Memory Corruption

Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of the current user when a victim opens or previews a specially crafted spreadsheet, making this a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no credentials or pre-existing privileges are needed, but because user interaction is required (UI:R) and no non-default configuration is involved, exploitation depends on social engineering - typically a phishing attachment, a malicious link, or a web-hosted document - rather than direct remote triggering. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per Microsoft's advisory.

Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.

Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.

Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.

Local privilege escalation in Microsoft OneNote stems from a use-after-free memory corruption flaw (CWE-416) that an authenticated attacker with low-privilege local access can trigger to execute code in a higher-privileged context. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the corresponding Mac editions. No public exploit has been identified at time of analysis, and vendor patches are available; given the local access prerequisite and patch availability, this is a patch-priority item rather than an emergency.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.

Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.

Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.

Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.

Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.

Local privilege escalation in the Windows Client License Service allows an authenticated low-privileged attacker to gain SYSTEM-level code execution by triggering a use-after-free (CWE-416) with a crafted local process, with high impact to confidentiality, integrity, and availability. Affected are unpatched Windows 10, Windows 11, and Windows Server builds (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2022 below 10.0.20348.5761); exploitation requires pre-existing local low-privileged access (CVSS AV:L/PR:L, UI:N) and no public exploit or active exploitation is identified at time of analysis, with SSVC reporting exploitation: none. This is a credible but not emergency-priority local privilege escalation driven by a post-foothold memory-corruption primitive.

Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.

Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.

Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.

Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows USB Print Driver lets an authenticated attacker who already holds a foothold on a vulnerable Windows host corrupt kernel memory and obtain SYSTEM-level code execution. The flaw is a use-after-free (CWE-416) reachable only through the USB printing driver path; the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, base 7.0) requires valid local credentials and a successful race on freed kernel memory, so exploitation is timing-dependent, non-deterministic, and rated non-automatable by CISA SSVC. Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases, and no public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.

Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.

Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an attacker who already holds low-privileged code execution on a WSL-enabled host to trigger a use-after-free and obtain full control over confidentiality, integrity, and availability (CVSS 7.8, CWE-416). Exploitation is strictly local (AV:L) and requires an existing account or foothold with low privileges (PR:L), but needs no user interaction and has low attack complexity, so a reliable trigger is plausible once the prerequisites are met; hosts where the optional WSL feature is not installed are not exposed. No public exploit code and no confirmed active exploitation have been identified, and Microsoft has released fixed builds for every affected Windows 10, Windows 11, and Windows Server version, so patching is the decisive risk-reduction step.

Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.

Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.

A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.

A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.

A use-after-free in the Windows USB Print Driver (CWE-416) allows an attacker who already holds low-privileged local access to a Windows host to escalate privileges and obtain full control over confidentiality, integrity, and availability of the affected system. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025 (including Server Core installations), per the EUVD version ranges. Exploitation requires winning a timing-dependent race in the driver (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), which CISA's SSVC rates as not automatable, and no public exploit has been identified at time of analysis - this is a post-compromise privilege-escalation primitive rather than an opportunistic remote threat, and Microsoft has shipped a vendor update addressing it.

Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.

Local privilege escalation in the Windows USB Print Driver (usbprint.sys) lets an authenticated, low-privileged user on the target host raise their privileges to SYSTEM by winning a use-after-free race in the driver's request-handling path. CVSS 3.1 scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker must already have a foothold on the machine, no user interaction is needed, and the high attack complexity reflects the probabilistic nature of reclaiming the freed object. The affected builds are Windows 10 21H2/22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2022 and Windows Server 2025 (including Server Core); no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and Microsoft has published fixes, so this is a moderate-priority local escalation rather than an emergency remote threat.

Local privilege escalation in the Microsoft Windows Win32 kernel subsystem lets an authenticated attacker holding low-privileged access on an affected host corrupt kernel memory via a use-after-free race and escalate to full system privileges. Microsoft rates it CVSS 7.8 (AV:L/PR:L/UI:N, with high confidentiality, integrity and availability impact) and has shipped fixed builds for Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025; no public exploit identified at time of analysis, and CISA's SSVC assessment records no known exploitation and marks the flaw as not automatable, since winning the UAF timing is attacker-dependent rather than reliably scriptable. Because the vector is entirely local and requires prior code execution in a low-privilege context, this is a credible but not emergency-level priority - it matters most as a post-compromise elevation step on unpatched builds.

Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.

Out-of-bounds write in Microsoft .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio 2022/2026 can allow an unauthenticated remote attacker to execute code when a victim processes crafted input, per CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). This is a genuinely high-priority, patch-worthy flaw but with important caveats that lower its real-world urgency relative to its 8.8 CVSS: exploitation requires user or application interaction to process the malicious input, and no public exploit has been identified at time of analysis. Vendor-released patches are available as .NET 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2, plus Visual Studio 17.14.42 and 18.10.4.

An out-of-bounds write (CWE-787) in ASP.NET Core and the associated .NET runtimes lets a remote, unauthenticated attacker trigger memory corruption that crashes or destabilizes a network-reachable service, yielding a full loss of availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires no credentials, no user interaction, and no special configuration - only that the target endpoint be reachable and running an unpatched build (for example .NET 8.0 below 8.0.32, .NET 9.0 below 9.0.21, or .NET 10.0 below 10.0.13). There is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as "none" while marking the flaw fully automatable, so scripted denial-of-service attempts remain a plausible near-term risk; vendor patches are available.

Remote code execution in Microsoft .NET allows an unauthenticated attacker to execute arbitrary code when a legitimate user opens or loads crafted content that triggers an out-of-bounds write in the runtime. The flaw affects a broad range of .NET Framework versions (3.5 through 4.8.1), modern .NET 8.0, 9.0, 10.0, and 11.0 preview, plus Visual Studio 2022 and 2026. No public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates the issue as non-automatable, though the mandatory user interaction and wide deployment make patching critical for unpatched systems.

Local privilege escalation in Windows Hyper-V allows an authenticated, low-privileged user on a Hyper-V-enabled Windows host to trigger a use-after-free and execute code at a higher integrity level, ultimately reaching SYSTEM-level privileges on the host. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 builds prior to their fixed levels, and is only reachable once the attacker already holds local access on a system where the Hyper-V role is enabled. No public exploit identified at time of analysis, and CISA's SSVC decision framework records exploitation as none with the attack assessed as not automatable.

Remote code execution in Microsoft Windows Local Security Authority Subsystem Service (LSASS) affects multiple Windows 10, Windows 11, and Windows Server builds, allowing an unauthenticated network attacker to trigger an out-of-bounds write that can lead to code execution with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and exploitation requires only network reachability to an exposed LSASS interface on an unpatched host. No public exploit was identified at time of analysis and CISA SSVC records Exploitation: none and Automatable: no, but the unauthenticated remote vector makes this a top-priority vulnerability to patch; Microsoft has released a vendor patch.

Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.

Local privilege escalation in the Windows Desktop Window Manager (DWM) allows an authenticated local attacker with low privileges to execute arbitrary code at a higher integrity level, typically SYSTEM, on affected Windows 10, 11, and Server installations. The flaw is a use-after-free (CWE-416) in DWM, requiring no user interaction (UI:N) and only low privileges (PR:L), so any unprivileged process on a vulnerable build can trigger it. Microsoft has released patches, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.

Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privileges of the opening user by delivering a specially crafted presentation that must be opened or rendered. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions; vendor patches are available. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none', though the raw CVSS score is 9.8 because successful exploitation yields total confidentiality, integrity, and availability impact.

An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.

Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.

A use-after-free in the Windows Background Intelligent Transfer Service (BITS) lets an attacker who already holds low-privilege local code execution on a Windows host elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The service ships by default on every supported Windows client and server edition, but the flaw is a post-compromise escalation primitive rather than an initial-access vector - there is no remote or network-reachable path and no victim interaction is required, so exploitation is limited to hosts where an attacker or malware is already running as a standard user on a pre-patch build. Microsoft has released fixes; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), making this a genuine patch-priority item rather than an emergency. Patched builds are enumerated per Windows version (for example Windows 11 24H2 fixed in 10.0.26100.9711, Windows Server 2022 in 10.0.20348.5761), so only unpatched systems remain exposed.

Use-after-free memory corruption in Microsoft PowerPoint enables unauthenticated remote attackers to execute arbitrary code on a victim's machine when a maliciously crafted presentation is opened. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no authentication is required, but exploitation depends on the target opening the attacker-supplied file, making email attachments, chat-delivered documents, and shared links the practical delivery vectors. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the macOS Office SKUs; the vendor has released updates, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows Kernel lets an authenticated attacker who already has low-privileged code execution on the host win a use-after-free race condition to obtain SYSTEM-level rights, yielding full compromise of confidentiality, integrity, and availability (CVSS 7.0, CWE-416). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds in the ranges listed by Microsoft are affected; the flaw is not remotely reachable, requires local authenticated access, and carries high attack complexity, so exploitation is likely unreliable and may need repeated attempts. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, not in KEV), and vendor patches are available, making this a credible but not top-tier priority for most environments.

Local privilege escalation in the Windows Kernel (CWE-416 use-after-free) affects Windows 11 versions 24H2, 25H2, 26H1, 26H2, and Windows Server 2025 including Server Core; an authenticated attacker with low privileges can exploit this to gain kernel-level or SYSTEM privileges on the local machine. The vulnerability requires local access and high attack complexity (likely a race condition or specific heap state), with no remote vector and no user interaction required; SSVC reports exploitation none and no public exploit identified at time of analysis. Microsoft has released patches addressing the issue, and updating to the fixed builds removes the vulnerability.

Local privilege escalation in the Microsoft Windows Kernel lets an attacker who already holds authenticated, low-privileged local code execution on a target host elevate to SYSTEM-level rights by triggering a use-after-free memory corruption condition. The flaw affects a broad range of unpatched Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - and Microsoft has published a fixing update via its MSRC advisory. No public exploit code or active exploitation has been identified at time of analysis: CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so this is a genuine but moderate-priority, patch-now issue rather than a top-tier emergency.

Local privilege escalation in the Windows SMB Server allows an authenticated, low-privileged user with local logon rights to trigger a use-after-free in the SMB server component and obtain code execution at a higher integrity level, with high impact across confidentiality, integrity and availability. The flaw spans a wide range of Windows client and server branches - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - and is constrained by the local vector (AV:L, PR:L) plus a non-default timing/memory precondition (AC:H), meaning the freed object must be won through a race or specific reuse state rather than reliably on a first attempt. Vendor patches are available for every affected branch and no public exploit code had been identified at time of analysis; this is a moderate-priority local escalation rather than a top-tier emergency, since it presupposes an existing foothold and an unreliable exploitation window.

Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free inside the installer service and gain elevated (SYSTEM-level) code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0): the attacker must win a non-deterministic race/heap-grooming window to reclaim the freed object, so the technique is not consistently reliable, and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation: none and Automatable: no. Vendor patches are available for the full affected build matrix spanning Windows 10 and Windows 11 (through 26H2) as well as Windows Server 2012 through Windows Server 2025, so this is a genuine but second-tier priority relative to remotely exploitable or actively exploited issues.

Use-after-free in the Windows Background Intelligent Transfer Service (BITS) allows an attacker who already holds low-privilege credentials and occupies an adjacent network position - the same broadcast domain or a logically adjacent segment - to corrupt memory and execute code in the context of the BITS service on Windows 10, Windows 11 and Windows Server 2012 through 2025. No user interaction is required and BITS is installed and running by default on every affected build, but the AV:A/PR:L prerequisites place this firmly outside the pre-authentication, internet-wide exploitation class. There is no public exploit code identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and vendor patches are available; the realistic reading is a genuinely serious, patch-now flaw rather than an inflated high-CVSS emergency, with priority going to segmented environments that still expose adjacency and to hosts where low-privilege accounts are widely held.

Remote code execution in the Windows DHCP Server role allows an unauthenticated attacker who can reach the service on UDP port 67 to corrupt memory via a use-after-free and potentially execute code with the privileges of the DHCP service. Affected builds span Windows Server 2012 through Windows Server 2025, including Server Core installations, below the fixed versions published by Microsoft; the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no authentication or user interaction is required, but the high attack complexity reflects a race-condition-style heap corruption that is not guaranteed to succeed on a single attempt. There is no public exploit identified at time of analysis and no confirmed active exploitation, so risk is driven primarily by the total technical impact (memory corruption with full confidentiality, integrity and availability loss) rather than by observed attacker activity.

Unauthenticated remote code execution in Microsoft's Windows DHCP Server affects Windows Server 2012 through Windows Server 2025 (including Server Core installations) that have the DHCP Server role installed and reachable over the network. A use-after-free (CWE-416) in the DHCP service lets a network attacker corrupt memory and potentially execute code, but the CVSS AC:H rating reflects a race/timing-dependent condition that makes reliable exploitation harder than a deterministic request. No public exploit code was identified at time of analysis, and vendor patches are available; the DHCP role is non-default and typically only present on infrastructure servers acting as DHCP providers.

Remote code execution in Windows DHCP Server is possible through a use-after-free that can be triggered by unauthenticated, network-adjacent attackers against Windows Server systems where the optional DHCP Server role is enabled and reachable. The assessed CVSS vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, and affected builds include Windows Server 2012 through Server 2025, including Server Core installations. Vendor patches are available, and available intelligence indicates no public exploit identified at time of analysis and no confirmed active exploitation, so this is a credible high-priority patching target rather than an emergency under active attack.

Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds authenticated low-privilege code execution on a Windows 10 or Windows 11 host win a race against freed memory in the Game DVR capture component and take over the service with elevated (SYSTEM-level) rights. The flaw is a use-after-free (CWE-416) with High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) because the timing window must be reliably won, so no public exploit has been identified at time of analysis and the CISA SSVC assessment rates the issue not automatable with exploitation status 'none'. Microsoft has released vendor patches; affected builds span Windows 10 1809, 21H2 and 22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2.

Local privilege escalation in Microsoft Office Click-To-Run allows an attacker who already holds a low-privileged foothold on a Windows host to turn a use-after-free (CWE-416) memory-corruption flaw into full compromise of the affected process context, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and no user interaction required. The affected deployments are Microsoft Office installed and serviced through Click-To-Run: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Because the vector is AV:L/PR:L, this is an authenticated, post-access escalation primitive rather than a remote or unauthenticated attack path, and no public exploit code or confirmed active exploitation was identified at the time of analysis; Microsoft has released patched builds. The practical risk is bounded by the prerequisite initial foothold, and reliable exploitation additionally depends on winning the heap reuse/grooming required to control the freed object.

A use-after-free in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets a locally authenticated attacker on a vulnerable Windows host elevate privileges to SYSTEM by winning a narrow timing window in which a freed kernel object is reclaimed before deletion completes. Because exploitation requires the attacker to already hold low-privileged local access (PR:L), it is a post-compromise privilege-escalation primitive rather than a remote entry point, and the high attack complexity (AC:H) means success is neither trivial nor deterministic. Microsoft has released fixes for all affected Windows 10, Windows 11, Windows Server 2019/2022/2025 builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.

Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated, low-privileged attacker who already holds a foothold on the host win a use-after-free and gain SYSTEM-level code execution. Exploitation requires winning a timing-dependent race against the service (AC:H), with no user interaction needed, and affects Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019 including Server Core builds below the patched levels. There is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis; a vendor patch is available and the issue is assessed as a genuine but non-urgent High-severity local elevation-of-privilege flaw (CVSS 7.0, EPSS-level urgency not elevated).

Unauthenticated remote code execution is possible against Windows Failover Cluster through a use-after-free in the cluster service, affecting Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations, whenever the Failover Clustering role is installed and running. Signals diverge sharply: Microsoft and NVD publish a 9.8 score with AV:N/AC:L/PR:N/UI:N, while the independent assessment re-scores attack complexity as High (AC:H) because the clustering role is not a default configuration, the service normally lives on segmented management/heartbeat networks rather than exposed public interfaces, and reliably converting a freed object into controlled execution requires precise timing. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" while rating the flaw fully automatable with total technical impact if the service is reachable; if that reachability exists, impact is complete loss of confidentiality, integrity, and availability.

Local privilege escalation in the Windows Storage Spaces Controller lets an attacker who already holds a low-privileged, authenticated session on an affected Windows host trigger a use-after-free and run code at a higher integrity level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction and no remote reachability - the foothold is the barrier, not the exploitation itself. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis; patched vendor builds (e.g., Windows 11 24H2 at 10.0.26100.9711 or later, Windows Server 2025 at 10.0.26100.33650 or later) are not exploitable, so the practical risk sits with unpatched, already-compromised or insider-accessible endpoints and servers.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.

Local privilege escalation in the Windows Graphics Kernel allows an attacker who already holds low-privileged code execution on a target host to elevate to SYSTEM through a use-after-free (CWE-416) memory corruption flaw in the kernel-mode graphics subsystem. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is authenticated in the sense that the attacker must already have a local foothold; no user interaction is required and there is no remote or network vector, so this is a post-compromise escalation primitive rather than an initial access path. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2025 (including Server Core installations); no public exploit code has been identified at time of analysis, EPSS is low at 0.27% (17th percentile), CISA SSVC records no known exploitation, and a vendor patch is available.

Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.

Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.

A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.

Local privilege escalation in Microsoft's Windows Installer service lets an attacker who already holds authenticated low-privilege local access free and then reuse a memory object, potentially seizing control of the SYSTEM-level installer process. Exploitation hinges on winning a non-deterministic race/timing window (AC:H, PR:L, AV:L), so CISA's SSVC rates exploitation as 'none' and automatable as 'no'; no public exploit identified at time of analysis and the flaw is not in CISA KEV, though the technical impact if successfully triggered is total (full confidentiality, integrity and availability loss). Microsoft has released vendor patches covering all affected Windows 10, Windows 11 and Windows Server builds.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already possesses low-privilege code execution on a Windows host to corrupt memory via a use-after-free and elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is not remotely reachable and needs pre-existing local access; the high attack complexity reflects a race/heap-reuse condition that makes exploitation timing-dependent, and no public exploit identified at time of analysis. Microsoft has released a vendor patch.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated, low-privileged code execution on a host to trigger a use-after-free in the installer service and execute code in a higher-privileged context. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-416), the flaw requires an existing foothold and is therefore a second-stage escalation primitive rather than a remotely reachable or pre-authentication vector, with no user interaction needed once that local access exists. No public exploit code has been identified at time of analysis, and no confirmed active exploitation has been reported; Microsoft has released fixes covering all supported Windows client and server branches, including fixed builds such as 10.0.26100.9711 for Windows 11 24H2 and 10.0.26100.33650 for Windows Server 2025.

Local privilege escalation in the Microsoft Windows Installer service (msiexec) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to elevate to higher integrity - ultimately SYSTEM-level privileges - by triggering a use-after-free (CWE-416) in the packaging/installation code path, achieving full loss of confidentiality, integrity, and availability for the affected host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a broad set of supported Windows client and server platforms, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, all default installations of the core OS component. Because the vector requires AV:L and PR:L, this is a post-compromise escalation step rather than an initial-access vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; Microsoft has published vendor fixes as part of its monthly security update.

Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authorized low-privilege user elevate to SYSTEM by triggering a use-after-free memory-corruption condition in the installer service. Exploitation is confined to unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 hosts, and requires a valid local account plus high attack complexity because the primitive depends on precise object-lifetime/timing conditions (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, 7.0); no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Microsoft has released patched builds for every affected branch, so exposure is limited to systems that have not yet applied the current cumulative updates.

Local privilege escalation in Windows Management Services lets an authenticated attacker who already holds a standard-user session on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host drive a use-after-free to gain high-integrity code execution with full confidentiality, integrity, and availability impact on the affected machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is only reachable after the attacker has obtained local code execution, making it a post-compromise escalation primitive rather than a remote entry point; the CISA SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis. A vendor patch is available through Microsoft's update guide, and the impact is total for the host once the UAF is successfully converted into elevation.

Use-after-free in the Windows Kernel allows an authenticated, low-privileged local attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to escalate privileges to SYSTEM-level, delivering high confidentiality, integrity and availability impact as a post-compromise LPE primitive. Affected systems are unpatched builds of Windows 10, Windows 11 and Windows Server 2012 through 2025 that fall below the fixed revisions in the vendor advisory. A vendor patch is available per the Microsoft MSRC update guide; no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) on supported Windows 10, Windows 11 and Windows Server builds allows a low-privileged, locally logged-on user (PR:L, AV:L, UI:N) to win a use-after-free race inside the service and execute code in a higher-privileged service context. The issue is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with high attack complexity reflecting the difficulty of reliably triggering and winning the memory-reuse race, and CISA's SSVC assessment records no exploitation, no automatable path and no public exploit identified at time of analysis. Because AppXSvc is default-enabled and the vector is strictly local, residual risk is concentrated on unpatched multi-user, shared or kiosk Windows hosts where any interactive account could repeatedly attempt the race; vendor patches are available and materially reduce that risk.

Local privilege escalation in the Windows Print Spooler allows an attacker who already holds an authenticated, low-privileged foothold on a Windows host to elevate to SYSTEM-level code execution. The root cause is a use-after-free memory corruption flaw (CWE-416) that requires no user interaction and has low attack complexity, so it can be triggered reliably once local code execution is obtained; the local-only vector means it is a post-compromise escalation primitive rather than an initial-access path. Microsoft has released patched builds for all affected client and server versions, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in Microsoft's Windows Image Acquisition (WIA) service lets an attacker who already holds low-privileged authenticated access on a Windows host corrupt memory in the WIA component and run code with higher - ultimately SYSTEM-level - privileges. Exploitation is confined to the local machine (AV:L), requires a pre-existing foothold (PR:L), and hinges on winning a use-after-free timing window rated high complexity (AC:H), so it is not remotely reachable, cannot be reliably automated, and needs no victim interaction. Microsoft has released a vendor fix per its update guide and no public exploit code or active exploitation has been identified at time of analysis, making this a credible but not top-tier priority patch - the real-world risk comes from attackers who have already landed on a box and want to finish escalating.

Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.

Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.

Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.

Local privilege escalation in the Windows StateRepository API lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a use-after-free (CWE-416) in the state store used by the AppX/UWP deployment stack, corrupting memory and gaining higher privileges up to the level of the affected component, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity, and availability for the vulnerable component. The issue spans a wide set of Windows 10, Windows 11, and Windows Server builds (per EUVD-2026-100050), and a vendor fix is available per the Microsoft advisory; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Because exploitation is gated on a pre-existing local foothold rather than on any non-default configuration, it should be treated as a post-compromise escalation step rather than a remote entry point, making it a credible but not emergency priority.

Local privilege escalation in the Windows Direct Composition (dcomp) compositor lets a low-privileged, already-authenticated local attacker drive a use-after-free (CWE-416) and gain high-integrity code execution (C:H/I:H) on affected Windows 10, Windows 11 and Windows Server builds. Exploitation is post-foothold only: the CVSS vector (AV:L, PR:L, UI:N) requires the attacker to already hold local code execution, so this is not a remotely reachable entry point and no user interaction is needed once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a patch-now local escalation rather than a drop-everything emergency; fully patched systems at or above the fixed builds are unaffected.

Use-after-free in the Windows Message Queuing (MSMQ) Queue Manager lets a locally authenticated, low-privilege attacker execute arbitrary code on the host, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating full loss of confidentiality, integrity and availability once the flaw is triggered. Exploitation is constrained: the MSMQ feature is not part of a default Windows installation, so the Queue Manager service must be deliberately deployed, and per the assessed vector the attacker must already hold local low-privilege access - there is no remote or anonymous path and no user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and this is assessed as a plausible but not top-tier priority because local-only access, prior authentication and the optional non-default MSMQ component collectively narrow realistic exposure to hosts where MSMQ is intentionally enabled and an attacker already has a foothold.

A local privilege escalation vulnerability in the Windows Storage VSP (Virtual Storage Provider) driver allows a low-privileged, authenticated attacker with existing code execution on a Windows host to elevate to SYSTEM-level privileges by triggering a use-after-free race condition in the driver. The flaw affects a broad range of Windows client and server platforms, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2016 through Windows Server 2025, and carries a CVSS 3.1 score of 7.8. Exploitation is difficult because it depends on winning a race condition (AC:H) and the CISA SSVC assessment rates it as not automatable with no known exploitation, so no public exploit code or active in-the-wild abuse has been identified at time of analysis.

Local privilege escalation in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged execution or credentials on a host to abuse a use-after-free race in the driver and gain kernel-level (SYSTEM) privileges, per CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable driver ships and loads by default on every listed Windows 10, Windows 11 and Windows Server build, so no non-default feature or configuration has to be enabled to reach the code - but the high attack complexity reflects the fact that the freed object must be reclaimed inside a narrow timing window, which weakens real-world reliability and complicates weaponization. No public exploit code has been identified and there is no evidence of active exploitation (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has published fixes for the affected builds.

Local privilege escalation in the Windows Clipboard User Service lets an authenticated low-privileged attacker who can already run code on a target host raise their rights to SYSTEM-level by triggering a use-after-free in the service's memory handling. Exploitation is timing-sensitive rather than trivial: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker needs local authenticated access and must win a race to reclaim freed memory, but no victim interaction and no network path are required, and the resulting scope change means full compromise of confidentiality, integrity, and availability on the host. Microsoft has released fixed builds for all affected Windows branches, and as of analysis there is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); this is a moderate-priority, real-but-not-urgent elevation-of-privilege flaw that matters most on multi-user, RDP, or kiosk-style systems where untrusted users share a session host.

Local privilege escalation in the Windows Clipboard User Service allows an authenticated low-privileged attacker who already holds a foothold on the host to elevate to higher integrity via a use-after-free (CWE-416) in the service's object handling. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and because the Scope metric is Changed the successful exploit crosses a privilege boundary rather than merely corrupting the vulnerable process. Exploitation is constrained by high attack complexity - the attacker must win a timing window and reliably reclaim the freed object, so CISA's SSVC assessment rates it non-automatable with exploitation observed as none, and no public exploit code has been identified at time of analysis. All supported Windows 10, Windows 11 and Windows Server branches up to the January-class build cutoffs listed in the advisory are affected, and a vendor patch is available.

Local privilege escalation in the Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privilege attacker with an existing foothold on the host to trigger a use-after-free in the queue manager and elevate to SYSTEM (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, requires MSMQ - an optional Windows component that is not installed or running by default - and provides no path to initial access, so the realistically exposed population is limited to hosts where MSMQ is enabled and to attackers who have already obtained a local account. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a vendor patch; the risk is credible but not a drop-everything emergency.

Privilege escalation in the Windows DWM Core Library lets a locally authenticated attacker with only low-level privileges raise their rights on an affected host by triggering a use-after-free (CWE-416) in the Desktop Window Manager's core component. Successful exploitation is constrained by high attack complexity (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), meaning it depends on winning a race/timing window and arranging a specific memory layout, so it is expected to be unreliable per attempt rather than a guaranteed escalation. This is a post-access escalation path rather than a remote entry point: the attacker must already hold a standard/interactive foothold on an unpatched build, and no user interaction is required. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available from Microsoft.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.

Local privilege escalation in Windows SmartScreen allows an authenticated attacker holding only standard-user rights to trigger a use-after-free in the reputation-checking component and escalate to a high-integrity context on an unpatched host. The flaw is rated CVSS 7.8 (HIGH) with full confidentiality, integrity, and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is exploitable locally without user interaction but requires an existing low-privileged session, so it functions as a post-compromise escalation step rather than a remote initial-access vector. Affected builds span Windows 11 23H2 through 26H2 and Windows Server 2025; Microsoft has published vendor patches that raise the OS build above the vulnerable thresholds, and no public exploit code was identified at time of analysis.