Buffer Overflow

Local privilege escalation in Windows Direct Composition - the desktop compositor subsystem shipped by default in Windows 11 24H2, 25H2 and 26H2 and in Windows Server 2025, including Server Core - lets an attacker who already holds low-privilege local access corrupt heap memory and execute code at a higher integrity level (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is bounded by the prerequisite of an existing authenticated foothold on the host, so this is a post-compromise escalation primitive rather than a remote entry point; the independent assessment rates it a credible but not emergency-level priority. A vendor patch is available from Microsoft, and there is no public exploit identified at time of analysis (SSVC exploitation: none) and no KEV listing.

Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.

Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.

Stack-based buffer overflow in Microsoft Word affects Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and the Mac editions of Office, allowing a remote attacker to execute code in the context of the victim who opens a specially crafted Word document (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker privileges are required, but exploitation depends on user interaction - typically an email attachment or a web-downloaded document - which is the primary limiting factor and is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has released vendor patches and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.

Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.

Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.

Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.

A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).

A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.

Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.

Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.

Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.

Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.

An out-of-bounds read (CWE-125) in the Windows Event Logging Service can be driven by network-supplied input to corrupt execution flow, with the vendor rating confidentiality, integrity, and availability impact as High (CVSS 7.5). Affected are unpatched Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022 and 2025, including Server Core installations; exploitation is unauthenticated and network-reachable (PR:N/AV:N) but requires user interaction (UI:R) and a hard-to-satisfy timing or memory-layout condition (AC:H), so realistic risk is materially lower than the base score suggests. There is no public exploit identified at time of analysis, CISA's SSVC assessment records no exploitation activity, and a vendor patch is available from Microsoft.

Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.

A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).

Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.

Out-of-bounds read in Microsoft Paint 11.x allows an unauthenticated attacker to execute arbitrary code on a target system when the victim opens a specially crafted image file in the vulnerable app. The attack is delivered over a network (e.g., via a downloaded or emailed image), but Paint exposes no network service, so the practical prerequisite is user interaction - opening the file - which, together with the high attack complexity required to turn a memory read into reliable code execution, makes this a moderate-to-high severity client-side issue rather than an urgent emergency. No public exploit has been identified at time of analysis (CISA SSVC reports Exploitation: none, and the flaw is not on CISA KEV), and Microsoft has released a patched version, Paint 11.2605.91.0, so remediation should focus on updating Paint on endpoints that routinely handle images from untrusted sources.

An out-of-bounds read in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to cause a denial of service on affected hosts, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting availability-only impact. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 are affected, but exploitation is only reachable on hosts that actually expose an IKE/IPsec listener on UDP 500/4500 to the attacker's network - typically VPN gateways, IKEv2 remote-access servers, or hosts under domain IPsec policy. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and Microsoft has released vendor patches listed in the MSRC update guide.

Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.

Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.

Local privilege escalation in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) lets an attacker who already holds low-privileged, authenticated code execution on a host read out-of-bounds kernel memory and chain that primitive into full SYSTEM-level control. All supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below their respective fixed build numbers are affected; the driver ships by default, so no optional feature must be enabled. There is no public exploit identified at time of analysis (CISA SSVC records Exploitation as 'none' and Automatable as 'no'), and this is not a KEV-listed, actively exploited issue - but the reported CVSS of 7.8 with high confidentiality, integrity and availability impact makes it a credible, moderate-priority escalation target once an attacker has a local foothold. A vendor-released patch is available.

Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.

Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.

Local privilege escalation in the Windows MIDI Service Module allows an authenticated attacker with low-level privileges (PR:L) on an affected Windows 11 host to corrupt heap memory and elevate to SYSTEM-level or otherwise higher-integrity execution. The flaw is a CWE-122 heap-based buffer overflow (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) triggered by malformed input delivered to the MIDI service interface; it is local-only, requires an existing foothold, and involves no victim user interaction. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is a credible but not emergency-tier vulnerability - patch when convenient within normal monthly cycles rather than on an emergency basis. Affected builds are Windows 11 24H2, 25H2, 26H2, and 26H1 below their respective patched builds (10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231).

Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.

The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows unauthenticated remote attackers to execute code on affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems, provided they can trick a user into opening, mounting, or processing malicious partition or disk data (UI:R). Vendor patches are available, and no public exploit or confirmed active exploitation has been identified at time of analysis; this is a high-priority patching item but not an emergency.

Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.

Heap memory corruption in the Windows SMB Client lets a remote, unauthenticated attacker escalate privileges on any affected Windows 10, Windows 11, or Windows Server host after the victim is induced to open an SMB connection to an attacker-controlled server. The vulnerability carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no attacker credentials are needed but the victim must initiate the outbound SMB session, since the flaw sits in the client's parsing path rather than in a listening service. Microsoft has published fixed builds via the MSRC update guide, exploitation has not been observed, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with automation as impractical - making this a credible mid-to-high priority patch item rather than an emergency.

Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow and escalate to SYSTEM, yielding full loss of confidentiality, integrity, and availability (CVSS 7.8). The vulnerability is reachable only with local access and low privileges (AV:L, PR:L, UI:N) and requires no user interaction, making it a post-compromise escalation primitive rather than an initial-access or network-facing attack path. No public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none and Automatable: no), but Microsoft has published vendor fixes covering Windows 10, Windows 11, and Windows Server builds, so unpatched hosts where an attacker has already landed should be treated as high risk.

Remote code execution in Microsoft Windows Shell (CVE-2026-83782) lets an unauthenticated attacker trigger a heap-based buffer overflow and run arbitrary code, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - no privileges, no user interaction and no non-default configuration are required per the assessed vector. The flaw affects Windows client editions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Windows Server 2025, so essentially every supported and several legacy Windows builds are in scope until patched. No public exploit code identified at time of analysis, and CISA's SSVC assessment records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, meaning the urgency driver today is patch coverage rather than observed attacks. CISA KEV does not list this CVE, so there is no confirmation of active exploitation.

Heap-based buffer overflow in Microsoft Windows Installer (msiexec) allows an authenticated local attacker with low privileges to elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server releases. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is reachable only after a local foothold is obtained, making it a post-compromise escalation primitive rather than a remote entry point. At time of analysis, no public exploit code or confirmed active exploitation has been reported, and Microsoft has released patched builds.

Remote code execution in Microsoft's Internet Messaging API affects unpatched Windows 10, Windows 11, and Windows Server installations, where a heap-based buffer overflow lets an unauthenticated attacker execute code by delivering a specially crafted message. Exploitation is network-reachable without credentials (AV:N, PR:N), but the victim must open or preview the malicious content (UI:R), so unattended services are not directly triggerable, and success yields full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment records Exploitation: none with Automatable: no, though Technical Impact is rated total - making this a credible, high-priority patching target rather than an emergency.

Privilege escalation in the Windows Bluetooth Service lets an attacker within Bluetooth radio range trigger a heap-based buffer overflow and gain full control over the confidentiality, integrity, and availability of the target host, as reflected in the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.8). No authentication and no user interaction are required; a reachable, Bluetooth-enabled endpoint in default configuration is sufficient, which makes this a genuinely serious but not emergency-tier issue because the flaw cannot be triggered over the internet or a routed network - CISA's SSVC decision framework accordingly rates it non-automatable with exploitation observed as none. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to gain SYSTEM-level access by triggering an unsynchronized access to a shared resource during MSI package operations. Exploitation requires a valid local account (PR:L, AV:L) and hinges on winning a narrow timing window (AC:H), so attacks are typically unreliable and may need many repeated attempts - consistent with CISA SSVC rating the issue not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent, so real-world urgency is lower than the HIGH-adjacent, 7.0 CVSS score alone might suggest; vendor patches are available for all affected Windows builds.

Heap-based buffer overflow in the Windows Text Shaping engine (CWE-122) allows unauthenticated remote attackers to execute arbitrary code, carrying a critical CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity, and availability impact. Affected systems span an unusually wide footprint of Windows client and server releases - Windows 10 21H2/22H2 and 1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) - but only unpatched builds below the fixed versions catalogued by ENISA EUVD are exposed. Microsoft has released vendor patches through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; because the assessed vector asserts no authentication and no user interaction, defenders should confirm the UI:N rating against the MSRC advisory, since text-shaping code paths are normally reached only when attacker-supplied content is actually rendered.

Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.

A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.

Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.

Heap-based buffer overflow in the Windows Win32K kernel-mode driver (win32kbase.sys/win32kfull.sys) lets an attacker who already holds a low-privileged local session on a Windows host corrupt kernel pool memory and elevate to SYSTEM-level privileges. The flaw is rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and affects Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations below the patched build numbers. Exploitation is not remote and requires pre-existing local access, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Microsoft has issued a fix, making this a credible, patch-worthy local privilege-escalation issue rather than an emergency on its own.

Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.

Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.

Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.

Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.

Local privilege escalation in Windows Overlay Filter (WOF) allows an authenticated low-privileged attacker with the ability to run code on a vulnerable Windows host to trigger a buffer over-read (CWE-126) and gain elevated privileges, potentially including SYSTEM-level access. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD/MSRC advisory, and the flaw cannot be reached remotely. This is a genuine but second-tier priority: no public exploit code has been identified, SSVC rates exploitation as none and non-automatable, and the attacker must already hold a local authenticated session, so it is primarily a post-compromise escalation risk rather than an initial-access vector.

Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.

Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.

Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.

Local privilege escalation in Windows NTFS allows an authenticated attacker with a low-privileged local session to trigger an out-of-bounds write (CWE-787) and execute code with elevated privileges. Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis (SSVC exploitation: none, Automatable: no), and a vendor-released patch is available.

Local privilege escalation in Windows NTLM lets an attacker who already holds low-privileged, authenticated code execution on a Windows host corrupt heap memory and gain higher privileges (CVSS 7.8, CWE-122). The flaw is reachable without user interaction and on default installations, and because NTLM is a default, always-present Windows component, every client and server build listed by the vendor (Windows 10/11 and Windows Server 2016 through 2025) is affected. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment scores exploitation as none while flagging the technical impact on a successfully exploited system as total, so patching should be handled in a normal Patch Tuesday cadence rather than as an emergency.

A stack-based buffer overflow in the Windows Installer (msiexec) component allows an authenticated attacker holding a low-privileged local account to elevate privileges to SYSTEM on affected Windows hosts. The flaw is local-only (AV:L) and requires no victim interaction, but carries High attack complexity (AC:H), meaning a race condition or a specific system state must be won before the overflow can be reliably triggered, which limits practical exploitability to shared and multi-user systems such as RDS/terminal servers rather than typical single-user endpoints. No public exploit code has been identified at time of analysis and no active exploitation is confirmed (CISA SSVC exploitation: none); the high EPSS-style urgency signals are absent, and Microsoft has released a vendor patch, making this a genuine but moderate-priority issue that should be handled through normal patch cycles.

A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.

A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.

Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.

Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.

Heap-based buffer overflow in the Windows Bind Filter Driver (bindflt), a kernel-mode component shipped by default on supported Windows client and server editions, lets a locally authenticated user with only low privileges corrupt kernel heap memory and escalate to SYSTEM. Exploitation requires existing local access and a valid low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the bug functions as a privilege-escalation stage chained after an initial foothold rather than an independent remote entry point; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Microsoft has published fixed builds for all affected branches, so despite the lack of exploitation telemetry this is a genuine patch-priority item for Windows environments.

Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.

Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.

Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.

Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.

Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.

An out-of-bounds read in the Windows Network Policy Server (NPS) role lets unauthenticated remote attackers crash or degrade the service, producing a denial-of-service condition on hosts that expose NPS to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no credentials, user interaction, or client-side conditions are required once NPS is reachable, and impact is confined to availability - no code execution, integrity, or confidentiality loss. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, though the flaw is rated Automatable: yes and affects a broad set of Windows client and server builds spanning Windows 10/11 and Windows Server 2012 through 2025; a vendor patch is available and should be prioritized on internet- or partner-facing RADIUS infrastructure.

Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.

Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.

Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).

Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.

Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.

Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).

Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.

Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An out-of-bounds read in Windows kernel-mode drivers (CVE-2026-83637, CWE-125, CVSS 7.8) lets an attacker who already holds low-privileged local code execution on a Windows host escalate to full kernel privileges, yielding high confidentiality, integrity, and availability impact. Successful exploitation requires an existing local foothold and an authenticated session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); there is no remote or unauthenticated attack path and no user interaction is needed. No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not automatable), and Microsoft has released vendor patches for all affected Windows 10, Windows 11, and Windows Server editions.

Denial of service in Windows DNS Server: an unauthenticated, network-reachable attacker can send crafted DNS traffic to a host running the DNS Server role and trigger an out-of-bounds read (CWE-125) that disrupts or crashes the service, scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only). Unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 installations are affected, with Active Directory domain controllers and internet-facing resolvers carrying the greatest exposure because the DNS role must be listening by default; there is no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact. Microsoft has released fixes through the MSRC update guide, and the impact is confined to service disruption with no code execution or data disclosure resulting.

Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.

Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.

Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).

Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.

Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.

Local privilege escalation in the Windows NTFS file-system driver (CVE-2026-83567) allows an authenticated attacker who can already execute code on a Windows host to trigger an out-of-bounds read, which Microsoft scores as a full compromise of confidentiality and integrity (CVSS 7.8, C:H/I:H/A:H). Affected builds span essentially the entire supported Windows estate - Windows 10 1607 through 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - all in default configuration. This is a genuine but not emergency-priority vulnerability: no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has published vendor patches, so the practical risk is bounded by the requirement for pre-existing local authenticated access and the absence of a remote vector.

Heap-based buffer overflow in Windows Image Acquisition (WIA) allows an unauthenticated remote attacker to execute arbitrary code on Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 systems, but only after the victim opens or processes a specially crafted image through the WIA component (UI:R), so exploitation requires user interaction rather than being zero-click. CVSS 3.1 scores this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H / CWE-122), CISA's SSVC rates it Automatable: no with total technical impact, and no public exploit has been identified at time of analysis. Vendor patches are available from Microsoft, making this a high-priority patch-now issue for unpatched builds rather than an emergency driven by active exploitation.

Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.

A heap-based buffer overflow in the Windows RPC Runtime lets an authenticated local attacker with standard user rights elevate to higher privileges on affected Windows 11 hosts. The flaw is only reachable by code already executing on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and the vulnerable component is core, always-present Windows infrastructure, so no special configuration or user interaction is needed once a foothold exists. Microsoft has released fixes in its update guide (MSRC advisory for CVE-2026-83518), and there is no public exploit identified at time of analysis (SSVC exploitation: none, CISA KEV not listed); this makes it a patch-priority item for fleets still running unpatched Windows 11 builds rather than an emergency.

Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.

Remote, unauthenticated denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows any network-reachable attacker to crash the process that handles logon, credential validation and authentication for the host. Affected builds span Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core installations); patched builds at or above the vendor-listed build numbers are not exploitable. The impact is availability-only - no code execution, no data disclosure and no integrity impact - so real-world exposure is mainly a concern where authentication ports are reachable and where a host reboot or loss of authentication services is operationally disruptive; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.

Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.

Local privilege escalation in Microsoft Windows NTFS stems from an out-of-bounds read (CWE-125) that an authenticated attacker who already holds a low-privileged foothold on the host can trigger to reach high-integrity code execution and to read beyond the bounds of a kernel buffer (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw touches the default Windows filesystem, so unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025 and their Server Core installations are all in scope, but the local attack vector (no remote, unauthenticated reach) confines it to post-compromise escalation rather than an initial access path. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and Microsoft has released vendor patches.

Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.

Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted Excel document, affecting Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and corresponding Mac editions. Exploitation requires user interaction (opening a malicious file) and no public exploit or active exploitation is currently identified, per SSVC (Exploitation: none). Vendor patches are available, and code execution occurs only with the privileges of the user who opens the file.