
Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 platforms contains an infinite loop flaw (CWE-835) that a remote unauthenticated attacker can trigger to exhaust service resources and cause a sustained denial of service. The attack requires high complexity (CVSS AC:H) but no authentication, targeting organizations that expose AD FS endpoints to the network. No public exploit code exists and CISA SSVC confirms no known exploitation at time of analysis; Microsoft has released patches across all affected platforms.
Integer overflow in the Windows Devices Human Interface (HID) subsystem enables a local, low-privileged attacker to disclose sensitive information on affected systems. The vulnerability spans Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025, representing a broad attack surface across Microsoft's supported OS portfolio. No public exploit code exists and CISA SSVC rates current exploitation as none, with an EPSS score of 0.30% (22nd percentile) confirming very low near-term exploitation probability.
Windows Push Notifications on multiple Windows 10, 11, and Server editions exposes sensitive information to low-privileged local attackers, who can read notification content or related data scoped to other users or higher-privilege contexts without any user interaction. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, with vendor-confirmed fixed build versions available via Microsoft Update. No public exploit exists and no active exploitation is confirmed - SSVC rates exploitation as none and EPSS sits at 0.36% (28th percentile) - making this a secondary patching priority unless operating shared multi-user Windows environments.
Sensitive information disclosure in Windows Push Notifications (WPN) permits a locally authenticated, low-privileged attacker to read confidential data they are not authorized to access. Affected systems span Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer footprint. No public exploit identified at time of analysis, EPSS sits at 0.36% (28th percentile), and CISA SSVC rates exploitation as none with non-automatable attack paths.
Sensitive information disclosure in Windows Push Notifications allows a locally authenticated standard user to access notification data they are not authorized to view across Windows 10, Windows 11, and Windows Server 2022/2025 platforms. The flaw (CWE-200) requires only low-privilege local access - no elevated rights or user interaction - making it exploitable by any interactive user on a vulnerable host. No public exploit code exists at time of analysis, and both EPSS (0.36%, 28th percentile) and SSVC (exploitation: none, automatable: no) signals indicate low near-term weaponization risk despite the high confidentiality impact rating.
Buffer over-read in the Windows NTFS kernel driver exposes adjacent memory contents to a local attacker holding a standard user account across a broad range of Windows 10, 11, and Server releases. Exploitation is constrained to AV:L/PR:L, meaning an attacker must already have interactive or programmatic local access before triggering the CWE-126 condition - making this a post-compromise reconnaissance primitive rather than an initial-access vector. EPSS stands at 0.31% (22nd percentile) and SSVC confirms no known exploitation activity, placing this at low operational urgency despite the High confidentiality impact rating.
Windows Kernel information disclosure across a broad range of Microsoft Windows 10, Windows 11, and Windows Server editions allows a locally authenticated low-privileged attacker to read sensitive kernel memory contents they are not authorized to access. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is confined to local exploitation with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing the issue across all affected version branches per EUVD-2026-43865.
Windows Cryptographic Services improperly validates certificates across multiple Windows 10, 11, and Server editions, enabling remote unauthenticated attackers to bypass security features enforced by the PKI/certificate trust chain over a network path. Affected platforms span Windows 10 21H2 and 22H2, Windows 11 24H2 through 26H1, and Windows Server 2022 and 2025 in both full and Server Core deployments. No public exploit identified at time of analysis; EPSS at 0.24% (15th percentile) and SSVC exploitation status of 'none' together indicate low near-term exploitation probability despite the broad product footprint.
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Integer underflow in the Windows Kernel enables a locally authenticated attacker to disclose sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server platforms. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privilege local user can trigger the flaw without special configuration or user interaction, yielding high confidentiality impact with no integrity or availability consequences. Microsoft has released a patch via the July 2026 Security Update Guide; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.
Sensitive information disclosure in the Windows Trusted Runtime Interface Driver permits a locally authenticated, low-privileged attacker to read protected data from the affected system. The flaw impacts Windows 10 (21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2025 across both full and Server Core installations. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; Microsoft has released patches resolving the issue.
Security feature bypass via improper privilege management (CWE-269) in Microsoft Windows DNS grants a locally authenticated attacker the ability to circumvent an unspecified security control, resulting in high integrity impact on affected Windows 11 and Windows Server 2025 systems. Affected platforms include Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No active exploitation has been confirmed by CISA KEV, EPSS probability is very low at 0.22% (13th percentile), and SSVC rates exploitation status as none - indicating this is a patched local-only issue without known active abuse.
Sensitive information disclosure in the Windows Kernel affects Windows 10 (versions 21H2 and 22H2), Windows 11 (versions 24H2, 25H2, and 26H1), and Windows Server 2022 and 2025, where the kernel writes sensitive data into log files that a low-privileged local user can access. An authorized attacker with a standard local account can read these log files to obtain sensitive kernel-level information, yielding high confidentiality impact with no integrity or availability consequence. No public exploit has been identified at time of analysis, and the EPSS score of 0.36% at the 28th percentile corroborates low near-term exploitation likelihood; Microsoft has released patches addressing all affected versions.
Privilege escalation to SYSTEM level is achievable in Windows Spaceport.sys - the kernel-mode Storage Spaces port driver - across a wide range of Windows 10, Windows 11, and Windows Server releases, when an attacker has physical access to the target machine. An integer overflow or wraparound in the driver's arithmetic logic (CWE-190) can corrupt kernel memory structures, enabling full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and SSVC confirms exploitation status as none, but the Technical Impact rating is total, meaning successful exploitation fully compromises the affected system.
Local information disclosure in Windows DirectX exposes sensitive data to unauthorized local actors across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-200) achieves high confidentiality impact per the CVSS vector while producing no integrity or availability impact, meaning an attacker gains read access to protected data without disrupting system operation. No public exploit has been identified at time of analysis; EPSS at 0.38% (30th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability despite the wide affected surface.
Uninitialized memory disclosure in the Windows SMB implementation enables a locally authenticated, low-privileged attacker to read sensitive contents from uninitialized kernel or heap buffers, achieving high confidentiality impact within the affected system. The vulnerability spans Windows 10 (from version 1607 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2012 through 2025 across both full and Server Core installation types. No public exploit code has been identified and CISA SSVC assesses exploitation status as none, placing this firmly in the patch-and-monitor category rather than emergency response.
Windows Kernel information disclosure across a broad range of Microsoft Windows desktop and server editions allows a local, unprivileged attacker to read sensitive kernel memory or system state not intended for user-space access. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N confirms local code execution with no special privileges is sufficient to trigger the flaw. EPSS sits at 0.38% (30th percentile) with no CISA KEV listing and SSVC exploitation status of 'none,' indicating no confirmed or publicly observed active exploitation at time of analysis; however, kernel information leaks of this class are routinely used to stage ASLR-bypass steps in multi-stage privilege escalation chains.
Privilege escalation to SYSTEM level is achievable in the Windows USB Video Class (UVC) driver across a broad swath of Windows 10, 11, and Server editions via physical connection of a malicious USB device. The heap-based buffer overflow (CWE-122) is triggered when the driver processes attacker-controlled UVC descriptors from a crafted device, corrupting kernel heap memory. No active exploitation is confirmed (absent from CISA KEV, SSVC exploitation=none), and EPSS sits at 0.37% (29th percentile), consistent with the physical access barrier that makes mass exploitation impractical.
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) enables physical attackers to disclose kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires plugging a crafted USB audio device into the target machine, making remote attack impossible by design. No public exploit exists and SSVC exploitation status is confirmed as none, though the High confidentiality impact rating reflects that kernel memory disclosure can expose sensitive in-memory data if triggered.
Link-following vulnerability in Windows upnp.dll (Universal Plug and Play) enables a locally authenticated attacker with standard user privileges to read files outside intended access boundaries by planting symbolic links or junction points that the service resolves without proper validation. Affected scope spans Windows 10 (versions 1607-22H2), Windows 11 (versions 24H2-26H1), and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis; EPSS of 0.27% (19th percentile) and CISA SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Windows Event Logging Service across a wide range of Windows 10, Windows 11, and Windows Server versions fails to enforce its intended protection mechanisms, permitting any authenticated low-privileged network user to read information that should be access-controlled. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only a valid low-privilege account and network connectivity, with no user interaction and no elevated rights - making it a practical post-compromise lateral-movement or reconnaissance tool. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, but the ubiquitous deployment footprint across the Windows ecosystem elevates organizational exposure.
Windows File Explorer on affected Microsoft Windows 10, Windows 11, and Windows Server platforms exposes sensitive information to locally authenticated low-privilege users without authorization. The CWE-200 root cause indicates inadequate access restrictions within the File Explorer shell component, enabling a user to read data beyond their authorization boundary. No public exploit exists and SSVC confirms no observed exploitation activity, but the broad Windows deployment footprint and high confidentiality impact (C:H) make this relevant for shared-access environments, terminal servers, and organizations with insider-threat concerns.
Windows File Explorer across a broad range of Windows 10, Windows 11, and Windows Server releases contains a use-of-uninitialized-resource flaw (CWE-908) that allows a low-privileged local attacker to read stale memory contents and disclose potentially sensitive information. The vulnerability is locally constrained (AV:L, PR:L) with no integrity or availability impact, and SSVC signals no known exploitation and no automatable attack path. EPSS at 0.31% (22nd percentile) and the absence of a CISA KEV entry collectively indicate low near-term exploitation likelihood despite the wide deployment footprint of the affected OS.
Windows Audio Service on multiple Windows desktop and server versions improperly exposes sensitive information to locally authenticated standard users, enabling information disclosure without requiring elevated privileges. Affecting Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 (with Server 2022 and 2025 referenced in tags), the flaw is exploitable post-foothold by any low-privileged local account, making it a realistic post-exploitation pivot rather than an initial access vector. No public exploit code has been identified at time of analysis, and a vendor-released patch is confirmed available via the Microsoft Security Response Center.
Windows File Explorer on virtually all supported Microsoft Windows desktop and server editions leaks sensitive information to locally authenticated low-privileged users, classified under CWE-200. The flaw allows a local attacker holding only a standard account to access data that should be restricted to higher-privileged processes - with no user interaction required (UI:N) and low attack complexity (AC:L). Despite the high confidentiality impact in the CVSS vector, EPSS sits at just 0.36% (28th percentile) and SSVC confirms exploitation as 'none' and the attack as not automatable, placing this firmly in the category of a patch-cycle priority rather than an emergency response. No public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Windows Remote Desktop Protocol (RDP) client leaks sensitive memory contents due to use of an uninitialized resource (CWE-908), allowing a network-accessible attacker to disclose potentially high-value information from a victim's system. Exploitation requires user interaction - a victim must connect to an attacker-controlled RDP endpoint - making this a client-side information disclosure attack affecting Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2012 through 2025. No public exploit code has been identified and no active exploitation is confirmed; however, the CVSS confidentiality impact is rated High, meaning exposed memory could include credentials or session tokens.
Information disclosure via uninitialized memory in the Windows SMB driver stack affects a broad range of Windows 10, Windows 11, and Windows Server versions. A locally authenticated, low-privileged attacker can trigger a code path that reads from uninitialized memory within the SMB subsystem, potentially leaking sensitive kernel or heap memory contents. No public exploit code or active exploitation has been identified at the time of analysis; Microsoft has released a patch via MSRC.
Privilege escalation via use-after-free in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, requiring physical access to exploit. An attacker with hands-on access to a target machine can trigger a memory corruption condition through the USB print subsystem to achieve full local privilege escalation - High confidentiality, integrity, and availability impact per CVSS. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Missing authentication enforcement in the Microsoft Windows DNS component allows a low-privileged local attacker to tamper with DNS configuration or records without requiring elevated credentials. Affected platforms span Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025 - a broad deployment footprint across enterprise environments. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' with partial technical impact, but the high integrity impact (CVSS I:H) warrants attention in multi-user environments and on DNS server infrastructure where record integrity is critical.
Privilege escalation to full system control is achievable in Windows Storage Spaces Direct via a CWE-190 integer overflow that causes arithmetic wraparound, exploitable by an attacker with physical access to affected hardware. The flaw spans Windows 10 (versions 1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2016 through 2025, representing a broad Microsoft platform footprint. Despite the C:H/I:H/A:H impact profile confirmed by SSVC as 'technical impact: total,' the physical access prerequisite (AV:P) is a hard constraint; SSVC additionally confirms exploitation status as none, no public exploit code exists, and EPSS sits at 0.31% (23rd percentile), making this a low operational priority for most organizations.
Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock (afd.sys) enables a locally authenticated, low-privilege attacker to intercept or read sensitive data that the driver handles without adequate protection. Affected platforms span Windows 10 (multiple versions), Windows 11, and Windows Server 2012 through 2025 as confirmed by EUVD version data and Microsoft CPE strings. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.21% (11th percentile), and CISA SSVC classifies this as no active exploitation with non-automatable attack paths, positioning this as a low-urgency but meaningful local disclosure risk.
Windows Media on multiple Windows client and server editions exposes sensitive information to authenticated local users, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad footprint of Microsoft's supported OS ecosystem. No active exploitation has been identified at time of analysis - the vulnerability is absent from CISA KEV, EPSS sits at 0.36% (28th percentile), and SSVC assesses exploitation status as none - making this a patch-and-monitor priority rather than an emergency response.
BitLocker's protection mechanism on Windows fails to enforce a critical authentication or verification step, permitting a physically present attacker to bypass full-disk encryption without credentials, a recovery key, or elevated privileges. Despite a CVSS score of 6.8 (Medium) - moderated by the physical access requirement - the impact ratings are High across confidentiality, integrity, and availability, meaning successful exploitation grants complete access to encrypted data and the underlying system. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library exposes sensitive memory contents to locally authenticated, low-privileged attackers on Windows 11 and Windows Server 2025. The flaw (CWE-125) allows a standard user to read beyond an allocated buffer boundary within the DWM process, resulting in high-confidence information disclosure with no integrity or availability impact. Microsoft has released patches covering all affected build ranges; no public exploit code has been identified at time of analysis.
Security feature bypass in Microsoft Windows BitLocker allows an attacker with physical access to circumvent the drive encryption protection mechanism. Affected systems can have BitLocker-protected data accessed despite the encryption-at-rest control being enabled, undermining a core platform confidentiality boundary. There is no public exploit identified at time of analysis, but the vulnerability is reported by Microsoft (secure@microsoft.com) as a protection mechanism failure with high impact across confidentiality, integrity, and availability.
BitLocker drive encryption on Windows can be bypassed by a physically present, unauthenticated attacker, exposing protected volume contents with high confidentiality impact. Classified as CWE-693 (Protection Mechanism Failure), the flaw undermines BitLocker's core threat model - data-at-rest protection - across a wide range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions; however, the physical access requirement means organizations with mobile or physically accessible systems should treat this as a higher operational priority than the CVSS score alone implies.
Spoofing via improper input validation affects Microsoft Azure Attestation service and the Device Health Attestation Service component across a broad range of Windows OS versions, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. An authorized attacker with high privileges and physical access to the target device can manipulate attestation inputs to spoof device health or platform integrity status, achieving a high-integrity impact with no confidentiality or availability consequence. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the CVSS score of 3.9 (Low) reflects the significant physical and privilege barriers to exploitation.
Out-of-bounds read in the Windows DHCP Server service enables a locally authenticated, low-privileged attacker to disclose contents of process memory on affected systems. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges - no elevated rights or user interaction needed. Exploitation is constrained to hosts where the Windows DHCP Server role is actively installed and running, which significantly limits the attack surface to designated infrastructure servers rather than general workstations. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Out-of-bounds read in Windows DHCP Server exposes adjacent memory contents and can crash the service, yielding both information disclosure and a high-severity denial-of-service condition on affected Windows systems. The flaw (CWE-125) is exploitable locally with low attack complexity and no user interaction, targeting systems where the DHCP Server role is installed across a broad range of Windows 10, 11, and Server editions from 2012 through 2025. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via the MSRC update guide (CVE-2026-45608).
Out-of-bounds read in Microsoft's UxTheme Library (uxtheme.dll) enables a locally authenticated attacker to crash the affected Windows system, resulting in denial of service. The vulnerability spans a broad swath of Windows releases - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management critical for enterprise environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds read in the Windows Application Identity (AppID) Subsystem exposes sensitive kernel or process memory to a local authenticated attacker without requiring elevated privileges or user interaction. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2025, including Server Core installations. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog, though the high confidentiality impact (CVSS C:H) indicates meaningful data exposure potential when triggered.
Mark of the Web (MOTW) protection mechanism failure across a broad range of Windows client and server releases allows unauthenticated network-based attackers to deliver files that evade the Zone.Identifier security tag, bypassing downstream defenses such as SmartScreen and Office Protected View that depend on MOTW presence. User interaction is required to trigger the bypass, limiting automated mass exploitation. No public exploit code exists and CISA has not listed this in KEV; however, the breadth of affected Windows versions - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - gives this vulnerability significant surface area as a link in social-engineering attack chains.
Information disclosure in the Windows Application Identity (AppID) Subsystem exposes sensitive data to locally authenticated, low-privileged attackers across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires only a local session with standard user privileges - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide affected surface spanning consumer and server SKUs makes patching a meaningful priority in multi-user or shared-system environments.