Heap Overflow

Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.

Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.

Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.

Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.

Local privilege escalation in the Windows Kernel allows a low-privileged, authenticated attacker who already holds code execution on a target host to trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM-level privileges. The vulnerability is strictly local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it provides no remote or network path and is only useful as a post-compromise escalation step rather than an initial access vector. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with 'Automatable: no', because the attacker must already have a local foothold; Microsoft has published patched builds for the affected Windows 11 and Windows Server releases.

Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.

A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.

Heap-based buffer overflow in the Windows Win32 kernel subsystem lets a locally authenticated low-privilege attacker escalate to full system privileges on an affected host. Every supported Windows build in the EUVD-listed ranges is exposed by default - Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2 (including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations - until the corresponding cumulative update is applied; CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact on confidentiality, integrity and availability is total once the primitive is triggered. Microsoft has published fixes in its update guide, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none). The practical barrier is that the attacker must already hold local code execution on the target, making this a post-compromise privilege-escalation step rather than an initial-access vector.

Heap-based buffer overflow in the Windows kernel (CVE-2026-70106) allows an attacker who already holds low-privileged local code execution to elevate privileges on the affected host, scoring 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exposure is broad across build numbers - Windows 10, Windows 11 and Windows Server 2012 through 2025, including Server Core - but the attack is gated behind an existing local foothold, so it is a post-compromise escalation primitive rather than a remotely reachable one. Microsoft has released fixes through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).

Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.

Heap-based buffer overflow in the Windows Rich Text Edit Control (RichEdit) allows remote attackers to execute arbitrary code in the context of the rendering application when a victim processes attacker-supplied rich text, without any authentication prerequisite per the CVSS vector (AV:N/AC:L/PR:N). Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac are all listed as affected, so the exposure surface spans both the operating system and productivity applications that embed the control. Vendor patches are already available (MSRC advisory for CVE-2026-70096, EUVD-2026-99161), and no public exploit code or confirmed active exploitation has been identified at time of analysis - CISA's SSVC assessment records Exploitation: none while rating the flaw fully automatable with total technical impact, making pre-patch exposure the primary concern. Note that while the vendor vector marks UI:N, our independent assessment applies UI:R, because exploitation realistically requires the target to open or preview crafted rich text in a RichEdit-backed application, which constrains mass spray-and-pray campaigns.

Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.

Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.

Local privilege escalation in the Microsoft PostScript Printer Driver allows an attacker who gets a victim to open or print a crafted PostScript payload to trigger a heap-based buffer overflow (CWE-122) and execute code in the context of the affected Windows printing component. The flaw affects a broad range of Windows client and server builds - including Windows 10/11 and Windows Server 2012 through 2025 - that have not been updated to their fixed build revision. Per the CVSS vector the attacker needs no pre-existing account (PR:N), but exploitation is local (AV:L) and requires user interaction (UI:R), a crafted document must be processed on the target, and no public exploit code or active exploitation was identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no).

Heap-based buffer overflow in Microsoft Windows GDI (CWE-122) lets remote attackers achieve code execution on a fully updated-adjacent target by convincing a user to open or preview a maliciously crafted image or document that is parsed through the Windows Graphics Device Interface; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) indicates no authentication is needed but that the victim must interact with the attacker-supplied file. Code execution occurs in the security context of the user who opened the file, so the impact is bounded by that user's privileges and no scope change occurs. No public exploit code has been identified at time of analysis and the CISA SSVC decision framework records Exploitation: none with Automatable: no, while Technical Impact is rated total; there is no KEV listing, so this is a high-priority patching item rather than an emergency. Microsoft has published fixed builds covering Windows 10, Windows 11 and Windows Server 2012 through 2025.

Privilege elevation on unpatched Windows hosts is possible through a heap-based buffer overflow (CWE-122) in the Client-Side Caching (CSC) / Offline Files service, which caches content fetched from SMB network shares. The assessed vector (AV:N/AC:L/PR:N/UI:R) describes an unauthenticated remote attacker, but success hinges on a victim interacting - typically by connecting to or accessing an attacker-controlled share so CSC parses a crafted response and overflows a heap buffer - which is consistent with SSVC rating automatic exploitation as 'no' and with the SSVC exploitation signal of 'none'. Microsoft has released patches for every affected build, and no public exploit code has been identified at time of analysis, so this is a serious but not emergency-grade issue demanding prompt, scheduled patching rather than crisis response.

Local privilege escalation in the Microsoft Windows Win32 kernel subsystem allows an attacker who already holds low-privilege local access on a Windows host to corrupt heap memory and gain SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must be authenticated locally (PR:L, AV:L) and needs to run a crafted program that reaches the vulnerable kernel code path, with no user interaction required. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and vendor-released patches are available for all affected Windows client and server builds.

Local privilege escalation in Microsoft Windows OLE allows an authenticated attacker who already holds a low-privileged foothold on a host to corrupt heap memory through crafted OLE object handling and execute code at a higher integrity level, matching the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). Scope is limited to unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by EUVD; because the vector is local-only with PR:L, the flaw is not remotely reachable and cannot be triggered against a default configuration by an outside party. CISA SSVC rates exploitation as "none" and automatable as "no", there is no public exploit identified at time of analysis, and Microsoft has shipped fixes via its Update Guide, making this a credible but not emergency-level priority.

Heap-based memory corruption in the Windows NetBIOS component lets an authenticated local attacker with only low-privileged code execution elevate to SYSTEM on unpatched hosts. Exploitation requires an existing foothold - a valid local account and the ability to run code on the target - so this is a post-compromise escalation primitive, not a remote or initial-access vector; no user interaction is required (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). Microsoft has released fixes and CISA's SSVC assessment rates exploitation as 'none' and the issue as non-automatable, so despite a total technical impact this rates as a genuine but not emergency-tier priority; no public exploit code was identified at time of analysis.

Authenticated local code execution in Windows PowerShell affects Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025, where a heap buffer overflow triggered by crafted input lets a low-privilege local user run code at the level of the PowerShell process. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), and because the vector requires an existing local interactive session, the practical exposure is privilege escalation or post-foothold activity on shared hosts rather than a remote or unauthenticated attack. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has released fixed builds through the MSRC update guide.

A heap-based buffer overflow in the Windows Resilient File System (ReFS) driver (refs.sys) allows a locally authenticated, low-privileged attacker to corrupt kernel heap memory and elevate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already have a foothold on the host plus the ability to feed attacker-controlled input through the ReFS code path, which in practice means a ReFS-formatted volume must be present or mounted for the driver to process that input. Vendor patches are available per the Microsoft advisory, and no public exploit code has been identified at time of analysis (SSVC: Exploitation none, Automatable no); CISA's SSVC framing rates technical impact as total if successfully triggered, but the local-only, authenticated prerequisite and the non-default status of ReFS keep real-world urgency moderate.

Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.

Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.

Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an authenticated low-privileged user with an existing local foothold to corrupt heap memory in the host-side WSL components and cross a security boundary to gain elevated code execution, rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). The attack is entirely local - there is no network vector - and it requires the optional WSL feature to already be installed and enabled on an affected Windows 10, Windows 11 or Windows Server build, which meaningfully limits the exposed population since WSL is not present by default. Microsoft has published a fix through the MSRC update guide and there is no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none and automatable as no.

Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.

Local privilege escalation in Microsoft Windows NTFS (CVE-2026-70010) allows an authenticated, low-privileged user to corrupt kernel heap memory via crafted NTFS filesystem operations and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) in the in-kernel NTFS driver, rated CVSS 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold a local foothold on the host but needs no user interaction and faces low attack complexity. Exploitation is not remotely reachable over the network, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none'; patch availability is confirmed through the Microsoft MSRC update guide.

Heap-based buffer overflow in the Windows Libarchive component - the library Windows uses to extract 7z, rar, tar, cab and similar archive formats - lets a remote attacker execute arbitrary code with the privileges of the user who opens a malicious archive. Because exploitation is delivered over the network (AV:N) with no authentication required (PR:N) but demands that the victim open or process the crafted file (UI:R), the realistic attack path is a phishing email attachment, a web download, or a hosted share rather than anything wormable; CISA's SSVC decision framework reflects this with Exploitation=none and Automatable=no. There is no public exploit identified at time of analysis and vendor patches are available, so the practical priority is patch deployment rather than emergency containment - while noting the CVSS 8.8 score masks that the mandatory user interaction is the single factor keeping risk below critical.

Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.

Heap-based buffer overflow in the Microsoft Streaming Service (the Windows kernel streaming subsystem, including mskssrv) permits a locally authenticated attacker to elevate privileges on affected Windows hosts. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a privilege-escalation primitive, not a remote entry point - the attacker must already hold low-privileged local code execution on the target machine before it can be triggered, and no victim interaction is required (UI:N). At time of analysis there is no public exploit identified, CISA KEV does not list the CVE, and CISA's SSVC decision framework records Exploitation: none with Automatable: no, so this is a credible but not emergency-priority issue; a vendor patch is available and version-specific fixed builds are published in the Microsoft advisory.

Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.

Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.

Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.

Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.

A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.

Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.

Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.

Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.

Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.

Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.

Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.

Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.

Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.

Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.

Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.

Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an attacker who already holds authenticated, low-privilege code execution on a host to corrupt heap memory inside a highly privileged VBS component and elevate to full machine control (CVSS 7.8, C:H/I:H/A:H). Only unpatched Windows 11 24H2/25H2/26H1/26H2 builds and Windows Server 2025 (including Server Core) below the vendor's fixed build numbers are affected, and exploitation requires local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). No public exploit code has been identified at time of analysis and CISA SSVC records no known exploitation, making this a credible but not emergency-tier priority; Microsoft has released patched builds, so remediation is straightforward for managed fleets.

Heap-based buffer overflow in Microsoft Office Access allows remote code execution when a victim opens a malicious, attacker-crafted Access file such as an .accdb or .mdb database or an embedded object. Affected users are those with Access installed on the target host: no authentication to the system is required (PR:N) and attack complexity is low (AC:L), but exploitation is gated by the mandatory victim interaction (UI:R) of opening the crafted file, and any code executes only with the opening user's privileges (S:U). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the MSRC advisory is the authoritative reference, and CVSS 8.8 reflects high confidentiality, integrity, and availability impact, making this a credible operational priority rather than a drop-everything emergency.

Heap-based buffer overflow in Microsoft Access enables unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted database file. Exploitation is non-trivial due to high attack complexity (AC:H) and requires user interaction (UI:R), but successful exploitation grants code execution with the user's privileges. No public exploit code has been identified at time of analysis, and a vendor patch is available via the Microsoft Security Response Center.

Heap-based buffer overflow in Microsoft PowerPoint allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted presentation file, but exploitation requires user interaction and reliable heap corruption against modern memory-safety mitigations (AC:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is considered moderate-to-high due to the social engineering delivery and Protected View defenses that can impede successful attacks. This vulnerability affects Microsoft Office PowerPoint installations that have not received the update referenced in the Microsoft Security Update Guide.

Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a victim opens a specially crafted Access database file, with an attacker needing no credentials but depending on user interaction to trigger the flaw. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning successful exploitation yields full loss of confidentiality, integrity, and availability within the Access process context, though the mandatory opening of the malicious file limits automated, hands-off exploitation. Based on available intelligence, no public exploit identified at time of analysis and EPSS scoring was not supplied; the entry appears only in the Microsoft Security Response Center update guide, and no CISA KEV listing or other exploitation signal is present.

Heap-based buffer overflow in Microsoft Office Access lets unauthenticated remote attackers execute arbitrary code in the context of the user who opens a specially crafted Access database (.accdb/.mdb) file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms that no credentials are required and attack complexity is low, but the mandatory user interaction (UI:R) - typically a phishing attachment, download, or shared file - is the gating factor that prevents automated, widespread exploitation; code runs only with the privileges of the user who opened the file. There is confirmed KEV? no - no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so this is a credible, patchable priority rather than an actively exploited emergency.

Remote code execution in Microsoft Office Access occurs when a victim opens an attacker-supplied, specially crafted Access database file that triggers a heap-based buffer overflow during file parsing (CWE-122). The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): it is network-deliverable, low-complexity and needs no authentication, but is gated entirely by the requirement that a user open the malicious document, and scope is unchanged so code runs in the victim's user context rather than granting system-wide control. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.

Heap-based buffer overflow in Microsoft Access allows unauthenticated remote attackers to execute code when a victim opens a maliciously crafted Access database, scoring CVSS 8.8. Exploitation requires user interaction (UI:R), so there is no zero-click or server-side vector, and code runs in the context of the user who opens the file, limiting immediate blast radius. No public exploit identified at time of analysis; this is serious but not emergency-tier because the victim must open the attacker-supplied file.

Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute code in the security context of the user who opens a specially crafted Access database file. Exploitation is not autonomous despite the AV:N vector: the attacker must deliver the malformed file and persuade the victim to open it (UI:R), and reliable code execution further depends on heap-layout grooming to control the corrupted allocation (AC:H), so any code that runs inherits only the opening user's privileges (S:U). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the assessed risk is mixed-priority given the mandatory user interaction and high attack complexity.

Heap-based buffer overflow in Microsoft Office Access allows unauthenticated remote attackers to execute arbitrary code when a victim opens a maliciously crafted Access database file. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), and successful exploitation grants code execution with the privileges of the current user (S:U). No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (8.8) and low attack complexity make this a significant risk for organizations using affected Access versions.

Remote code execution in Microsoft QUIC (msquic) allows unauthenticated network attackers to execute arbitrary code via a heap-based buffer overflow (CWE-122). Per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, no authentication or user interaction is required, and the flaw carries full confidentiality, integrity, and availability impact (base score 9.8). Only hosts exposing a QUIC/HTTP-3 or SMB-over-QUIC listener over UDP (typically port 443) are affected, and successful exploitation depends on defeating standard heap and control-flow mitigations; no public exploit has been identified at time of analysis.

Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.

Arbitrary code execution in Adobe FrameMaker is possible via a heap-based buffer overflow (CWE-122) that is triggered when the victim opens a specially crafted file. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.8) indicates the flaw is local to the desktop application, requires user interaction, needs no prior authentication, and gives the attacker only the privileges of the user who opens the document. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the main risk is social engineering against FrameMaker users.

Heap-based buffer overflow in Adobe FrameMaker (CWE-122) lets an attacker achieve arbitrary code execution in the context of the user who opens a crafted FrameMaker document. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no prior authentication or privileges are needed, but exploitation depends on the victim opening an attacker-supplied file, and code runs only with that user's rights due to unchanged scope. Impact is therefore bounded by the victim's privilege level and by successful social engineering; there is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited.

Heap-based buffer overflow in Adobe FrameMaker enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) confirms the attack is local and requires user interaction, with no privileges needed to trigger the flaw but no remote or automatable path either. No public exploit was identified at time of analysis, exploitation is bounded to systems where FrameMaker is installed and used to open untrusted documents, and code runs only with the current user's privileges - there is no automatic elevation of privilege.

Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.

Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.

Heap-based buffer overflow in Microsoft OneNote allows unauthenticated remote attackers to execute arbitrary code in the security context of the user who opens a crafted OneNote file, rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation is not zero-click: per the UI:R component of the assessed vector, the victim must open or preview an attacker-supplied OneNote/Office document delivered by email, web, or file share, and code then runs with that user's privileges without scope change (S:U), so no inherent privilege escalation is provided. No public exploit identified at time of analysis and the CVE is not in CISA KEV; no EPSS score was supplied in the available data.

Heap-based buffer overflow in Microsoft Office Visio enables remote code execution when a victim opens a maliciously crafted Visio drawing file (CVSS 8.8, CWE-122). The attack is unauthenticated (PR:N) and remotely deliverable (AV:N), but requires user interaction (UI:R): the target must have the separately licensed Visio application installed and must be persuaded to open the attacker-supplied file, typically delivered by phishing email or a hosted download. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; real-world risk is materially reduced by Protected View, Mark-of-the-Web, attachment blocking, and the fact that Visio is not present in most Office installations.

Heap-based buffer overflow in Microsoft Visio allows remote, unauthenticated attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document. Exploitation is not zero-click: it requires user interaction (UI:R), with the malicious file typically delivered as an email attachment or download link that the victim must open, and no credentials or special target-side configuration are needed (PR:N). No public exploit code or confirmed active exploitation is identified in the available data, no EPSS score was supplied, and Microsoft's MSRC Update Guide is the authoritative reference for fixes.

Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute arbitrary code in the security context of the user who opens a crafted Access database file. Exploitation is gated by user interaction (UI:R) - the victim must open an attacker-supplied file delivered by email, web download, or shared location - with low attack complexity (AC:L) and no credentials required from the attacker (PR:N), and code runs as the invoking user rather than as SYSTEM. Rated 8.8 (C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and environments that do not install or use Access are not exposed.

Remote code execution in Microsoft Access is possible when a user opens a specially crafted Access file, exploiting a heap-based buffer overflow (CWE-122) to let an unauthenticated attacker execute code in the context of the victim. Affected are systems with Microsoft Access installed; the attack requires user interaction (UI:R in the CVSS vector) and no public exploit code or confirmed active exploitation is identified at time of analysis, though the vendor advisory should be consulted for updates.

Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.

Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.

Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.

Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.

Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.

Local privilege escalation in the Windows Storage component lets an authenticated, low-privileged user already running code on a Windows host drive a heap-based buffer overflow to gain high-integrity (SYSTEM-level) privileges. Exploitation is not remote: it requires an existing local session (CVSS AV:L, PR:L) and no user interaction (UI:N), but the high attack complexity (AC:H) means the attacker must win a non-deterministic heap-layout or timing condition, which makes reliable weaponization harder than a typical PR:L/AC:L elevation-of-privilege bug. At the time of analysis there is no public exploit identified, no EPSS or KEV signal in the provided intelligence, and the authoritative source for fixed builds is the Microsoft MSRC update guide; the moderate-priority character of this issue reflects that prior host access is a hard prerequisite and success is probabilistic.

Heap-based buffer overflow in the Windows Storage subsystem (CWE-122) allows an authenticated local attacker holding low privileges to elevate to a higher-privileged context on the affected host. The CVSS vector (AV:L/AC:H/PR:L/UI:N) and the assessment confirm the attacker must already be able to execute code locally and that exploitation is gated by high complexity, most likely a race condition or a carefully groomed heap layout, making success unreliable rather than repeatable. This is a moderate-priority local privilege-escalation issue rather than a remote emergency; no public exploit identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV). The supplied data does not enumerate affected Windows builds, so the MSRC update guide must be consulted for the precise vulnerable and fixed versions.

Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).

Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.

Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.

Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.

Heap-based buffer overflow in Microsoft Excel enables an unauthenticated, remote attacker to execute arbitrary code in the context of the victim user, provided the victim opens or previews a specially crafted Excel workbook (CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation depends on social engineering to deliver the malicious file, and default Office protections such as Protected View and Mark-of-the-Web meaningfully reduce real-world risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and signals are moderately strong but not top-tier urgent.

Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.

Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.

A heap-based buffer overflow in Commvault MediaAgent (and the associated HyperScale deployment) can be triggered over the network by an unauthenticated attacker, causing the service to crash and denying backup/data-protection availability. The affected component is the MediaAgent service within Commvault Cloud; per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, though exploitation depends on the attacker being able to reach the MediaAgent/HyperScale service port, so firewall-segmented backup networks are materially less exposed. Impact is confined to availability (VA:H, with VC:N/VI:N), and there is no public exploit identified at time of analysis; CISA KEV does not list this issue. The input assigns CVSS 4.0 base 8.7 (HIGH); the independent assessment scores it 7.5 (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and both agree the effect is denial of service only.

Heap buffer overflow in Wazuh Manager's File Integrity Monitoring alert generation lets an enrolled agent corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage across all monitored endpoints. Affected versions are Wazuh 3.12.0 through 4.14.7, fixed in 4.14.8; the attacker must hold a valid agent enrollment key (PR:L, authenticated), and because FIM/syscheck is enabled by default on agents no special manager-side configuration is required. The vendor CVSS 4.0 score of 7.1 (HIGH) is driven almost entirely by availability impact (VA:H), and no public exploit code has been identified at time of analysis.

Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.

Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 release trains, where a heap-based buffer overflow caused by improper bounds checking lets an attacker who can reach the appliance's request-processing path corrupt heap memory and run arbitrary code with full confidentiality, integrity and availability impact. The flaw is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required, and it is exploitable over the network. There is no public exploit identified at time of analysis and it is not confirmed actively exploited (no CISA KEV listing); IBM has published a vendor fix, and this is a genuine high-priority issue rather than an inflated high-CVSS score.

Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is caused by a heap-based buffer overflow that a remote attacker can trigger without authentication or user interaction, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) with total impact to confidentiality, integrity, and availability. Exploitation is not confirmed by any signal: no public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, SSVC reports Exploitation=none with Automatable=no, and EPSS is only 0.37% (29th percentile). The practical risk therefore hinges on whether affected DataPower builds are reachable from untrusted networks, since IBM has published a fix and the high base score reflects worst-case impact rather than observed attack activity.

Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailServer account - crash the mail server service and potentially execute code in its LocalSystem security context by passing an over-long hexadecimal string to the unauthenticated COM method Utilities.BlowfishDecrypt, which copies input of arbitrary length into a fixed 255-byte heap buffer. Because exploitation requires an existing local login (CVSS AV:L/PR:L) and the only confirmed outcome is a service crash, this is an access-gated local privilege-escalation/denial-of-service issue rather than a remotely wormable emergency; no public exploit identified at time of analysis. Vendor fix is available in hMailServer 6.3.4, which contains the reference commit 135a1908ff820ed587d5f180f98c53bd010d8931.