Buffer Overflow

Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.

An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.

Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.

Remote code execution in the Windows Background Intelligent Transfer Service (BITS) affects a default-enabled component present on Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), an attacker who already holds a low-privilege account or foothold can send crafted requests to BITS over the network without user interaction and achieve high confidentiality, integrity, and availability impact within the service's own privilege context (scope unchanged); note that the vendor description's 'unauthorized attacker' phrasing conflicts with the PR:L rating and should be reconciled against the MSRC advisory. There is no confirmed active exploitation and no public exploit identified at time of analysis (CISA SSVC exploitation: none, automatable: no), but technical impact is rated total and a vendor patch is available, making this a high-priority patch target.

Heap-based buffer overflow in OpenSSH for Windows can let an unauthenticated network attacker execute code, but the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the independent assessment indicate the victim must initiate the vulnerable SSH operation, likely by using an affected Windows OpenSSH client against an attacker-controlled or compromised SSH server. Affected builds span Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 as enumerated in EUVD-2026-99587; Microsoft has released patched builds through the MSRC update guide. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none and Automatable as no, so risk is gated by user interaction and the need for the victim to connect to attacker-influenced infrastructure.

Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.

Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.

Local privilege escalation in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authenticated, low-privileged user on an affected host to trigger a heap-based buffer overflow and obtain high-integrity code execution in the context of the vulnerable service (CVSS 7.8, CWE-122). Exploitation requires a pre-existing local foothold with valid low-privileged credentials (AV:L/PR:L) and no user interaction (UI:N), so the flaw functions as a privilege-escalation link in a post-compromise chain rather than a remote entry point; there is no CISA KEV listing and no public exploit code identified at time of analysis. Microsoft has shipped a vendor patch, and ENISA EUVD tracks the issue as EUVD-2026-100095, making this a moderate-but-real priority concentrated on multi-user, RDP/terminal, and Windows Server hosts where untrusted local principals exist.

Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code on a victim's machine when the target opens a specially crafted workbook, delivered over a network via email attachment, web download, or a shared file. The flaw is a heap-based buffer overflow (CWE-122) in affected Office builds, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no authentication or prior access is required, but the attacker is dependent on the victim opening the file, which is why CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, and the listed macOS Office editions prior to their fixed builds. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so this is a high-priority but not top-of-queue patch item; no EPSS probability was supplied with the source data.

Memory corruption in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged attacker to execute arbitrary code over the network, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. Because BITS is a default-enabled core component of every supported Windows client and server edition listed in the EUVD data, no feature toggle has to be turned on for exposure - but the CVSS vector's PR:L metric means the attacker must already hold a low-privileged foothold, and CISA's SSVC assessment marks the flaw as not automatable, so no wormable mass-exploitation path is indicated. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available, making this a high-priority but not emergency-outbreak patching target.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker with low-privileged local access to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction (UI:N), and is not remotely reachable or automatable at scale per CISA SSVC (Automatable: no). Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none).

Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker with low-level privileges to exploit a memory corruption flaw and gain higher privileges on affected Windows client and server systems. The vulnerable BITS component is default-enabled and reachable without non-default configuration, but exploitation requires a pre-existing local foothold and no user interaction, with no remote or network vector. Vendor patch is available; no public exploit identified at time of analysis, and the independent assessment rates this as a credible but not emergency-level priority.

An out-of-bounds read (CWE-125) in Microsoft's Windows Server 'Server for NFS' role can be triggered by a remote, unauthenticated attacker sending crafted network requests, and Microsoft rates it as potentially leading to remote code execution with full confidentiality and integrity impact. The flaw affects the optional NFS server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 as well as Windows 10 1607 and 1809 builds below the patched revisions, so hosts that have never installed the Server for NFS feature are not exposed. No public exploit code has been identified and CISA SSVC records exploitation as 'none' and automatable as 'no', which is consistent with the CVSS UI:R requirement for user interaction; the high base score (8.8) alongside those low exploitation signals is a conflict that defenders should weigh when prioritising, with patched builds available from Microsoft.

Local privilege escalation in Microsoft Windows Graphics Kernel allows an authenticated local attacker with low privileges to gain elevated (likely SYSTEM) privileges by triggering a heap-based buffer overflow. Affected versions include Windows 11 24H2, 25H2, and 26H2 prior to builds 10.0.26100.9711, 10.0.26200.9711, and 10.0.26300.9711 respectively, and Windows Server 2025 (including Server Core) prior to 10.0.26100.33650. No public exploit code or active exploitation has been identified, and the high attack complexity (AC:H) suggests exploitation requires precise heap grooming or winning a race condition, reducing reliability.

Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.

Local privilege escalation in the Windows 11 Virtualization-Based Security (VBS) Enclave allows an attacker who already holds low-privileged, authorized code execution on a host to trigger an integer overflow (CWE-190) and gain full control over confidentiality, integrity, and availability of that machine. Only unpatched Windows 11 builds 23H2, 24H2, 25H2, 26H1, and 26H2 with VBS enabled are affected; the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local-only, post-compromise escalation with no user interaction and no remote exposure. Vendor-released patches are available from Microsoft, and no public exploit identified at time of analysis.

Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.

Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.

Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.

Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.

Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.

Local privilege escalation in Microsoft's Windows Resource Management (MRM) component lets an authenticated attacker who already holds low-level privileges on a host trigger an integer overflow (CWE-190) and elevate to higher integrity, with full impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote - it requires an existing local foothold - but needs no user interaction and has low attack complexity, so once any code execution or interactive access is obtained on an unpatched build, escalation is straightforward. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds below the vendor's fixed revision levels are affected; there is no public exploit code identified and no confirmed active exploitation (no CISA KEV listing) at time of analysis, although vendor patches are available.

Local privilege escalation in Windows Winlogon (CVE-2026-87699) allows an attacker who already holds an authenticated low-privileged session on a target machine to trigger a heap-based buffer overflow in the Winlogon process and elevate to full SYSTEM-level privileges, yielding high confidentiality, integrity, and availability impact on that host. The flaw affects a broad set of Windows 10, Windows 11, and Windows Server 2012 through Server 2025 builds below the fixed revisions published by Microsoft (for example Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, and Windows Server 2016 below 10.0.14393.9612), and the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores it 7.8. There is no public exploit identified at time of analysis, and CISA's SSVC records exploitation as 'none', but the fully local, no-user-interaction attack path makes this an effective post-compromise escalation step for an attacker already present on a host.

Local privilege escalation in the Windows Reliable Multicast Transport Driver (RMCAST, pgm.sys) lets an attacker who already holds low-privileged local access on a vulnerable host win a time-of-check time-of-use race and elevate to SYSTEM-level execution. The flaw is not remotely reachable: exploitation requires a pre-existing local, authenticated foothold (AV:L/PR:L) and must be repeated many times to reliably hit the narrow check/use window (AC:H), but a successful race yields full confidentiality, integrity, and availability impact. Microsoft has released fixed builds for the affected Windows 10, Windows 11, and Windows Server branches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and no EPSS score was supplied with the source data.

Heap corruption in the Microsoft Windows Shell allows an unauthenticated remote attacker to execute arbitrary code in the context of a user who opens or interacts with attacker-supplied Shell content, such as a crafted file, link, or shell item. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is gated by mandatory user interaction and CISA's SSVC assessment records exploitation as 'none' and the attack as not automatable, so it is best suited to targeted social-engineering delivery rather than unattended mass exploitation; no public exploit identified at time of analysis. The affected build range is broad, covering Windows 10, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025.

Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.

Heap-based buffer overflow in the Windows Volume Manager Extension Driver lets an unauthenticated remote attacker execute code in kernel context on affected default Windows installations, scoring CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released a vendor patch, and CISA's SSVC assessment rates the flaw as automatable with total technical impact, but no exploitation has been observed and no public exploit code exists - so the practical risk hinges on whether a reachable network path to the driver actually exists, since a storage/volume driver is not inherently internet-facing. Every supported Windows client and server branch from Windows 10 1607 through Windows 11 26H2, plus Server 2012 through Server 2025, is enumerated as affected below the fixed build numbers.

Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.

Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.

Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.

Local privilege escalation in the Windows UI Immersive Server component allows an attacker who already holds a low-privileged local account on a Windows host to corrupt heap memory via a crafted input and elevate to a higher-integrity context, including SYSTEM. Affected systems are all supported Windows client and server editions running builds below the fixed patch level, ranging from Windows 10 1607 and Windows Server 2012 up through Windows 11 26H2 and Windows Server 2025; patched builds are not exploitable, and there is no remote or unauthenticated path. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and non-automatable, and no EPSS score was supplied, so the practical risk is a serious but post-compromise local escalation flaw rather than an emergency-grade, mass-exploitable issue; a vendor patch is available.

Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.

Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.

A stack-based buffer overflow in the Microsoft Graphics Component, reachable through Microsoft Office for Android, lets an authenticated attacker who can place a crafted document or graphics object in front of a victim gain code execution in the context of the mobile app, with high impact to confidentiality, integrity, and availability. Only builds from 16.0.1 up to but not including 16.0.20430.20000 are affected, and exploitation requires user interaction - the victim must open or render the malicious file - which materially narrows the practical attack surface despite the 8.0 CVSS score. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; the vendor has published an update-guide entry, so affected organizations should treat this as a credible mid-to-high priority patching item rather than a top-tier emergency.

Privilege escalation in the Windows kernel-mode drivers lets an authenticated attacker who already holds low-privileged local code execution on a host trigger a heap-based buffer overflow and elevate to SYSTEM-level rights. Affected are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds below their respective patched revisions. This is strictly a post-compromise local escalation (CVSS 3.1 7.8, AV:L/PR:L/UI:N) with no remote or network-facing attack surface; no public exploit code has been identified at time of analysis and there is no KEV listing, so it should be treated as a high-value chaining primitive rather than an initial-access vector.

Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.

Local privilege escalation in the Microsoft Windows Search Component (CWE-122 heap-based buffer overflow) allows an attacker who already holds a low-privileged, authenticated local foothold on a Windows host to corrupt heap memory and achieve high-impact code execution. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming the flaw is not remotely triggerable and needs no victim interaction, but does require the attacker to already be running code locally. Affected builds span Windows 10, Windows 11, and Windows Server 2012 through 2025; Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.

Local privilege escalation in the Windows Win32k kernel subsystem allows an attacker who already holds a low-privileged local account on an affected Windows 11 or Windows Server build to trigger an out-of-bounds kernel read that Microsoft rates as elevation of privilege with High confidentiality, integrity, and availability impact. Exploitation requires local authenticated access (AV:L, PR:L) and no user interaction (UI:N), but the High attack complexity (AC:H) indicates success likely depends on winning a race or arranging a specific kernel memory state, so it is not reliably repeatable. There is no public exploit identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the CVSS 7.8 (High) score reflects severe technical impact rather than an imminent, easily triggered attack.

Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.

An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library can be triggered by a local, authenticated low-privilege attacker to leak memory and, in the assessed worst case, achieve local privilege elevation on affected Windows 10, Windows 11, and Windows Server builds. This is a credible but not emergency-tier priority: exploitation demands a pre-existing local foothold and high attack complexity (race or precise memory/heap conditioning), and no public exploit or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft advisory, so affected fleets should be updated through normal patch cycles rather than treated as an emergency.

A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.

Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on a vulnerable build to trigger an out-of-bounds read that the vendor rates as full-impact (C:H/I:H/A:H) on confidentiality, integrity, and availability. Only pre-patch builds of Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), are affected; patched builds are not exploitable, so this functions as a post-compromise escalation step rather than an initial access vector. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS 7.8 (HIGH) score and the low-privilege local prerequisite make it a realistic follow-on step after a workstation or server foothold, and Microsoft has released fixes.

Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.

Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.

Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.

Local privilege escalation in the Microsoft Windows WebDAV component allows an authenticated low-privileged user to trigger a heap-based buffer overflow and gain code execution at a higher integrity level on the affected host. Exploitation requires a pre-existing local foothold (AV:L, PR:L, UI:N) plus reliable heap grooming or race-condition success (AC:H), making this a post-compromise escalation primitive rather than a remote or unauthenticated entry point. It affects unpatched Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 builds below their respective patched thresholds; no public exploit code has been identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied with the record.

Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.

A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.

Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.

Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.

Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.

Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.

Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.

Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.

Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.

An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.

Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.

Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.

Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.

Elevation of privilege in Microsoft Hyper-V lets an attacker who already holds high privileges inside a guest virtual machine trigger an out-of-bounds read that crosses the hypervisor boundary, yielding full confidentiality, integrity, and availability impact on the host (scope change, C:H/I:H/A:H). The flaw (CWE-125) is local, requires no user interaction, and is only reachable on Windows systems where the Hyper-V role is installed and enabled, making it a post-compromise guest-to-host escape rather than a remote or unprivileged attack. No public exploit code has been identified and CISA's SSVC assessment rates exploitation as none; vendor patches addressing the affected builds are available, so this is a serious but not emergency-grade issue for unpatched Hyper-V hosts.

Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.

Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.

Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.

Memory corruption in Microsoft's WPF desktop stack (Microsoft.WindowsDesktop.App.Runtime, shared by .NET and .NET Framework) allows an unauthenticated, network-positioned attacker to cause an out-of-bounds write by delivering an XPS document whose glyph coordinates overflow pointer arithmetic in CD3DGlyphBank::RectFillAlpha. Exploitation requires user interaction - the victim must open or render the malicious XPS file in an affected WPF application - and prerequisites are otherwise limited to the Windows platform and to applications that actually process untrusted XPS/glyph content, so server services that never render such documents are not exposed. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact; note that signals conflict and should be weighed carefully, since the CVE description frames the outcome as privilege elevation while the vendor advisory frames it as remote code execution with process termination. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC exploitation: none), and vendor patches are available across .NET 8/9/10/11 RC, .NET Framework 3.5 and 4.x, and Visual Studio.

Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.

Local privilege escalation in the Windows Volume Manager Extension Driver (volmgrx) lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger an out-of-bounds read and escalate to full control of the machine, carrying a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected driver ships by default across an unusually wide range of releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, and Microsoft has published fixes through its MSRC Update Guide. Exploitation requires a pre-existing local foothold and cannot be triggered remotely, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates it Exploitation: none and Automatable: no, making this a moderate post-compromise hardening priority rather than an emergency.

An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.

Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.

Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.

Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.

Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.

Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.

Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).

Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.

Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.

Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.

Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.

Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.

Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.

Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.

Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.

An out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows a network-positioned attacker to corrupt memory in a high-privilege system process and execute arbitrary code, with the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicating a low-privilege authenticated attacker, no user interaction, and full confidentiality, integrity, and availability impact. The affected surface spans essentially the entire supported Windows fleet, from Windows Server 2012/2012 R2 and Windows 10 1607 through Windows 11 26H2 and Windows Server 2025, so unpatched domain controllers and member servers are the highest-value targets. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none and the flaw as non-automatable, meaning exploitation is not trivial to script at scale; Microsoft has released fixed builds for all affected branches.

Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.

Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.

Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.

Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.

Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).

Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.