Buffer Overflow

Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.

Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.

Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.

Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.

Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.

Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.

Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.

Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.

Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.

Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.

Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.

Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.

Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.

Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.

Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.

Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.

Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.

Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.

Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.

Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.

Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.

Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.

Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.

Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.

Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.

Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.

Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.

Remote code execution in Microsoft Outlook results from a stack-based buffer overflow triggered when a victim opens or previews a maliciously crafted email/message. The flaw affects Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise, with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and no privileges required. This is a high-priority issue, though not the absolute top tier of urgency, because user interaction is required; no public exploit identified at time of analysis, and vendor patches are available.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute arbitrary code locally when a user opens a specially crafted workbook. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before version 16.0.14334.20974, and Microsoft Office LTSC 2024 before version 16.0.17932.21056. Exploitation requires user interaction (UI:R) to open the malicious file; no public exploit identified at time of analysis, and the issue is considered a credible patch-priority item rather than an emergency. Code execution occurs in the context of the user opening the file, so a low-privilege user context limits downstream impact.

Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.

Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.

Heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute arbitrary code in the context of the victim when the victim opens a crafted Word document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office LTSC/365 for Mac 2021/2024. Microsoft has released vendor patches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. User interaction (opening the document) is the primary limiting factor, and code execution is confined to the user's security context (S:U).

Opening a specially crafted document in an affected Microsoft Word build triggers a heap-based buffer overflow that lets an attacker execute code in the context of the user who opened the file. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise installations older than the current fixed release. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack requires the victim to open the malicious file, but no attacker credentials or prior privileges are needed; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.

Stack-based buffer overflow in Microsoft Office Word enables a local, authenticated user to elevate privileges to the level of the affected process, resulting in high confidentiality, integrity, and availability impact on the host (CVSS 3.1 base 7.8 HIGH). Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office LTSC/365 for Mac. A vendor patch is available; no public exploit code or confirmed active exploitation has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.

Remote code execution in the optional Microsoft Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) allows an unauthenticated, remote attacker to run arbitrary code in the context of the victim user by supplying a malformed RAW image file. Exploitation requires user interaction (CVSS UI:R) - the victim must open, preview, or let Explorer generate a thumbnail for the crafted file, which can be delivered via email, web download, or a network share - and requires the optional codec to be installed, since it is not present on default Windows installations (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor patch data indicates a fix is available. Overall this is a credible, patch-worthy priority but not a drop-everything emergency, given the dependency on the optional codec and on victim interaction with the malicious file.

Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged access on a target host trigger a heap-based buffer overflow and execute code at a higher integrity level, up to full system rights (CVSS 7.8, AV:L/PR:L/UI:N). Unpatched Windows 10 builds from 1607 through 22H2, Windows 11 builds from 23H2 through 26H2, and Windows Server 2012 through 2025 are affected below the fixed revisions tracked in EUVD-2026-100258. No public exploit code has been identified at time of analysis, but vendor-released patches are available, making this a genuine patching priority for any endpoint or server where an attacker could obtain a local foothold.

Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.

Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.

A heap-based buffer overflow in the Windows PCI Bus Driver lets an authenticated local attacker with only low privileges escalate to kernel-level code execution on affected Windows hosts, giving total loss of confidentiality, integrity, and availability (CVSS 8.8, scope-changed). Exploitation requires an existing low-privilege local session (AV:L/PR:L, UI:N) and the ability to invoke the driver with malformed input - there is no remote or network path, and CISA's SSVC assessment rates the issue as not automatable with exploitation: none. No public exploit code has been identified at time of analysis and there are no reports of active exploitation, but the driver is a default, always-present kernel component on every supported Windows client and server build, so the vulnerable surface is ubiquitous and the payload is high-impact once a foothold exists - making this a credible but non-urgent prioritization.

Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.

Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.

Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.

Heap-based buffer overflow in Windows Kernel allows a low-privileged local attacker to elevate privileges on affected Windows 10, Windows 11, and Windows Server installations. Exploitation requires the attacker to already run code as a low-privileged local user; there is no remote trigger and no user interaction is required. No public exploit code has been identified at time of analysis, and vendor patches are available.

Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.

Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.

An out-of-bounds read in the Windows NTFS file system driver allows a locally authenticated attacker holding a low-privileged session to execute code with elevated privileges on the affected host. The flaw is triggered when NTFS processes attacker-influenced on-disk structures or volume metadata, giving a crafted or tampered NTFS volume a path to corrupt driver state within kernel context. Impact is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the vector is local-only with PR:L this is a privilege-escalation and post-exploitation primitive rather than an initial-access vector; no public exploit code and no confirmed active exploitation were identified at time of analysis. A vendor fix is available, and systems patched to the builds listed by Microsoft are not affected.

An out-of-bounds read in the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services allows an unauthenticated remote attacker to crash the SCEP enrollment endpoint on affected Windows servers, producing a denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only hosts where the optional NDES role is installed and reachable over the network are exposed, spanning Windows Server 2012 through Windows Server 2025 plus Windows 10 versions 1607 and 1809, and Microsoft has published vendor fixes for these builds. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and real-world exposure is bounded because NDES is a deliberately deployed, non-default role rather than a component present on every Windows server.

Local privilege escalation in Microsoft Windows Storage Spaces is possible through an out-of-bounds read in Spaceport.sys, the kernel-mode driver that backs Storage Spaces and related storage-pool functionality. An attacker who already holds a low-privileged, authenticated session on the host (AV:L, PR:L, UI:N per CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) can reach the driver through local device/IOCTL interaction and trigger the flaw, with high impact to confidentiality, integrity and availability - effectively full system compromise once code execution is achieved. The vulnerability affects essentially all supported Windows client and server branches that ship the driver, and is not remotely exploitable; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, so it is primarily a post-compromise escalation risk rather than an initial-access vector. Microsoft has published a security update (MSRC advisory CVE-2026-96862), tracked in the EU as EUVD-2026-99778.

Out-of-bounds memory reads in Microsoft's Network Device Enrollment Service (NDES) allow a remote, unauthenticated attacker to disrupt certificate-enrollment service by sending crafted requests to a reachable SCEP endpoint, yielding a denial-of-service condition rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exposure is narrow in practice: NDES is an optional Active Directory Certificate Services role that is not present in a default Windows Server installation, so only hosts where the role has been deployed and its HTTP/HTTPS SCEP interface is network-reachable are at risk, and the vector requires no authentication, privileges, or user interaction. Impact is confined to availability - the assessed vector shows no confidentiality or integrity loss - and no public exploit identified at time of analysis, though vendor patches are available for all affected builds.

Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).

Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.

Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.

Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.

Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.

Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.

Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.

An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.

An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.

Out-of-bounds write in Microsoft .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio 2022/2026 can allow an unauthenticated remote attacker to execute code when a victim processes crafted input, per CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). This is a genuinely high-priority, patch-worthy flaw but with important caveats that lower its real-world urgency relative to its 8.8 CVSS: exploitation requires user or application interaction to process the malicious input, and no public exploit has been identified at time of analysis. Vendor-released patches are available as .NET 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2, plus Visual Studio 17.14.42 and 18.10.4.

An out-of-bounds write (CWE-787) in ASP.NET Core and the associated .NET runtimes lets a remote, unauthenticated attacker trigger memory corruption that crashes or destabilizes a network-reachable service, yielding a full loss of availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires no credentials, no user interaction, and no special configuration - only that the target endpoint be reachable and running an unpatched build (for example .NET 8.0 below 8.0.32, .NET 9.0 below 9.0.21, or .NET 10.0 below 10.0.13). There is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as "none" while marking the flaw fully automatable, so scripted denial-of-service attempts remain a plausible near-term risk; vendor patches are available.

An out-of-bounds read in the .NET runtime and toolchain (CVE-2026-96232) allows an unauthenticated, remote attacker to read memory beyond intended buffer boundaries and disclose its contents over the network, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected builds are .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2, plus applications developed with Microsoft Visual Studio 2022 before 17.14.42 and Visual Studio 2026 before 18.10.4. Only confidentiality is impacted - there is no code execution, privilege escalation or data modification - and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none while noting the attack is automatable, and intelligence sources indicate a vendor patch is available. The practical risk depends entirely on whether a vulnerable .NET application exposes the affected code path to untrusted network input, so internet-facing services built on the unpatched runtimes are the priority targets.

Remote code execution in Microsoft .NET allows an unauthenticated attacker to execute arbitrary code when a legitimate user opens or loads crafted content that triggers an out-of-bounds write in the runtime. The flaw affects a broad range of .NET Framework versions (3.5 through 4.8.1), modern .NET 8.0, 9.0, 10.0, and 11.0 preview, plus Visual Studio 2022 and 2026. No public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates the issue as non-automatable, though the mandatory user interaction and wide deployment make patching critical for unpatched systems.

Remote code execution in Microsoft Windows Local Security Authority Subsystem Service (LSASS) affects multiple Windows 10, Windows 11, and Windows Server builds, allowing an unauthenticated network attacker to trigger an out-of-bounds write that can lead to code execution with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and exploitation requires only network reachability to an exposed LSASS interface on an unpatched host. No public exploit was identified at time of analysis and CISA SSVC records Exploitation: none and Automatable: no, but the unauthenticated remote vector makes this a top-priority vulnerability to patch; Microsoft has released a vendor patch.

Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.

Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.

A heap-based buffer overflow in the optional Microsoft Windows Raw Image Extension allows remote code execution in the context of the invoking process when a user opens or previews a crafted RAW image file. Affected versions are 2.1.0.0 up to but not including 2.4.36.0; because exploitation requires user interaction (UI:R) with a malicious file and is not automatable, systems that do not have the extension installed are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.

Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.

Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.

Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.

Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.

A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.

Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.

Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code in the context of the victim user, but only if that user is convinced to open a specially crafted document (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected installations span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC 2021/2024 plus Office 365 for Mac, so both Windows and macOS environments are in scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory user interaction (UI:R) - together with Protected View and untrusted-document blocking - is the principal factor limiting real-world exposure; this is a credible prioritization candidate rather than a top-tier emergency on current signals. Microsoft has released vendor patches addressing the flaw.

Remote code execution in Microsoft Office allows an unauthenticated attacker to execute arbitrary code by convincing a user to open a specially crafted document. This heap-based buffer overflow affects Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Mac versions of Office LTSC 2021/2024 and Office 365 for Mac. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the vulnerability is high-priority due to total technical impact and network attack vector; patching is available from Microsoft.

Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.

Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.

Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.

Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.

Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.

Remote code execution in Microsoft Word for Windows and macOS is possible through a heap-based buffer overflow (CWE-122) that is triggered when an affected Office build processes a specially crafted Word document delivered over a network, typically as an email attachment or a web download. The vulnerability is unauthenticated (PR:N) but requires user interaction: the victim must open the malicious document, and the AC:H rating reflects that the attacker must achieve reliable heap layout and grooming to convert the memory corruption into code execution. When successful the outcome is total loss of confidentiality, integrity and availability on the victim's system, although no public exploit code has been identified and CISA's SSVC review records no active exploitation and no automatable path, making this a targeted-attack risk rather than a wormable or mass-exploitation event. Microsoft has released patched builds for the affected Windows and macOS channels.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged attacker who already holds an interactive or authenticated session on a Windows host to trigger an out-of-bounds read in the compositor and elevate to a higher-integrity context. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): no user interaction or remote reach is required, but the local authenticated session is a hard prerequisite, which confines exposure to hosts where an attacker has already gained an initial foothold. Microsoft has released patch builds for all affected servicing branches and there is no public exploit code identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, making this a credible but not emergency-grade priority rather than an actively exploited Windows elevation-of-privilege bug.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated local user who already has low-privileged code execution on a Windows host to elevate their privileges (CVSS 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-125 out-of-bounds read). Affected are unpatched Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H2) and Windows Server 2019/2022/2025 installations, including Server Core builds, since the DWM Core Library is present and active by default on every supported installation. Exploitation status: no public exploit identified at time of analysis, CISA SSVC rates Exploitation as none and Automatable as no, and the attack is per-host, requires prior local code execution, and is not remote or network-facing; a vendor patch is available and hosts updated to the fixed builds are not affected.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged user who already has code execution on the host to trigger an out-of-bounds read in the compositor and, per the assessed CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H), achieve high confidentiality, integrity and availability impact in DWM's more privileged context. Every default installation of the affected Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025 builds - including Server Core - carries the vulnerable component, but the flaw is not remotely reachable and requires an existing local foothold as an authenticated user. No public exploit code has been identified at time of analysis and CISA's SSVC records no observed exploitation, making this a post-compromise escalation step rather than an initial-access vector; Microsoft has shipped patched builds and a fix is available via the MSRC update guide.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.

Local privilege escalation in the Windows Bind Filter Driver (BindFlt), a kernel-mode component shipped by default across supported Windows client and server editions, lets an already-authenticated low-privileged attacker trigger a heap-based buffer overflow and gain elevated (SYSTEM) code execution on the host. Exploitation requires a pre-existing local foothold - the CVSS vector is AV:L/PR:L/UI:N - so this is a post-compromise escalation primitive rather than a remotely reachable entry point, and it carries a high technical impact (total loss of confidentiality, integrity and availability on the affected machine). No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', so this is a credible but not emergency-tier patching priority; Microsoft has released fixed builds for every affected edition and organizations should fold them into normal cumulative-update cycles, prioritizing multi-user and high-value hosts.