Buffer Overflow

Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.

Remote unauthenticated code execution in Microsoft Exchange Server is possible via a stack-based buffer overflow in affected builds of Exchange Server Subscription Edition RTM, Exchange Server 2019 CU14/CU15, and Exchange Server 2016 CU23, rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers with network reachability to an unpatched Exchange deployment need no credentials and no user interaction, and the assessed impact is total (confidentiality, integrity, and availability all rated High). The high attack complexity component indicates that reliable exploitation depends on conditions outside the attacker's direct control, such as defeating stack protections or reaching a specific vulnerable code path, and CISA SSVC records Exploitation: none and Automatable: no; no public exploit identified at time of analysis, and Microsoft has released fixed builds.

Heap-based buffer overflow in Microsoft's optional MPEG-2 Video Extension (versions 1.0.0.0 up to but not including 1.2.32.0) allows an unauthenticated attacker to execute code over a network by delivering a specially crafted MPEG-2 media file that a victim opens in an application that invokes the codec. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects a total technical impact offset by a required user interaction: the codec is a deliberate Microsoft Store add-on rather than a default Windows component, so the exposed population is limited to systems where it has been installed, and code executes only in the context of the user who opens the file. CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, and no public exploit has been identified at time of analysis; a vendor patch is available.

Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.

Heap-based buffer overflow in Microsoft Word lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens a specially crafted document, affecting Office LTSC 2021 and LTSC 2024, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. Because the flaw triggers only when the victim opens the malicious file (CVSS UI:R) and SSVC marks it non-automatable, exploitation depends on social engineering rather than automated mass attacks, even though a successful hit yields total loss of confidentiality, integrity and availability (CVSS 8.8). A vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis.

Heap-based buffer overflow in Microsoft Word allows remote code execution when a user opens or previews a specially crafted document. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, with a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and total technical impact per CISA's SSVC. Exploitation requires the victim to open the malicious document (UI:R), so it is not reachable through passive network traffic or automated scanning, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; vendor patches are available and should be prioritized given the high impact.

Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.

Heap-based buffer overflow in Microsoft Word allows remote attackers to execute code in the context of the user who opens a crafted Word document. Exploitation requires the victim to open an attacker-supplied file (CVSS UI:R) and no authentication or prior privileges (PR:N), with code running only in the opening user's context and no privilege escalation (S:U); SSVC marks the attack non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available, including fixed builds for Office LTSC 2021 and LTSC 2024, with updates for Mac and Microsoft 365 Apps distributed through Microsoft's Office security release channel.

Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.

Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.

Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.

An out-of-bounds read in Microsoft Outlook allows an unauthenticated, remote attacker to disclose information by getting crafted content parsed or rendered by the Outlook client, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) by the vendor with confidentiality-only impact. Our independent assessment keeps the network vector and high confidentiality impact but conservatively scores user interaction as required (UI:R), because the crafted message or attachment must actually reach a mailbox and be opened or previewed by Outlook - a delivery-and-render precondition, not a directly reachable network service. No public exploit code has been identified at time of analysis (CISA SSVC rates exploitation as 'none' and the issue is not in KEV), and a vendor patch is available, placing this in the important-but-not-emergency tier.

Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.

Heap-based buffer overflow in Microsoft Word allows unauthenticated remote attackers to execute arbitrary code when a crafted document is parsed, though exploitation is difficult to trigger reliably (AC:H) and, per our assessment, requires the victim to open or preview the malicious file (UI:R). Microsoft's advisory vector lists UI:N (no user interaction), which would suggest an automatic preview-pane path; this discrepancy should be resolved with MSRC because UI:R materially lowers real-world exploitability. A vendor patch is available for all affected Office channels, no public exploit code or CISA KEV entry was identified at time of analysis, and SSVC marks the flaw non-automatable, making this a serious but not emergency-tier vulnerability.

Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and corresponding Office for Mac editions when a victim opens a specially crafted document that triggers a heap-based buffer overflow. The attacker is unauthenticated (PR:N), but exploitation requires user interaction (UI:R), and any code runs in the context of the opening user (S:U) without crossing a privilege boundary. Microsoft has released patches; no public exploit identified at time of analysis, so treat this as a high-priority phishing-borne update item rather than a remotely triggerable no-interaction emergency.

Heap-based buffer overflow in the Microsoft Windows WebDAV client (WebClient service / WebDAV redirector) allows an unauthenticated remote attacker to corrupt heap memory and potentially achieve code execution on affected Windows hosts, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by mandatory user interaction: the victim must be induced to connect to or open attacker-controlled WebDAV content, such as a malicious WebDAV server, a UNC/WebDAV path, or a document containing an embedded remote reference. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation=none and Automatable=no, so this is a high-priority patch candidate rather than an emergency; vendor patches are available from Microsoft.

Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.

Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.

Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.

Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.

Remote code execution in Microsoft Excel (CVSS 8.8) becomes possible when an unauthenticated attacker convinces a victim to open a specially crafted spreadsheet, triggering an out-of-bounds read (CWE-125) that can be turned into memory corruption and code execution in the context of the user who opened the file. Affected configurations include Microsoft Office LTSC 2021 below 16.0.14334.20974, Microsoft Office LTSC 2024 below 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office 365 for Mac. No public exploit has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and the issue as not automatable, and vendor-released patches are available, making this a high-priority patch target rather than an emergency.

Local code execution in Microsoft Windows HTTP.sys affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, including Server Core installations. An attacker who already holds a valid low-privilege authenticated session on the host (CVSS vector AV:L/PR:L/UI:N) can trigger an out-of-bounds read in the HTTP kernel driver with no user interaction, delivering high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixes; multi-user hosts such as RDP/terminal servers, where untrusted users hold local accounts, carry the highest realistic exposure.

Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.

Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.

Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.

Local privilege escalation in the Windows Desktop Window Manager (dwm.exe) allows an attacker who already holds an authenticated low-privilege account on the target host to exploit an out-of-bounds read and gain elevated (SYSTEM-level) code execution. All supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions are affected up to their respective fixed builds, and the prerequisite is purely local code execution with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). No public exploit code or confirmed active exploitation has been identified at the time of analysis and CISA SSVC rates exploitation as none and not automatable, so this is a routine patch-priority item rather than an emergency - but the vendor update should be applied promptly on multi-user, RDP-accessible, and privileged-administration endpoints where a local foothold is easiest to obtain.

Code execution in Microsoft Word is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122) in the application's document parsing logic. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is unauthenticated and needs no elevated privileges, but it is local in nature and requires the victim to open a malicious file, meaning an attacker must first succeed at social engineering - the SSVC assessment records Exploitation=none, Automatable=no, and there is no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Successful exploitation yields arbitrary code only in the security context of the user who opened the document, not inherently SYSTEM or administrator, so the practical risk is a workstation-level compromise rather than immediate full host takeover.

Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.

Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.

Memory corruption in Microsoft .NET's System.Net.Sockets component allows an unauthorized attacker to execute code over a network on Windows hosts, but only against applications that reuse a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP datagram sockets. The flaw (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) manifests as an out-of-bounds write in the ReceiveFromAsync path once an undersized cached native address buffer is retained; no authentication or user interaction is required, though the high attack complexity reflects the non-default coding pattern required to reach the vulnerable state. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and non-automatable, and no KEV listing applies; Microsoft has shipped fixed runtime builds, making this a meaningful but non-emergency patching priority.

Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.

Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).

A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.

Remote code execution is possible in the Microsoft PostScript Printer Driver, where a heap-based buffer overflow (CWE-122) lets an unauthenticated attacker who can deliver crafted PostScript print data over the network corrupt heap memory and execute arbitrary code in the context of the Windows Print Spooler. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required; every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected unless it has been updated to the fixed build listed by Microsoft. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis - SSVC records exploitation as 'none' - so the practical exposure is driven by whether the print/spooler service is reachable from untrusted networks.

A heap-based buffer overflow in the Windows Network File System (NFS) Server role lets an attacker who already holds local, low-privileged authenticated access on a Windows host execute code in a higher-privileged context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Exploitation is constrained by prerequisites: the optional NFS Server / Services for NFS feature must actually be installed and enabled - it is absent from default Windows installations - and the attacker must already be on the box with valid low-privilege credentials; no user interaction is required. Vendor-released patches exist for all listed Windows client and server builds, no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), so this is a moderate-to-serious patching priority rather than a top-tier emergency. Defenders should note the scoring discrepancy flagged in the independent assessment: NFS is a network-facing service, yet Microsoft scored the vector as LOCAL - confirm via the MSRC advisory whether any network-adjacent trigger path exists beyond the local vector.

Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in Microsoft Windows OLE allows an attacker who already holds low-privileged authenticated access on a host to drive a heap-based buffer overflow by inducing the vulnerable component to process a crafted OLE object, resulting in code execution at a higher integrity level with complete loss of confidentiality, integrity, and availability (CVSS 7.8, CWE-122). The issue spans a wide set of unpatched Windows client and server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; vendor fixes are available and no public exploit code was identified at time of analysis. Because the attack is local (AV:L), requires existing credentials (PR:L), needs no victim interaction (UI:N), and is classified as non-automatable with exploitation 'none' under CISA's SSVC framework, it is a second-tier, post-compromise escalation primitive rather than a remote or wormable threat.

Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.

Memory-safety failure in the Windows Bluetooth Port Driver lets a device within Bluetooth radio range trigger out-of-bounds memory access that can escalate to code execution on unpatched Windows 10, Windows 11, and Windows Server hosts with an active Bluetooth radio. Exploitation requires proximity (adjacent network), the victim's Bluetooth to be enabled and in use, some form of user interaction such as accepting or initiating a Bluetooth connection, and high attack complexity reflecting preconditions outside the attacker's control; authentication is not required (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Microsoft has shipped fixes, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as "none" with the attack assessed as non-automatable, and hosts with Bluetooth disabled are not exposed - making this a moderate rather than top-tier priority despite the 7.1 score and the CVSS "total" technical impact rating on affected devices.

Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.

Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.

Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.

Local privilege escalation in the Windows Kernel allows a low-privileged, authenticated attacker who already holds code execution on a target host to trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM-level privileges. The vulnerability is strictly local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it provides no remote or network path and is only useful as a post-compromise escalation step rather than an initial access vector. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with 'Automatable: no', because the attacker must already have a local foothold; Microsoft has published patched builds for the affected Windows 11 and Windows Server releases.

Local privilege escalation in Microsoft's Windows Client for NFS allows an authenticated low-privileged attacker who already has code execution on a host to elevate to higher privileges (assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8). Exploitation requires the optional 'Client for NFS' feature to be installed and reachable from the attacker's context, so default installations without that component are not affected, and there is no remote or network-facing attack path. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis; Microsoft has released fixes via its update guide (MSRC advisory for CVE-2026-70113), and the issue is tracked as CWE-190 integer overflow or wraparound.

Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.

Local privilege escalation in the Microsoft PostScript Printer Driver allows a low-privileged user on an affected Windows host to gain elevated code execution by having attacker-controlled PostScript/print-driver data processed on the machine, with the root cause classified as a CWE-121 stack-based buffer overflow and a CVSS base score of 7.8. The vector (AV:L/AC:L/PR:N/UI:R) shows no privileges are required prior to exploitation (PR:N) but local presence is mandatory and the victim must be induced to trigger processing of the malicious data (UI:R); CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code has been identified at time of analysis. This is a credible but context-dependent post-compromise escalation step rather than a mass-exploitation emergency, and a vendor patch is available.

A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.

Heap-based buffer overflow in the Windows Win32 kernel subsystem lets a locally authenticated low-privilege attacker escalate to full system privileges on an affected host. Every supported Windows build in the EUVD-listed ranges is exposed by default - Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2 (including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations - until the corresponding cumulative update is applied; CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact on confidentiality, integrity and availability is total once the primitive is triggered. Microsoft has published fixes in its update guide, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none). The practical barrier is that the attacker must already hold local code execution on the target, making this a post-compromise privilege-escalation step rather than an initial-access vector.

Heap-based buffer overflow in the Windows kernel (CVE-2026-70106) allows an attacker who already holds low-privileged local code execution to elevate privileges on the affected host, scoring 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exposure is broad across build numbers - Windows 10, Windows 11 and Windows Server 2012 through 2025, including Server Core - but the attack is gated behind an existing local foothold, so it is a post-compromise escalation primitive rather than a remotely reachable one. Microsoft has released fixes through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).

Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.

Heap-based buffer overflow in the Windows Rich Text Edit Control (RichEdit) allows remote attackers to execute arbitrary code in the context of the rendering application when a victim processes attacker-supplied rich text, without any authentication prerequisite per the CVSS vector (AV:N/AC:L/PR:N). Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac are all listed as affected, so the exposure surface spans both the operating system and productivity applications that embed the control. Vendor patches are already available (MSRC advisory for CVE-2026-70096, EUVD-2026-99161), and no public exploit code or confirmed active exploitation has been identified at time of analysis - CISA's SSVC assessment records Exploitation: none while rating the flaw fully automatable with total technical impact, making pre-patch exposure the primary concern. Note that while the vendor vector marks UI:N, our independent assessment applies UI:R, because exploitation realistically requires the target to open or preview crafted rich text in a RichEdit-backed application, which constrains mass spray-and-pray campaigns.

Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.

Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.

Local privilege escalation in the Microsoft PostScript Printer Driver allows an attacker who gets a victim to open or print a crafted PostScript payload to trigger a heap-based buffer overflow (CWE-122) and execute code in the context of the affected Windows printing component. The flaw affects a broad range of Windows client and server builds - including Windows 10/11 and Windows Server 2012 through 2025 - that have not been updated to their fixed build revision. Per the CVSS vector the attacker needs no pre-existing account (PR:N), but exploitation is local (AV:L) and requires user interaction (UI:R), a crafted document must be processed on the target, and no public exploit code or active exploitation was identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no).

Heap-based buffer overflow in Microsoft Windows GDI (CWE-122) lets remote attackers achieve code execution on a fully updated-adjacent target by convincing a user to open or preview a maliciously crafted image or document that is parsed through the Windows Graphics Device Interface; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) indicates no authentication is needed but that the victim must interact with the attacker-supplied file. Code execution occurs in the security context of the user who opened the file, so the impact is bounded by that user's privileges and no scope change occurs. No public exploit code has been identified at time of analysis and the CISA SSVC decision framework records Exploitation: none with Automatable: no, while Technical Impact is rated total; there is no KEV listing, so this is a high-priority patching item rather than an emergency. Microsoft has published fixed builds covering Windows 10, Windows 11 and Windows Server 2012 through 2025.

Stack-based buffer overflow in Windows DHCP Server allows an authenticated attacker with low-level network privileges to run arbitrary code on unpatched Windows Server and Windows 10 systems where the DHCP Server service is present. The flaw is network-reachable, low-complexity, and needs no user interaction, but PR:L means the attacker must already have an authenticated foothold; CISA SSVC rates exploitation as none and not automatable, and no public exploit code is identified at time of analysis. Vendor patches are available, making this a serious flaw to prioritize on exposed DHCP servers rather than an immediate emergency.

Privilege elevation on unpatched Windows hosts is possible through a heap-based buffer overflow (CWE-122) in the Client-Side Caching (CSC) / Offline Files service, which caches content fetched from SMB network shares. The assessed vector (AV:N/AC:L/PR:N/UI:R) describes an unauthenticated remote attacker, but success hinges on a victim interacting - typically by connecting to or accessing an attacker-controlled share so CSC parses a crafted response and overflows a heap buffer - which is consistent with SSVC rating automatic exploitation as 'no' and with the SSVC exploitation signal of 'none'. Microsoft has released patches for every affected build, and no public exploit code has been identified at time of analysis, so this is a serious but not emergency-grade issue demanding prompt, scheduled patching rather than crisis response.

Local privilege escalation in the Microsoft Windows Win32 kernel subsystem allows an attacker who already holds low-privilege local access on a Windows host to corrupt heap memory and gain SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must be authenticated locally (PR:L, AV:L) and needs to run a crafted program that reaches the vulnerable kernel code path, with no user interaction required. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and vendor-released patches are available for all affected Windows client and server builds.

Local privilege escalation in Microsoft Windows OLE allows an authenticated attacker who already holds a low-privileged foothold on a host to corrupt heap memory through crafted OLE object handling and execute code at a higher integrity level, matching the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). Scope is limited to unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by EUVD; because the vector is local-only with PR:L, the flaw is not remotely reachable and cannot be triggered against a default configuration by an outside party. CISA SSVC rates exploitation as "none" and automatable as "no", there is no public exploit identified at time of analysis, and Microsoft has shipped fixes via its Update Guide, making this a credible but not emergency-level priority.

Memory corruption in the Microsoft Windows DHCP Server role allows unauthenticated remote attackers to execute arbitrary code on affected servers over the network. Only systems with the DHCP Server role installed and running are exposed - the attack surface is the DHCP service itself (typically UDP 67), while ordinary Windows clients and servers without that role are not vulnerable. Affected builds span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809 below the listed patch levels. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation and a non-automatable attack profile, although technical impact is rated total; a vendor patch is available. Note that the vendor-published base vector (7.5) reflects an availability-only impact, whereas the independent assessment scores confidentiality, integrity and availability all High (full code execution).

Heap-based memory corruption in the Windows NetBIOS component lets an authenticated local attacker with only low-privileged code execution elevate to SYSTEM on unpatched hosts. Exploitation requires an existing foothold - a valid local account and the ability to run code on the target - so this is a post-compromise escalation primitive, not a remote or initial-access vector; no user interaction is required (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). Microsoft has released fixes and CISA's SSVC assessment rates exploitation as 'none' and the issue as non-automatable, so despite a total technical impact this rates as a genuine but not emergency-tier priority; no public exploit code was identified at time of analysis.

Authenticated local code execution in Windows PowerShell affects Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025, where a heap buffer overflow triggered by crafted input lets a low-privilege local user run code at the level of the PowerShell process. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), and because the vector requires an existing local interactive session, the practical exposure is privilege escalation or post-foothold activity on shared hosts rather than a remote or unauthenticated attack. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has released fixed builds through the MSRC update guide.

A heap-based buffer overflow in the Windows Resilient File System (ReFS) driver (refs.sys) allows a locally authenticated, low-privileged attacker to corrupt kernel heap memory and elevate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already have a foothold on the host plus the ability to feed attacker-controlled input through the ReFS code path, which in practice means a ReFS-formatted volume must be present or mounted for the driver to process that input. Vendor patches are available per the Microsoft advisory, and no public exploit code has been identified at time of analysis (SSVC: Exploitation none, Automatable no); CISA's SSVC framing rates technical impact as total if successfully triggered, but the local-only, authenticated prerequisite and the non-default status of ReFS keep real-world urgency moderate.

Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.

Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.

Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an authenticated low-privileged user with an existing local foothold to corrupt heap memory in the host-side WSL components and cross a security boundary to gain elevated code execution, rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). The attack is entirely local - there is no network vector - and it requires the optional WSL feature to already be installed and enabled on an affected Windows 10, Windows 11 or Windows Server build, which meaningfully limits the exposed population since WSL is not present by default. Microsoft has published a fix through the MSRC update guide and there is no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none and automatable as no.

Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.

Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.

Local privilege escalation in Microsoft Windows NTFS (CVE-2026-70010) allows an authenticated, low-privileged user to corrupt kernel heap memory via crafted NTFS filesystem operations and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) in the in-kernel NTFS driver, rated CVSS 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold a local foothold on the host but needs no user interaction and faces low attack complexity. Exploitation is not remotely reachable over the network, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none'; patch availability is confirmed through the Microsoft MSRC update guide.

Local privilege escalation in the Windows IP Over USB Service (IpOverUsbSvc) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to overflow an integer value and consequently gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. Affected builds span Windows 10 (21H2/22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2022/2025 according to the EUVD version ranges, although the vulnerable service ships with developer/SDK and device-debugging tooling rather than being enabled on default installations. Exploitation requires local access and the service to be installed and running, so the practical fleet at risk is developer and debugging workstations; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and a vendor patch is available.

Remote code execution in Microsoft's Windows Desktop (WPF) runtime lets an unauthenticated attacker execute arbitrary code in the context of a victim who opens crafted WPF content containing a malicious pixel-shader. The flaw is a heap out-of-bounds write (CWE-787) in the shader-processing routine CPSTrans::Initialize, triggered when crafted pixel-shader bytecode desynchronizes the component's two parsing passes; per the CVSS vector the attacker needs no credentials (PR:N) but the victim must interact with the malicious content (UI:R), and exploitation yields code execution at the user's privilege level rather than elevated (S:U), which is why the independent assessment rates this as high priority but not an emergency. Affected software spans .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 preview/RC builds before 11.0.0-rc.2, multiple .NET Framework 3.5/4.6.2-4.8.1 servicing branches on Windows, and Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4). No public exploit code has been identified and there is no KEV listing at time of analysis, but vendor patches are available and should be applied promptly given the ease of triggering (AC:L) once a user opens the file.

Heap-based buffer overflow in the Windows Libarchive component - the library Windows uses to extract 7z, rar, tar, cab and similar archive formats - lets a remote attacker execute arbitrary code with the privileges of the user who opens a malicious archive. Because exploitation is delivered over the network (AV:N) with no authentication required (PR:N) but demands that the victim open or process the crafted file (UI:R), the realistic attack path is a phishing email attachment, a web download, or a hosted share rather than anything wormable; CISA's SSVC decision framework reflects this with Exploitation=none and Automatable=no. There is no public exploit identified at time of analysis and vendor patches are available, so the practical priority is patch deployment rather than emergency containment - while noting the CVSS 8.8 score masks that the mandatory user interaction is the single factor keeping risk below critical.

Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.

Local privilege escalation in Microsoft Streaming Service on Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 allows an authenticated, low-privilege attacker who already has code execution on the host to exploit an integer wraparound and elevate privileges, with total impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is strictly local - the vector (AV:L/PR:L/UI:N) rules out remote or unauthenticated reach - and SSVC records exploitation as none with automatable set to no, so no public exploit code has been identified at time of analysis. This is a genuine patch-priority issue but not an emergency, and it matters most on multi-user, terminal-server and jump hosts where untrusted users can already run code.

Heap-based buffer overflow in the Microsoft Streaming Service (the Windows kernel streaming subsystem, including mskssrv) permits a locally authenticated attacker to elevate privileges on affected Windows hosts. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a privilege-escalation primitive, not a remote entry point - the attacker must already hold low-privileged local code execution on the target machine before it can be triggered, and no victim interaction is required (UI:N). At time of analysis there is no public exploit identified, CISA KEV does not list the CVE, and CISA's SSVC decision framework records Exploitation: none with Automatable: no, so this is a credible but not emergency-priority issue; a vendor patch is available and version-specific fixed builds are published in the Microsoft advisory.

Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.

Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.

Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.

Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.

Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.

Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.

Code execution in the Windows Overlay Filter (WOF) driver lets a locally authenticated attacker trigger an out-of-bounds memory read and, per Microsoft's severity rating, achieve code execution with high confidentiality, integrity and availability impact on unpatched machines. The flaw (CVE-2026-69942, CWE-126, CVSS 7.8 / AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing local foothold and low-privileged credentials, so it is a post-compromise privilege-escalation issue rather than an initial access vector, affecting Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core) below their fixed build levels. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis; Microsoft has released a fix, so exposure is confined to systems that have not yet installed the current cumulative update.

Local privilege escalation in the Windows Spaceport.sys Storage Spaces kernel driver allows an authenticated attacker who already has the ability to execute code as a low-privileged user on an affected host to gain full SYSTEM-level privileges. An integer overflow/wraparound in the driver's handling of size or index values lets a crafted request corrupt kernel memory, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All unpatched Windows 11 releases from 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) installations with the driver loaded at defaults are in scope, but exploitation is not automatable per SSVC, and no public exploit identified at time of analysis.

Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.

Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.

Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.

Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.

Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.