Denial of Service

Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.

Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.

Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.

Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.

Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.

Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.

Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.

Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).

Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.

Use-after-free in Microsoft Office PowerPoint enables remote code execution when a victim opens a specially crafted PowerPoint document. The vulnerability affects PowerPoint 2016, 2019, Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac across multiple build versions, spanning virtually the entire active Office install base. Vendor patches have been released; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.

Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.

Use-after-free in the Windows Device Association Service enables a local low-privileged attacker to escalate to full system-level privileges across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability stems from improper memory management in the service responsible for pairing devices, where a freed memory region can be reused to redirect execution. Microsoft has released patches addressing all affected builds; no public exploit or CISA KEV listing is recorded at time of analysis, though the high-complexity (AC:H) requirement means reliable exploitation demands careful timing or race-condition abuse.

Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.

Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.

Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Remote code execution in Microsoft Office via a use-after-free (CWE-416) memory corruption flaw allows a network-adjacent or remote attacker to execute arbitrary code on the victim's machine. The attack is client-side: the attacker delivers a maliciously crafted Office document, which when opened by the user triggers the UAF condition. Affected products span the full Office family including LTSC 2021, LTSC 2024, Office 2019, Microsoft 365 Apps for Enterprise, and Mac variants; a vendor patch is available.

Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Shell on Windows 11 (versions 23H2 through 26H1) and Windows Server 2025 stems from a use-after-free memory corruption flaw (CWE-416). An authenticated local attacker who triggers the race-condition-sensitive bug can achieve full system compromise with C:H/I:H/A:H impact, yielding effective SYSTEM-level control. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has confirmed and patched the issue across all affected builds as documented in EUVD-2026-73549.

Remote code execution is possible in Windows Remote Desktop Services via a use-after-free memory corruption flaw, affecting Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. An authenticated, network-connected attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system. CVSS 7.5 (AV:N/AC:H/PR:L) reflects that exploitation requires low-privilege authentication and high attack complexity, making opportunistic mass exploitation less likely; no public exploit has been identified at time of analysis.

Privilege escalation via use-after-free in the Windows HTTP.sys kernel-mode driver allows a low-privileged authenticated attacker to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2025 hosts via a network attack path. The vulnerability (CWE-416) carries CVSS 7.1 with AC:H and UI:R, indicating a race-condition-dependent exploit requiring specific concurrent conditions rather than a simple reliable trigger. No public exploit identified at time of analysis; Microsoft has released cumulative update patches for all affected builds.

Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.

Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows unauthenticated remote attackers to crash the IKE service and deny VPN/IPsec negotiation to legitimate users. Affected systems span Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. Microsoft has released patches via the Security Response Center update guide; no public exploit code or CISA KEV listing exists at time of analysis.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.

Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.

Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.

Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.

Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.

Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.

Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.

Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.

Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.

Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.

Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.

Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.

Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.

Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.

Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.

Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.

Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.

Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.

Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.

Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.

Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.

Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.

Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.

Use-after-free memory corruption in Microsoft SQL Server enables a network-authenticated low-privileged attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. Affected versions span all actively serviced SQL Server releases from 2017 through 2025, across both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication barrier (any valid SQL Server login) and network accessibility make this a high-priority patching target in enterprise environments.

Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.

Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.

Unthrottled resource allocation in Microsoft.AspNetCore.OData exposes ASP.NET Core applications to network-based denial of service by unauthenticated remote attackers. The root cause (CWE-770) allows crafted OData protocol requests - such as deeply nested $expand, expensive $filter expressions, or unbounded batch operations - to consume server memory or CPU without limit until the service becomes unavailable. Microsoft has released a patch via the MSRC advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.

MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.

Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.

Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.

Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.

Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.

MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.

Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.

Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.

Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.

Denial of service in Snipe-IT before 8.7.1 allows authenticated users to exhaust PHP worker CPU by submitting arbitrarily large values in the note field of the POST /account/accept/{acceptance} endpoint. The unbounded input is passed directly to synchronous CommonMark markdown rendering during acceptance notification email generation, consuming worker CPU proportional to input size on every request. No public exploit code has been identified at time of analysis, but the attack is straightforward for any authenticated user and requires no special privileges beyond a valid account.

Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.

Use-after-free memory corruption in Arm's Bifrost, Valhall, and 5th Gen GPU userspace drivers allows a local non-privileged process - including through browser-exposed WebGL or WebGPU operations - to access already-freed memory regions, achieving full confidentiality, integrity, and availability impact. The flaw spans driver revisions from r42p0 through r55p0 across all three GPU families, covering a substantial portion of the Android Mali GPU ecosystem deployed in MediaTek and Samsung Exynos SoCs. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), but the WebGL/WebGPU trigger path is a notable attack surface reduction that warrants prompt patching on affected devices.

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers enables a local unprivileged process to access deallocated kernel memory through valid GPU memory processing operations, resulting in full confidentiality, integrity, and availability compromise (CVSS C:H/I:H/A:H). The flaw spans broad version ranges across all three driver families from r44p0 through r54p3/r55p0, affecting a large population of devices built on Arm Mali GPU hardware. No active exploitation is confirmed at time of analysis (EPSS 0.14%, no CISA KEV listing), but UAF vulnerabilities in kernel-mode GPU drivers are a well-established and historically weaponized local privilege escalation vector on Android and Linux platforms.

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed GPU memory, yielding full confidentiality, integrity, and availability impact within the kernel driver context. Affected revisions span a wide range across all three driver families - from r49p3 through r55p0 depending on the product line - placing a large population of Android and embedded Arm devices in scope. No public exploit code exists at time of analysis, and EPSS sits at 0.14% (4th percentile), though the low-complexity local attack surface characteristic of GPU driver UAFs has historically attracted sophisticated actors targeting mobile platforms.

Use-after-free in Arm's Valhall and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed kernel memory by submitting valid GPU processing operations, with potential for full system compromise across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H). Both driver families are affected from r50p0 through r54p3 and at r55p0, covering a wide swath of devices - notably Android smartphones and embedded SoCs - that rely on these GPU drivers. No active exploitation is confirmed (EPSS 0.14%, 4th percentile; no CISA KEV listing) at time of analysis.

Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.

HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block all server threads by exploiting a race condition in RST_STREAM and GOAWAY frame handling. The race incorrectly resets the `HTTP2Flusher.terminated` field from a non-null terminal state back to null, allowing new write-queue entries to be enqueued in a flusher that will never drain them; the write-blocked threads waiting on those entries hang indefinitely. Across five affected Jetty major branches (9.4, 10.0, 11.0, 12.0, 12.1), any internet-exposed HTTP/2 endpoint is reachable without authentication. No public exploit has been identified at time of analysis.

Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.

Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.

Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.

Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.

The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.

Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.