Buffer Overflow

Information disclosure in Microsoft Excel allows unauthenticated remote attackers to read sensitive memory contents by enticing a user to open a specially crafted Excel document. The flaw affects multiple Microsoft Office products, including Office LTSC 2024, Office LTSC 2021, Office Online Server, and Microsoft 365 Apps, and requires user interaction (opening or previewing the file) for exploitation. No public exploit code has been identified, and CISA SSVC rates exploitation as none; the risk is considered a moderate-priority information-disclosure issue.

Out-of-bounds read in Microsoft Excel allows an unauthenticated remote attacker to disclose confidential process memory, but only when a targeted user opens a maliciously crafted Excel file. No public exploit or active exploitation has been identified (CISA SSVC exploitation: none, automatable: no), and the EPSS score was not provided at the time of analysis. The flaw carries a moderate CVSS 6.5 with confidentiality impact only; vendor-released patches are available.

Opening a specially crafted PowerPoint document can cause Microsoft PowerPoint to read beyond the bounds of an allocated memory buffer and disclose process memory contents to an attacker (CVSS 5.5, C:H/I:N/A:N). The flaw affects Microsoft Office LTSC 2024 and 2021, Microsoft 365 Apps for Enterprise, and the Mac editions of Office/Office LTSC, and exploitation requires the victim to open the malicious file locally (AV:L, UI:R, PR:N) - it cannot be triggered remotely or automatically. There is no evidence of active exploitation or public exploit code, CISA SSVC rates exploitation as none and automatable as no, and Microsoft has released vendor patches for the affected builds.

Out-of-bounds memory read in Microsoft Excel allows an attacker to disclose information by convincing a victim to open a specially crafted Excel file with a vulnerable Office build. Affected releases are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and affected Microsoft 365 Apps for Enterprise builds delivered through the Office security release channel. CISA's SSVC decision framework rates exploitation as none and no public exploit code has been identified at time of analysis; the flaw yields only information disclosure of adjacent memory (C:H, I:N, A:N) with no code execution or availability impact on its own, and exploitation is gated by a local vector (AV:L) plus mandatory user interaction (UI:R).

Out-of-bounds read in Microsoft PowerPoint allows a local attacker to disclose sensitive information from memory when a victim opens a specially crafted file. This affects Microsoft Office LTSC 2024, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office for Mac (365, LTSC 2021, and LTSC 2024) prior to the vendor's patched releases. Exploitation requires user interaction to open the malicious document, and no public exploit code or active exploitation has been identified at time of analysis; the impact is limited to information disclosure without code execution or denial of service.

Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.

An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.

An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.

Heap-based buffer overflow in the Windows Storage Port Driver (CWE-122) lets an attacker who can physically interact with a target machine corrupt kernel pool memory and elevate privileges, with high impact to confidentiality, integrity, and availability (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8). Unpatched Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core installations, are affected; no authentication or user interaction is required, but the attack depends absolutely on hands-on physical access, is not remotely reachable, and cannot be automated (SSVC Automatable=no, Exploitation=none). No public exploit identified at time of analysis, no confirmed active exploitation (not listed in CISA KEV), and a vendor patch is available.

Information disclosure in the Windows USB Print Driver allows a locally authenticated, low-privilege attacker to read beyond intended buffer boundaries and leak contents of driver memory on affected Windows 10, Windows 11, and Windows Server builds (2012 through 2025, including Server Core installations). Exploitation requires an existing foothold on the host with the ability to exercise the USB print driver code path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), needs no victim interaction, and is limited to confidentiality impact - no data modification, no denial of service, and no remote vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with partial technical impact, and an EUVD record (EUVD-2026-99784) tracks the same affected build list; vendor patches are available, making this a genuine but lower-tier patching priority compared with remotely reachable issues.

Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker to disclose in-process memory contents when WIC processes a crafted or attacker-influenced image, with a CVSS of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Affected systems include a broad set of supported Windows 10, Windows 11, and Windows Server builds below their patched build thresholds, and exploitation requires prior low-privileged access to the host rather than remote network reachability. No public exploit identified at time of analysis, CISA SSVC reports exploitation none and automatable no, and Microsoft has released vendor updates to address the flaw.

Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.

Information disclosure in Windows Win32k permits a local, authenticated attacker with a standard user session to read kernel memory contents that should be inaccessible, potentially exposing sensitive data. Affected systems include unpatched Windows 10 21H2/22H2/1809, Windows 11 23H2, and Windows Server 2019, 2022, and 2025 builds prior to the listed fixed versions; the flaw is a buffer over-read (CWE-126) requiring local access (AV:L) and low privileges (PR:L), with no remote vector and no user interaction. Vendor patches are available, and no public exploit has been identified at time of analysis; risk is moderate and low-priority despite the CVSS 5.5 base score because confidentiality impact is high but integrity and availability are unaffected.

An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.

An out-of-bounds read in the Remote Desktop Display Driver component of Microsoft Windows lets an authenticated, low-privileged local attacker disclose potentially sensitive memory contents on the affected host. Exploitation requires the attacker to already hold a local foothold on the machine (AV:L, PR:L) and to execute code that reaches the driver; no user interaction is needed (UI:N), and the impact is limited to confidentiality (C:H, I:N, A:N) with no code execution or system compromise by itself. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and CISA's SSVC framework rates it non-automatable with only partial technical impact, so real-world urgency is LOW despite the high confidentiality rating.

An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.

Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.

Microsoft Office Access contains an out-of-bounds read (CWE-125) that lets an attacker disclose information from the affected process's memory by convincing a user to open a crafted Access file. Affected installations include Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 before 16.0.17932.21056 and LTSC 2021 before 16.0.14334.20974; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) confirms remote delivery is possible but that the victim must open the file, and that there is no integrity or availability impact and no authentication requirement. Microsoft has released fixes, and no public exploit has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and the attack as not automatable - making this a moderate-risk information-disclosure issue rather than an urgent priority.

An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.

Information disclosure in Microsoft Excel allows remote unauthenticated attackers to read portions of process memory by convincing a victim to open a specially crafted Excel document. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and unpatched Microsoft 365 Apps for Enterprise; exploitation requires user interaction, and no public exploit code or active exploitation has been identified at time of analysis. Vendor patches are available.

A buffer over-read in Microsoft Excel's document-parsing code allows an unauthorized attacker to disclose information over a network when a victim opens a specially crafted spreadsheet. Affected builds are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft Office LTSC 2021 before 16.0.14334.20974; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) the attacker needs no authentication or privileges but must convince the user to open the malicious file, and the impact is limited to memory disclosure (no code execution or data modification). Exploitation status is not confirmed: CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided, so this is not treated as an emergency patch item - this is a moderate-severity information disclosure flaw (CVSS 6.5) rather than a top-priority emergency, though the vendor has released fixes.

Information disclosure in Microsoft Excel allows a remote, unauthenticated attacker to read out-of-bounds memory and potentially leak sensitive process data when a victim opens a crafted spreadsheet. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and corresponding Mac editions; exploitation requires user interaction (UI:R) and is limited to confidentiality impact (C:H/I:N/A:N). No public exploit identified at time of analysis, active exploitation is not indicated, and vendor patches are available.

Memory disclosure in Microsoft Excel (CVE-2026-88190), where an out-of-bounds read while parsing a crafted workbook leaks process memory to a remote, unauthenticated attacker - but only if the victim opens the attacker-supplied file, making user interaction the decisive control point. Affected builds are Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (fixed build listed on the vendor's Office security-release page). Rated 6.5 with confidentiality-only impact and no integrity or availability effect, delivery is network-based (phishing attachment, shared document, or web download); no public exploit has been identified at time of analysis, and CISA's SSVC assessment rates the flaw non-automatable (Exploitation: none, Automatable: no), consistent with the mandatory user-interaction requirement and the absence of a code-execution primitive.

Out-of-bounds read in Microsoft Excel (CVE-2026-88184) allows an unauthenticated remote attacker to disclose sensitive in-process memory by convincing a victim to open a specially crafted Excel document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office editions for macOS. No public exploit code or active exploitation has been identified per CISA SSVC (Exploitation: none), and a vendor patch is available; the primary mitigating factor is the required user interaction (UI:R), which prevents zero-click or service-based exploitation.

An out-of-bounds read in Microsoft PowerPoint lets a remote, unauthenticated attacker disclose process memory by convincing a victim to open a specially crafted presentation file. Affected builds include Microsoft 365 Apps for Enterprise and Office LTSC 2024/2021 on Windows, along with the Office LTSC for Mac 2024/2021 and Office 365 for Mac editions; the flaw is scored 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and requires user interaction, so there is no server-side or automatic trigger. Impact is bounded to confidentiality (C:H, I:N, A:N) - the read does not by itself yield code execution or data modification - and there is no public exploit identified at time of analysis, with SSVC recording Exploitation: none and no CISA KEV listing.

Out-of-bounds read in Microsoft Excel lets an unauthenticated remote attacker disclose information from the application's memory when a victim opens a specially crafted spreadsheet, scoring CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds include Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and Office 365 for Mac; the crafted file can arrive by email attachment or web download, but a human must actively open it, so there is no remote zero-click or automated server-side exposure. Exploitation has not been observed (CISA SSVC records exploitation: none and automatable: no) and no public exploit code has been identified at time of analysis, with vendor patches available through the Microsoft update channels.

An out-of-bounds read in Microsoft Office Excel lets an unauthenticated remote attacker disclose memory contents by convincing a victim to open a specially crafted spreadsheet (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise; patched builds are not vulnerable. The impact is confined to information disclosure with no integrity or availability effect, and there is no public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation=none and Automatable=no, with Technical Impact=partial.

Out-of-bounds read in Microsoft Word lets an unauthenticated remote attacker disclose information from process memory when a victim opens a specially crafted Word document. Exploitation is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so delivery depends on social engineering - a malicious email attachment, download, or shared file - rather than a drive-by or wormable trigger, and the resulting impact is limited to confidentiality (C:H) with no integrity or availability effect. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as none and automatable as no, and Microsoft has released fixed builds (Office LTSC 2024 16.0.17932.21056 and later, Office LTSC 2021 16.0.14334.20974 and later, plus updated Microsoft 365 Apps and Mac editions), making this a moderate-priority information-disclosure issue rather than a critical emergency.

Information disclosure in Microsoft Word allows an unauthenticated attacker to leak memory contents from a victim's machine when the victim opens a specially crafted Word document. The flaw is a buffer over-read (CWE-126) rated CVSS 6.5, with confidentiality impact limited to memory disclosure and no effect on integrity or availability. Exploitation is gated by user interaction (UI:R) - the attacker must convince a victim to open a malicious file - which prevents unattended or wormable mass abuse; no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches via the MSRC update guide.

An out-of-bounds read (CWE-125) in Microsoft Digest Authentication on unpatched Windows client and server builds lets an authenticated local user disclose information from the host; the CVSS 3.1 vector (AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attacker must already hold low-level privileges on the machine, needs no user interaction, and can only read data - with no impact on integrity or availability. Because reachability is local rather than remote, the component is the Windows Digest/SASL authentication provider itself, and exploitation is limited to memory disclosure on systems that have not yet installed the vendor fixes identified by EUVD build numbers. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and SSVC assesses the issue as not automatable with no observed exploitation, so it should be treated as a low-to-moderate-priority hardening item rather than an emergency.

Information disclosure in Microsoft Excel allows an unauthenticated remote attacker to read memory contents by having a victim open a specially crafted Excel file in a vulnerable build. The flaw is an out-of-bounds read (CWE-125) rated CVSS 6.5 with a UI:R requirement, meaning the victim must open the malicious document - the primary limiting factor - while impact stays confined to confidentiality (C:H) with no code execution, data modification, or denial of service. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA SSVC: Exploitation none, Automatable no), and vendor patches are available for Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office 365 for Mac.

Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to disclose sensitive information by convincing a victim to open a specially crafted workbook; the user-interaction requirement (UI:R) limits automated exploitation. No public exploit code has been identified at time of analysis, and the vendor has released patches. The CVSS score of 6.5 reflects high confidentiality impact with no integrity or availability effect.

Information disclosure in Microsoft Office Excel (Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise) allows an unauthenticated remote attacker to read memory beyond the bounds of an allocated buffer by convincing a victim to open a specially crafted Excel file. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms a confidentiality-only impact with no integrity or availability loss, no code execution from this issue alone, and a mandatory user-interaction prerequisite - the victim must open the file, and in practice dismiss Protected View or Mark-of-the-Web warnings. There is no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no, so this is a moderate rather than top-priority risk; Microsoft has released patched builds.

Local privilege escalation in the Windows Storage Spaces Controller affects Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016 through 2025 running builds below the vendor-fixed revisions, where a heap-based buffer overflow (CWE-122) permits memory corruption leading to full loss of confidentiality, integrity, and availability on the host. Exploitation requires an authenticated local session AND high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), so this is strictly a post-compromise step used by an already-privileged attacker rather than an initial-access or unauthenticated vector. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and no KEV listing applies; this is a genuine but moderate-priority issue rather than a top-tier emergency, and vendor-released patches fully remove the condition.

An out-of-bounds read in the Windows Key Storage Provider (KSP) allows an authenticated, low-privileged local user to disclose memory contents from the calling process, as rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only systems running Windows builds below the fixed levels published in the Microsoft update guide and EUVD (for example, Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2025 below 10.0.26100.33650) are affected; patched builds are not exploitable. The issue requires an existing local session and valid credentials, is not remotely reachable, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, making this a moderate-severity, low-priority issue in practice.

Denial of service in the Microsoft Windows DNS Server role allows a network-reachable attacker who holds valid low-privilege credentials to crash or destabilize the DNS service on unpatched Windows Server releases from 2012 through 2025, including Server Core installations. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authorization on the target - this is explicitly an 'authorized attacker' scenario, not anonymous remote abuse - and the resulting impact is availability only, with no code execution, no data access, and no integrity loss. No public exploit has been identified at time of analysis and CISA's SSVC rates the issue non-automatable with nonexistent observed exploitation, making this a moderate-priority availability bug rather than a critical RCE-class threat.

An out-of-bounds read in the Microsoft Windows DNS Server role lets a remote attacker who already holds a low level of authorization (PR:L, per the assessed CVSS vector) crash or destabilize the DNS service, denying name resolution to clients on the network. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations), and exploitation requires the DNS Server role to be installed and reachable. Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity effect, no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no' - a moderate, not top-tier, priority. Microsoft has released fixed builds.

Denial of service in the Windows DNS Server role affects Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations), where an attacker who already holds valid low-privilege credentials (CVSS PR:L) can send specially crafted DNS traffic over the network that triggers an out-of-bounds read (CWE-125) and takes the DNS service down. Impact is availability-only: confidentiality and integrity are both rated None, scope is unchanged, and the CVSS 3.1 score is 6.5. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so the practical priority is moderate and driven by the criticality of the DNS role rather than by observed attacks.

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorized access on the network crash or degrade the DNS service, resulting in a denial of service. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds, and because the DNS role runs on most Active Directory domain controllers, any environment with an exposed or reachable DNS service should treat those hosts as in scope. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) the attacker must be authenticated with low privileges, exploitation is over the network, and impact is limited to availability with no code execution or data disclosure; CISA's SSVC assessment records no observed exploitation and no public exploit code, so this is a moderate-severity, patch-cycle issue rather than an emergency.

An out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who is already authorized to send DNS messages to the service trigger a denial of service over the network, degrading or crashing the DNS service on affected Windows Server builds. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable without user interaction but requires at least low-level authorization - the attacker must be an authorized actor able to submit DNS queries, not an anonymous internet client - and the impact is confined to availability with no confidentiality or integrity loss. Affected systems are Windows Server 2012 through Windows Server 2025, including Server Core installations, that are actually running the DNS Server role; default workstation installs are not affected. Vendor patches are available for all affected builds, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and the vulnerability as not automatable.

An out-of-bounds read in the Windows Remote Access Service Infrastructure lets an attacker who already holds a low-privilege local session on the host read beyond the bounds of an allocated buffer and disclose information from process memory. Exploitation requires both local access (AV:L) and an authenticated low-privilege context (PR:L) per the assessed CVSS vector, with no network-facing or unauthenticated path, and CISA's SSVC assessment marks it non-automatable with only partial technical impact, so this is a moderate-severity disclosure issue rather than a top-tier emergency. No public exploit code has been identified at time of analysis, though the affected component ships across an unusually broad footprint: Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations.

A local information-disclosure flaw in the Windows USB Driver component allows an attacker who already holds authenticated low-privilege access on a Windows host to read past the end of a kernel buffer and leak memory contents back to the caller. Because the CVSS vector is AV:L/PR:L/UI:N, exploitation requires a pre-existing local foothold and direct interaction with the driver on the affected machine; there is no network-reachable attack path and no user interaction is needed once that access exists. Impact is limited to confidentiality (C:H) with no integrity or availability effect, making this an information-leak primitive (useful for defeating ASLR or extracting pointer data) rather than a direct path to code execution, and there is currently no public exploit identified at time of analysis and no CISA KEV listing.

Information disclosure in the Windows StateRepository API permits a locally authenticated low-privileged attacker to read beyond allocated buffers and disclose memory contents on Windows 11 and Windows Server 2025. The flaw requires local code execution with a valid account (PR:L/AV:L) and no user interaction; remote or unauthenticated attackers cannot trigger it directly. No public exploit code or active exploitation is known (CISA SSVC: none), and Microsoft has released patches for all affected builds.

Local information disclosure in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated local attacker to leak memory contents by supplying a crafted UDF-formatted volume - such as a malicious ISO disc image, UDF-formatted removable media, or a mountable disk image - for the driver to parse. Successful exploitation is limited to confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no code execution, persistence, or denial of service; CWE-822 points to improper handling of an untrusted pointer/offset during parsing. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates the issue as non-automatable with partial technical impact, and vendor-released patches are available, so this is a moderate-severity, low-urgency issue across supported Windows client and server releases.

Information disclosure in Windows Management Instrumentation (WMI) allows an attacker who already holds a local, low-privileged foothold on a Windows host to read memory contents that should not be exposed to them. The flaw is an out-of-bounds read (CWE-125) triggered through a locally reachable WMI code path; no user interaction is required and attack complexity is low once local access exists, but the vector is strictly local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with impact limited to confidentiality - no code execution, integrity modification, or denial of service. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'; vendor patches are available and fully updated Windows 10, Windows 11, and Windows Server builds are not exposed.

An out-of-bounds read in the Windows Print Spooler lets an unauthenticated remote attacker disclose memory contents over the network, but only if a victim is first induced to interact with an attacker-controlled print resource or crafted spooler response. Microsoft rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is confined to confidentiality - there is no code execution, data modification, or denial of service. All supported Windows client and server builds are affected, including Server Core installations, yet no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which keeps real-world priority low-to-moderate; vendor patches are available and should be applied through normal patch cycles.

Information disclosure in the Windows Servicing Stack allows an authenticated local attacker to trigger a buffer over-read and leak in-memory data on affected Windows 11 and Windows Server 2025 builds. The vulnerability requires local access and low-level privileges (PR:L) and has no remote or unauthenticated vector. No public exploit code has been identified, and CISA's SSVC assessment rates exploitation likelihood as none; the impact is limited to confidentiality with no integrity or availability effect.

Information disclosure in the Windows Biometric Service (WbioSrvc) allows a locally authenticated attacker with low privileges to trigger a heap-based buffer overflow and over-read heap memory handled by the service, potentially exposing sensitive data. The flaw affects Windows 10, Windows 11, and Windows Server builds tracked as EUVD-2026-99540 and requires an existing local foothold, with no network vector and no victim interaction; the assessed impact is confined to confidentiality loss with no code execution, integrity, or availability effect. Microsoft has released patches, CISA's SSVC assessment records exploitation as 'none' and automation as 'no', and no public exploit has been identified at time of analysis, making this a moderate-severity, low-urgency fix rather than an emergency.

Out-of-bounds read in the Microsoft Windows Installer component allows an authenticated attacker with low-level local privileges to read memory contents outside intended bounds and disclose information from the affected host. The flaw affects a broad set of Windows client and server builds, including Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires a pre-existing local foothold, as the assessed vector is AV:L/PR:L with no remote or unauthenticated path, and impact is confined to confidentiality (C:H/I:N/A:N) with no code execution or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC evaluation rates exploitation as none and non-automatable, and the vendor has released fixes, so this is a moderate-severity local disclosure issue rather than an urgent remote threat.

Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.

Out-of-bounds read in the Windows Wi-Fi Driver (CWE-125) allows an attacker who already sits on the same wireless network or local Layer-2/broadcast segment as the target - and who already holds low-level privileges on that adjacent segment - to read beyond the bounds of a kernel buffer and disclose information from the affected Windows system. The issue affects a broad range of supported builds, from Windows 10 1607 through Windows 11 26H2 and the corresponding Windows Server 2016/2019/2022/2025 releases, all of which are fixed by the current cumulative updates. Impact is limited to confidentiality (CVSS:3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7); there is no integrity or availability impact, no code execution or privilege escalation, no public exploit code identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, making this a moderate, patch-routinely item rather than an emergency.

An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.

An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.

An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.

An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.

Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.

Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.

An out-of-bounds read in the Windows Remote Desktop Gateway service allows an attacker who already holds valid credentials authorizing access to the gateway to disclose memory contents over the network, with confidentiality-only impact and no effect on integrity or availability. The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - including Server Core installations - running the RD Gateway role below the builds listed by EUVD, and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial - making this a moderate-priority information-disclosure issue rather than a critical emergency. Internet-facing RD Gateways that permit weakly controlled credential access are the realistic risk surface, while internal gateways protected by strong authentication and conditional access are substantially lower risk.

An out-of-bounds read in the Windows HID Parser Library (hidparse.sys) allows an attacker who already holds low-privileged local access to read beyond the bounds of a buffer and disclose kernel memory contents to user space, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is local only - the attacker must be authenticated on the host and must cause the parser to process a malformed HID report descriptor, typically by attaching or emulating a crafted USB or Bluetooth HID device - and the result is read-only information disclosure with no code execution or system modification. No public exploit has been identified at time of analysis, CISA SSVC records no observed exploitation and rates the issue non-automatable with partial technical impact, and a vendor patch is available from Microsoft (MSRC update guide, EUVD-2026-100040).

An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.

Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.

Local information disclosure in the Windows HID Parser Library (CWE-125, out-of-bounds read) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019/2022/2025, allowing a low-privileged local actor to read memory beyond an intended buffer and potentially disclose sensitive data. Successful exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) plus the ability to get the parser to process attacker-influenced HID descriptor or report data, for example via an attached or emulated USB HID device; integrity and availability are unaffected. The issue is rated moderate rather than high priority: there is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available from Microsoft.

An out-of-bounds memory read in the Windows CD-ROM Driver (cdrom.sys) lets unauthenticated remote attackers disclose kernel memory contents when a user is induced to open, mount, or otherwise cause the system to parse attacker-controlled optical-media content such as a crafted ISO, CDFS, or UDF image; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) confirms confidentiality-only impact and a mandatory user-interaction step. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates Exploitation as "none" and Automatable as "no", so this is a real but non-urgent, information-disclosure-class defect rather than a wormable or code-execution issue. Vendor patches are available, with fixed builds published for every affected Windows client and server branch, so the practical risk is concentrated on unpatched endpoints below the listed build numbers.

Out-of-bounds read in the Windows HID Parser Library lets an attacker who already holds authenticated local access to a Windows host read beyond the bounds of a parser buffer by supplying a crafted or emulated HID input (for example a malicious USB HID device or a malformed HID report descriptor), resulting in local information disclosure. The affected component is only reachable after local authentication and requires attacker-controlled HID traffic, and the outcome is limited to confidentiality loss (C:H) with no integrity or availability impact and no scope change, so this is a genuine but comparatively low-urgency issue. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as "none" and the issue as non-automatable, and vendor-released patches are available in the form of the Windows build updates listed below.

An out-of-bounds read in the Windows HID Parser Library lets a locally present, low-privileged authenticated attacker disclose information from the affected system's memory by supplying a malformed HID descriptor or report to the parser. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and yields confidentiality impact only - no code execution, no privilege escalation, and no integrity or availability effect - though leaked memory contents could assist follow-on attacks. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and Microsoft has published a patch; exploitation requires an existing local foothold plus the ability to feed crafted HID data (physical, emulated, or virtual HID device).

An out-of-bounds read in the Windows HID Parser Library allows an attacker who already holds a valid local session on an affected Windows host to disclose memory contents by supplying crafted or malformed HID descriptor data (for example via an emulated or malicious USB/Bluetooth HID device, or a local process feeding HID input). Exploitation requires local access and low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in information disclosure only - no code execution, integrity, or availability impact - and no public exploit was identified at time of analysis, with CISA's SSVC rating exploitation as none and the flaw as non-automatable. Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server editions, so this is a moderate, not urgent, priority that is resolved by applying current cumulative updates.

Local information disclosure in the Windows Aggregated Data Platform Service allows an authenticated, low-privileged user on an affected Windows 11 host to read past the bounds of an in-memory buffer and potentially expose sensitive data that the account would not otherwise be entitled to see. Only unpatched Windows 11 builds - 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H2 below 10.0.26300.9711, and 26H1 below 10.0.28000.3231 - are affected; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5) confirms the attacker must already hold a local account and that no integrity or availability impact is possible. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and no EPSS score was supplied; the mandatory local foothold keeps this a moderate-severity, patch-cycle item rather than an emergency.

Information disclosure in Windows Hello allows an authenticated local attacker with low privileges to read out-of-bounds memory and expose potentially sensitive data on affected Windows 10 and Windows 11 systems. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) confirms a local, authenticated, low-privilege attack with no user interaction and impact limited to confidentiality. CISA SSVC rates exploitation as none and automatable as no; no public exploit was identified at time of analysis, and Microsoft has a vendor patch available.

A local information-disclosure flaw in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged local access on a Windows host to trigger a buffer over-read and read beyond the bounds of a kernel buffer, exposing memory contents (CVSS 5.5, C:H/I:N/A:N). Exploitation requires local authenticated access (AV:L/PR:L) with no user interaction, but does not yield code execution or system compromise; the attack surface is strictly local. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Microsoft has released patched builds addressing the affected CLFS driver versions.

An out-of-bounds read in the Windows Portable Device MTP (Media Transfer Protocol) driver lets a locally authenticated attacker disclose memory contents from the host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The attacker must already hold a local account or code-execution foothold on the machine and must be able to present a portable device (physical, emulated, or over a bridged interface) that issues crafted MTP requests to the vulnerable driver; no victim user interaction is required. Exploitation status is limited: CISA SSVC reports no known or expected exploitation and no public exploit code was identified at time of analysis, so this is a routine patch-cycle priority rather than an emergency. A vendor patch is available and the affected build list spans Windows 10, Windows 11, and Windows Server 2012 through 2025.

Physical attackers can read out-of-bounds kernel memory through the Windows RNDIS (Remote NDIS) driver, which mishandles attacker-supplied RNDIS protocol data presented over USB. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. The CVSS vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6), so no authentication or user interaction is needed once the attacker has physical access, but remote or network-based exploitation is not possible and impact is confined to information disclosure with no code execution, integrity, or availability effect; there is no public exploit identified at time of analysis and CISA SSVC records Exploitation: none with Automatable: no, so this is a genuinely low-priority issue despite the HIGH confidentiality rating. Practical risk is limited to kiosks, shared or unattended machines, and evil-maid scenarios where an untrusted party can plug in a device.

Elevation of privilege in the Microsoft Bluetooth Driver affecting Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016, 2019, 2022 and 2025 stems from an out-of-bounds read (CWE-125) that a physically present attacker can trigger with no authentication and no user interaction, achieving high impact across confidentiality, integrity and availability (CVSS 6.8). The decisive constraint is the CVSS attack vector AV:P: exploitation requires physical or local hardware-level access to deliver crafted input to the Bluetooth stack, so the flaw is not remotely reachable and CISA's SSVC framework rates it as non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and KEV/EPSS signals do not indicate active exploitation; residual risk is concentrated in lost, stolen, unattended, or otherwise physically accessible endpoints rather than in network-exposed systems.

An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated, low-privileged local attacker to disclose sensitive information from the affected host. Only systems running vulnerable builds of Windows 10, Windows 11, and their corresponding Windows Server editions are affected, and exploitation requires that the attacker already holds a local interactive session on the target machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5). There is no remote attack path: per CISA's SSVC decision framework, exploitation is assessed as none and the vulnerability is not automatable, and no public exploit code has been identified at time of analysis; the confidentiality-only impact and the local-vector prerequisite keep this a moderate-priority issue, most relevant on shared, multi-user, or Remote Desktop hosts where untrusted users can obtain local sessions.

Information disclosure in the Microsoft Bluetooth Driver allows a locally authenticated attacker with low-level privileges to trigger an out-of-bounds memory read and obtain sensitive data from the affected Windows host. The issue spans an unusually broad servicing footprint covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations, and is scored CVSS 5.5 with high confidentiality impact but no integrity or availability impact. There is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation: none), so this rates as a moderate-severity, low-priority hardening item rather than an emergency; Microsoft has already published fixed builds, so remediation is a routine servicing update applied to the Bluetooth driver stack.

An out-of-bounds read in the Windows Error Reporting (WER) component of affected Windows client and server builds lets an attacker who already holds low-privileged local access on the host read memory beyond the bounds of an allocated buffer, resulting in disclosure of potentially sensitive information from the affected process's address space. The flaw carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-125, meaning the sole impact is confidentiality - the bug cannot by itself modify data or cause a denial of service. There is no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and CISA KEV does not list this issue. This is a genuinely moderate, low-priority issue rather than an urgent threat: the attack surface is local-only, requires existing authenticated access and the ability to drive the vulnerable code path through WER, and yields information disclosure rather than code execution.

Local information disclosure in the Windows NTFS driver lets an authenticated, low-privileged user trigger an out-of-bounds read that exposes kernel memory contents on unpatched Windows 10, Windows 11 and Windows Server builds. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is only reachable after an attacker already has a local foothold on the host, and it yields confidentiality impact alone with no integrity or availability effect. Microsoft has published a vendor patch, CISA's SSVC evaluation records no exploitation and no automation, and no public exploit code has been identified at time of analysis, so this is a genuine but low-urgency issue that matters mainly as a post-compromise or chained-attack primitive rather than a standalone remote threat.

Heap corruption in the Windows Kernel lets an attacker who already holds local, low-privileged code execution on a target host escalate to higher privileges; the authoritative assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning full confidentiality, integrity and availability impact on the compromised machine, while NVD's published base score of 5.5 reflects availability impact only. All supported Windows 10 (21H2 and 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 builds below the vendor-fixed levels are affected, and exploitation requires an existing local, authenticated foothold as a low-privileged user (PR:L, AV:L) with no user interaction (UI:N) and low complexity (AC:L) beyond reaching the vulnerable kernel code path. Microsoft has shipped patches per its update guide, CISA's SSVC decision framework records exploitation as none, and no public exploit code has been identified at time of analysis, so this is a moderate-priority post-compromise escalation primitive rather than an initial-access or remotely reachable flaw.

Local information disclosure in the Windows Print Spooler allows an authenticated, low-privileged user (CVSS PR:L, AV:L) to read memory beyond the bounds of a buffer handled by the printing subsystem, which runs by default on Windows client and server editions. Affected builds are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 that predate the fixed build levels published in the vendor update (for example Windows 11 24H2 before 10.0.26100.9711 and Windows Server 2025 before 10.0.26100.33650). The issue is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N) and no user interaction required; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity, making this a moderate-severity, low-priority issue under real-world scrutiny, with vendor patches available.

Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.

Local information disclosure in the Windows Universal Disk Format file system driver (UDFS, udfs.sys) allows an authenticated low-privilege attacker to read out-of-bounds memory by supplying a maliciously crafted UDF volume - a rogue optical disc, ISO/UDF disk image, or removable/mounted device - that the targeted host then mounts and parses. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5): exploitation requires an existing local authenticated session, there is no remote vector and no victim user interaction, and impact is confined to confidentiality with no integrity or availability loss. Microsoft has shipped fixes per its advisory, CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation 'no' and partial technical impact, and no public exploit code was identified at time of analysis - making this a genuinely moderate, low-urgency issue rather than a top-tier priority.

Adjacent-network denial of service in the Windows Wi-Fi driver affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, where a crafted 802.11 frame reaching the wireless stack triggers an out-of-bounds read (CWE-125) that can crash the driver and render the wireless connection unavailable. Per the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no authentication and no user interaction are required, and unauthenticated attackers within Wi-Fi radio range - on the same wireless LAN, a shared hotspot, or a rogue access point - can reach the target, making this a moderate-severity availability issue rather than a remotely exploitable internet-facing one. No public exploit code has been identified at the time of analysis (CISA SSVC: Exploitation=none, Automatable=no), though the vendor has released patched builds, and the impact is confined to availability with no assessed data exposure or code execution.

An out-of-bounds read in the Microsoft Windows Search Component lets a locally authenticated, low-privileged attacker read memory adjacent to search operations, resulting in information disclosure without any user interaction. Impact is confined to confidentiality (C:H) with no integrity or availability effect, and exploitation requires an existing local session on an affected Windows 10, Windows 11, or Windows Server build - there is no remote or unauthenticated path. No public exploit code and no confirmed active exploitation have been identified (CISA KEV absent; SSVC exploitation: none), and the vendor has released fixed builds, so this is a low-to-moderate priority patch-and-move-on issue rather than an emergency.

Denial of service in Microsoft Windows via the IKE Extension (IKEEXT) service, which can be crashed or disrupted when it processes malformed IKE protocol input, causing a buffer over-read (CWE-126). All supported Windows client and server platforms that ship IKEEXT are affected - including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 through 2025 - but only systems with IPsec/IKE or Windows VPN functionality active and network-reachable are exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) indicates an authorized attacker with low-level network access (not anonymous reachability) can cause an availability-only impact; there is no confidentiality or integrity effect and no code execution, and no public exploit has been identified at time of analysis (CISA SSVC: exploitation none, automatable no), making this a moderate-priority patching item rather than an emergency.

An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

An out-of-bounds read in the Windows WLAN Service lets a locally authenticated attacker disclose information from the host's memory on affected Windows 10, Windows 11 and Windows Server builds. Exploitation requires the attacker to already hold a low-privileged interactive logon or to run code under an existing user token on the target host (CVSS AV:L, PR:L); the issue is not remotely or anonymously reachable, no user interaction is needed (UI:N), and impact is limited to confidentiality (C:H with I:N/A:N), so there is no code execution or system modification. Severity is CVSS 5.5 (MEDIUM), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis; a vendor patch is available and the signal set is consistent with a moderate, low-priority hardening item.

An out-of-bounds read in Active Directory Domain Services (AD DS) on unpatched domain controllers allows an authenticated, low-privileged attacker to crash or hang the directory service over the network, producing a denial of service against domain authentication and directory lookups. The flaw requires a valid domain account or equivalent foothold (CVSS vector PR:L) and no user interaction; success yields only availability impact with no confidentiality or integrity loss (C:N/I:N/A:H, assessed 6.5). No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and non-automatable, and no CISA KEV listing exists, so this is a moderate-priority, availability-only issue affecting a critical infrastructure component rather than an emergency patch case.

An out-of-bounds read in the Windows Graphics Device Interface (GDI) subsystem can leak memory contents to a remote, unauthenticated attacker, but only after the victim opens or previews attacker-supplied content such as a crafted image, embedded font, or metafile (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Every supported client and server edition is affected in default configurations, spanning Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', so this is a moderate-priority information-disclosure issue whose practical risk hinges on social-engineering a user into rendering the malicious file; note that the flaw yields disclosure only (I:N/A:N) and cannot by itself corrupt data or crash the host, and a vendor patch is available.

An authenticated, network-positioned attacker can force an out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS), crashing the service and producing a denial of service on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The vulnerability is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so low-privilege valid credentials and network reachability are prerequisites; unauthenticated attackers cannot exploit it per the assessed vector, and the impact is confined to availability with no confidentiality or integrity consequence. Microsoft has published fixes via its update guide, CISA's SSVC assessment rates exploitation as none, and there is no public exploit identified at time of analysis - making this a moderate-severity, low-urgency patch-cycle item rather than an emergency.

An integer overflow in a Windows Kernel Mode Driver lets an attacker who has physical access to a machine elevate privileges to kernel level, with no authentication or user interaction required. Because the attack vector is physical (CVSS AV:P, PR:N, UI:N), exploitation is confined to hands-on scenarios such as an unattended, locked, or kiosk device, and the CISA SSVC assessment rates it non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. The resulting impact on confidentiality, integrity, and availability is high once triggered, and Microsoft has released patched builds covering Windows 10, Windows 11, and Windows Server editions.

Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.