Buffer Overflow

Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.

Heap-based buffer overflow in the Windows Local Security Authority Server (lsasrv.dll) enables an authenticated local attacker to escalate privileges to SYSTEM on affected Windows Server 2025 and Windows 11 systems. The vulnerability resides in a core authentication and security-policy component running under the lsass.exe process, making successful exploitation effectively equivalent to full system compromise. No public exploit identified at time of analysis; vendor patch is available via Microsoft Update.

Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.

Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.

Remote code execution in Microsoft Windows PDF rendering affects a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds, where an integer overflow while parsing a crafted PDF wraps a size calculation and triggers a heap-based buffer overflow (CWE-122). An unauthenticated attacker who delivers a malicious PDF over the network can execute arbitrary code with the privileges of the rendering process. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.

Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.

Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.

Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.

Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.

Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.

Heap-based buffer overflow (CWE-122) in Microsoft Office Word enables unauthenticated remote code execution when a victim opens a specially crafted document. All currently supported Office product lines are affected across Windows (x86/x64) and macOS, including Microsoft 365 Apps for Enterprise, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 for Mac. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected products and full C/I/A impact make this a high-priority patching item across virtually all enterprise environments.

Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in the Windows Camera Frame Server Monitor service enables a local authenticated user to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025. Exploitation requires only a standard user account and no user interaction, making it a reliable post-exploitation privilege escalation primitive. Microsoft has released patches addressing all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.

Local privilege escalation in Windows Spaceport.sys (the Storage Spaces kernel driver) allows a low-privileged authenticated attacker to achieve full system compromise via a numeric truncation error that triggers a heap-based buffer overflow. The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature updates, with fixed build numbers confirmed by Microsoft through MSRC. No public exploit identified at time of analysis, but the local LPE class in kernel drivers is historically a high-priority target for post-exploitation toolkits.

Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a user opens a specially crafted Access database file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network delivery requiring only a single user interaction - consistent with a malicious file attachment or download attack pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) and broad affected version range spanning Office 2016 through Microsoft 365 Apps make this a high-priority patch-cycle item.

Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. Microsoft has released patches for all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.

Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.

Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.

Heap-based buffer overflow in Spaceport.sys, the kernel-mode driver that backs Windows Storage Spaces, lets an attacker who already holds low-privileged authenticated access elevate to kernel-level privileges on affected Windows 10, Windows 11 and Windows Server builds. Successful exploitation yields total impact across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with code execution in kernel context, and no user interaction is required beyond the attacker's existing session. The flaw is not listed in CISA KEV, SSVC records exploitation as 'none' and the attack as non-automatable, and no public exploit code has been identified at time of analysis; EPSS is a modest 0.77% (53rd percentile), so real-world risk is currently driven by targeted post-compromise privilege escalation rather than mass exploitation.

Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.

Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.

Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.

Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.

Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.

Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.

Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.

Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.

Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.

Privilege escalation to SYSTEM-level via a heap-based buffer overflow in the Windows Partition Management Driver affects multiple Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker with low privileges can exploit the CWE-122 heap overflow to achieve full confidentiality, integrity, and availability impact on the local system. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.

Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.

Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.

Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.

Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.

Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.

Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.

Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.

Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.

Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.

Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.

Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.

Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.

Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.

Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.

Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.

Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.

Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.

Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.

Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.

Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.

Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.

Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.

Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.

Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.

Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.

Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.

Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.

Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.

Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.

Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.

Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.

Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.

Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.

Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.

Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.

Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.

Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.

Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.