Memory Corruption

Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.

A use-after-free in the Windows Kernel lets an authenticated, low-privileged local attacker escalate to kernel-level (SYSTEM) privileges on affected Windows 11 and Windows Server 2025 builds. Exploitation requires an existing local foothold on the host and cannot be triggered remotely, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no user interaction is required and attack complexity is low (CVSS 7.8, AV:L/PR:L/UI:N). Microsoft has released fixes that raise the kernel build numbers listed in the advisory, and no public exploit code has been identified at time of analysis.

Local privilege escalation in the Windows Modern Device Management (MDM) component allows an authenticated low-privileged user who already has code execution on a Windows host to gain SYSTEM-level privileges by triggering a use-after-free in the MDM code path. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning it is not remotely reachable, requires no victim interaction, and depends on the attacker already holding a local foothold; successful exploitation also requires winning the heap-reuse race to reclaim the freed object. Consistent with our independent assessment this is a moderate-priority local escalation issue, and no public exploit identified at time of analysis; Microsoft has released patches through its update guide.

Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.

Local privilege escalation in Windows Composite Image File System (CimFS) affects Windows 11 24H2, 25H2, 26H1, and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core). An authenticated attacker who already has local access and standard user privileges (CVSS PR:L) and the ability to execute code that interacts with the CimFS driver can trigger a use-after-free (CWE-416) for high confidentiality, integrity, and availability impact inside the OS, though High attack complexity (AC:H) makes reliable exploitation dependent on winning a memory-reclamation race. Patch available per vendor advisory; no public exploit identified at time of analysis, and this is a medium-to-high priority local privilege escalation rather than a drop-everything emergency.

Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.

A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.

Local privilege escalation in the Windows Win32 kernel subsystem lets an attacker who already holds low-privileged code execution on a host escalate to full kernel-level (SYSTEM) privileges on unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and on Windows Server 2025, including Server Core installs. The underlying defect is a use-after-free (CWE-416) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the access vector is strictly local and the attacker must already be an authenticated user on the machine, so this is a post-foothold escalation rather than a remotely reachable bug, and no user interaction is needed. At time of analysis there is no public exploit code and no public exploit identified at time of analysis, and Microsoft has published vendor patches; exploitation would require reliably winning the object-reuse condition in kernel memory, and a failed attempt is likely to crash the host rather than succeed silently.

Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.

Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.

Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.

Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.

Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.

Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.

Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.

Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.

Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.

A use-after-free in the Windows WebDAV (WebClient) implementation allows an authenticated, locally-present low-privileged user to elevate privileges on the same host by winning a race-conditioned memory-reuse path (CWE-416, CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). All Windows client and server builds below their respective fixed build numbers are affected once the WebDAV client code path is reachable, with realistic exposure concentrated on multi-user hosts such as terminal servers, RDP session hosts and shared workstations where untrusted users can execute local code. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and Microsoft has released a vendor patch through the MSRC update guide.

Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.

Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.

Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.

Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.

Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.

Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.

Local privilege escalation in Microsoft Office Click-To-Run allows an authenticated low-privileged attacker who already has code execution on a target host to trigger a use-after-free (CWE-416) and gain elevated privileges. The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 installations, requires no user interaction, and has no remote attack surface; no public exploit has been identified at time of analysis. CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available.

Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.

Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) stems from a use-after-free memory-safety flaw (CWE-416) that an attacker with low-privileged local access can trigger to gain SYSTEM-level code execution. Real-world exposure is narrow: RRAS is not installed or running by default, so only hosts configured as VPN, NAT, or routing gateways are realistic targets, and exploitation depends on winning a timing race (CVSS AV:L/AC:H/PR:L, high attack complexity), which CISA SSVC assesses as not automatable with no observed exploitation. Microsoft has released a vendor patch, and no public exploit identified at time of analysis - this is a moderate-priority, not emergency, vulnerability whose practical risk sits below what the 7.0 base score alone suggests.

Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.

Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.

Local privilege escalation in the Windows Telephony Server (TAPI) allows an authenticated, low-privileged local user to gain elevated rights - potentially SYSTEM - by triggering a use-after-free in the telephony stack. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the EUVD data below the vendor's patched build levels are affected, and because the vulnerable component is present by default, exposure is broad even though the attack is not remote. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier priority: it only becomes dangerous after an attacker has already obtained a foothold on the host and can interact with the TAPI service.

Local privilege escalation in the Windows Update Orchestrator Service on unpatched Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets a local, low-privileged attacker who can already run code on the host win a heap race condition and elevate to SYSTEM. The defect is a use-after-free (CWE-416) with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and CISA's SSVC assessment records Exploitation=none and Automatable=no, meaning the race is unreliable and must be won manually rather than triggered by a repeatable exploit chain. There is no public exploit code identified at time of analysis, so this is a moderate-priority patch-and-move-on item rather than an emergency, though the vendor has made a fix available.

Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.

Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.

Local privilege escalation in Microsoft Windows DirectComposition lets an authenticated attacker who already holds low-privileged code execution on a host trigger a use-after-free in the desktop composition engine and gain code execution at a higher integrity level. Affected are supported Windows client and server builds prior to the fixed builds listed in the vendor advisory, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022 and Windows Server 2025 (including Server Core). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment marks the issue as non-automatable, making this a genuine but non-emergency patching priority rather than a drop-everything emergency.

Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.

Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.

Memory corruption in Microsoft XML (MSXML) allows an unauthenticated remote attacker to execute arbitrary code in the context of whatever process parses attacker-supplied XML, with high impact to confidentiality, integrity, and availability (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are supported Windows client and server editions - including Server Core installs - running builds older than the fixed levels catalogued in EUVD-2026-99433 and the MSRC advisory, from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025. Microsoft has shipped vendor fixes, and there is no public exploit identified at time of analysis: CISA's SSVC entry records exploitation as 'none' and marks the flaw as not automatable, though the HIGH attack complexity reflects that a reliable use-after-free requires precise heap grooming and, in practice, an XML-rendering or XML-consuming path must be reached.

Local privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged, authenticated session on a vulnerable host gain full SYSTEM-level control by triggering a use-after-free (CWE-416) in kernel memory handling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unpatched population covers Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 and Windows Server 2022/2025, with fixes recorded in EUVD-2026-100051 that raise builds such as Windows 11 24H2 to 10.0.26100.9711, Server 2025 to 10.0.26100.33650 and Windows 10 to 10.0.19044.7807. Patch available per vendor advisory; no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with automatability as no, although technical impact is rated total.

Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.

Remote code execution in the Windows RPC Runtime allows an unauthenticated network attacker to run code at the service account's privilege level by triggering an out-of-bounds write in memory handling of RPC traffic. Any supported Windows 10, Windows 11, or Windows Server release that has not been updated to its fixed build is affected - from Windows Server 2012 (6.2.9200.26434) and 2012 R2 through Windows Server 2025 (10.0.26100.33650), plus Windows 10 1607 through 22H2 and Windows 11 23H2 through 26H2 - and the vendor-rated CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no authentication, user interaction, or special configuration is required beyond RPC reachability. CISA's SSVC assessment rates technical impact as total with exploitation currently 'none', so no public exploit code has been identified at time of analysis and the flaw is not on the KEV catalog; the practical constraint is network exposure, since hosts with RPC ports filtered at the perimeter or segmented from untrusted networks are not reachable by external attackers even though internal and lateral use remains viable. Patches are available from Microsoft, making this a patch-now priority rather than an emergency zero-day response.

A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.

Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to corrupt kernel memory and elevate to SYSTEM. The flaw is a use-after-free (CWE-416) requiring a race-condition-style trigger, reflected in the CVSS vector AV:L/AC:H/PR:L/UI:N (7.0 High) and the CISA SSVC assessment of Exploitation: none and Automatable: no - there is no remote path, no user interaction, and no public exploit identified at time of analysis. It was not added to CISA KEV, and vendor-supplied patches are available; affected builds are specific Windows 11 23H2 through 26H2 releases and Windows Server 2025 (including Server Core) below the fixed build numbers, while patched builds are not exploitable. Independent assessment rates this as a genuine but not emergency-grade priority best handled through routine monthly patching.

Local privilege escalation in the Windows Update Orchestrator Service (UsoSvc) on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a standard, low-privileged local account to trigger a use-after-free in the service and elevate to the service's high-privilege (LocalSystem) context. There is no remote or unauthenticated path: the CVSS vector (AV:L/PR:L) confirms the attacker must already be logged on locally with low privileges, and the high attack complexity (AC:H) reflects that success depends on winning a timing-dependent memory-reuse race, which usually requires repeated attempts rather than a single deterministic trigger. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none), and vendor patches are available, so this is a genuine but second-tier priority concentrated on shared, multi-user, or terminal-server hosts where untrusted users hold standard accounts.

Local privilege escalation in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds code execution as any logged-on user to raise privileges to kernel/SYSTEM level. The defect is a use-after-free (CWE-416) in a subsystem present in default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025, requiring no user interaction once a local foothold exists, though it cannot be triggered remotely and grants no initial access on its own. Microsoft has released vendor patches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.

Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.

Remote code execution in the Windows Network Load Balancing (NLB) feature affects Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, with an assessed CVSS 3.1 score of 9.8 from a vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describing a network-reachable, low-complexity, unauthenticated attack with total confidentiality, integrity and availability impact. The flaw is a use-after-free (CWE-416) in NLB's handling of network traffic, allowing an unauthorized attacker to execute code over the network; the CISA SSVC assessment rates technical impact as "total" and automatable as "yes," meaning a working exploit could be scripted and scaled. Exploitation is bounded by deployment reality rather than technical difficulty: NLB is not part of a default Windows Server installation, so only hosts where the feature is installed, enabled and network-reachable are exposed - no public exploit was identified at time of analysis and the SSVC exploitation signal is "none."

Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.

Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.

Local privilege escalation in the Windows Bind Filter Driver (bflt.sys), a core kernel-mode component, allows an authenticated low-privileged attacker with existing code execution on a target host to escalate to SYSTEM-level privileges through a use-after-free condition (CWE-416). Exploitation is not trivial: the flaw is a race condition requiring precisely timed reclamation of a freed kernel object, reflected in the high attack-complexity rating of the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 7.0), and the attacker must already hold local access (AV:L, PR:L) - this is a post-compromise escalation primitive, not a remote entry vector. No public exploit code was identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but second-tier priority relative to actively exploited kernel flaws; it nonetheless affects default installations of Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core) until patched.

Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.

A use-after-free in the Windows Kernel lets an attacker who already holds local, authenticated low-privileged access on a host escalate to full system-level privileges, yielding high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected platforms are Windows 11 versions 23H2, 24H2, 25H2, and 26H2 plus Windows Server 2025 (including Server Core installation) running builds below the fixed levels. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so this is best treated as a post-compromise escalation primitive that cannot be reached remotely or without prior code execution on the machine. Vendor-released patches are available from Microsoft.

Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.

Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.

Unauthenticated remote code execution is possible in the kernel-mode CCFFilter driver shipped with multiple supported Windows client and server releases, because a use-after-free (CWE-416) in that driver can be triggered by network traffic and leads to memory corruption in kernel space. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, no credentials or user interaction are required, and the SSVC assessment rates the attack as automatable with total technical impact. No public exploit code has been identified at time of analysis and it is not listed as confirmed actively exploited (CISA KEV); exploitation signals are mixed, with the main practical uncertainties being the undocumented network reachability of this filter driver and the memory-timing precision that a reliable kernel use-after-free generally demands. Microsoft has released vendor patches for the affected builds.

Use-after-free in the Windows Camera Frame Server Monitor - the default-running component of the Windows 11 and Windows Server camera frame-server stack - permits an unauthenticated (PR:N), zero-interaction (UI:N) attacker to corrupt memory and execute code in a higher-integrity context, yielding full confidentiality, integrity and availability impact (C:H/I:H/A:H, CVSS 8.8). The single meaningful obstacle to exploitation is the adjacency requirement: the CVSS vector is AV:A, so the attacker must already occupy the same layer-2 segment, subnet or local LAN as the target and cannot reach the service directly across the public internet, which substantially narrows the exploitable population to actors who have obtained a local network foothold. Microsoft has shipped fixed builds for every affected Windows 11 and Windows Server branch, and CISA's SSVC assessment records exploitation as 'none' with automatable 'no'; no public exploit code or confirmed active exploitation was identified at time of analysis, leaving the overall priority moderate rather than emergency.

Local privilege escalation in OpenSSH for Windows stems from a use-after-free (CWE-416) in the SSH component shipped with supported Windows builds, allowing an authenticated low-privileged user who already holds a foothold on the host to corrupt memory inside the OpenSSH process and elevate to the privileges of that process, with high impact across confidentiality, integrity and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: there is no remote or network vector, no user interaction is required, and exploitation presupposes a valid low-privilege account plus the vulnerable OpenSSH for Windows component being installed and in use on an unpatched build. No public exploit code has been identified at the time of analysis, CISA's SSVC decision framework records exploitation as none and the flaw as not automatable, and Microsoft has released vendor patches for all affected Windows versions.

Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.

Local privilege escalation in Windows Win32K allows an attacker who already holds low-privileged, authenticated local access to trigger a use-after-free in the kernel-mode window manager driver and obtain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. The defect is a second-stage primitive rather than an initial-access flaw: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing foothold on the host plus the ability to execute code issuing Win32K syscalls, and it cannot be reached by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis, CISA's SSVC data records exploitation as "none" and automatable as "no", and Microsoft has released a vendor patch covering all listed Windows client and server builds.

Local privilege escalation in the Windows Win32 Kernel Subsystem (Win32k) allows an attacker who already holds a low-privileged, authenticated local foothold to corrupt kernel memory and elevate to higher integrity, potentially SYSTEM. The flaw is a use-after-free (CWE-416) reachable through the user-mode-to-kernel windowing/GDI path; per the assessed vector AV:L/AC:L/PR:L/UI:N, exploitation requires prior local code execution and no user interaction, so it is a post-compromise escalation primitive rather than an initial-access or remote vector. Microsoft has released vendor patches and CISA's SSVC decision data records no known exploitation and no automatable exploitation path; no public exploit code has been identified at time of analysis. Rated 7.8 (High) with total technical impact, this is a credible but not emergency-tier priority - patch on a normal cadence, prioritizing multi-user and high-value Windows 10, Windows 11, and Windows Server hosts.

Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.

Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.

Local privilege escalation in the Windows MIDI Service Module allows an authenticated low-privileged attacker to gain elevated code execution by triggering a use-after-free (CWE-416) in the service's memory handling. Affected versions include Windows 11 24H2 (10.0.26100.0 < 10.0.26100.9711), 25H2 (10.0.26200.0 < 10.0.26200.9711), 26H1 (10.0.28000.0 < 10.0.28000.3231), and 26H2 (10.0.26300.0 < 10.0.26300.9711). Exploitation requires the attacker to already possess authenticated local code execution (PR:L, AV:L) and to win a timing-dependent race (AC:H), making reliable exploitation non-trivial; no public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.

Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.

Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.

Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.

A use-after-free in the Windows Bluetooth Service allows an unauthenticated attacker within Bluetooth radio range to execute code on affected Windows 10, Windows 11, and Windows Server hosts where Bluetooth is enabled and the service is running - the default state on most laptops, tablets, and Bluetooth-equipped desktops. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2019/2022/2025 (including Server Core) below the fixed build numbers listed in EUVD data. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation carries High attack complexity (AC:H) because the attacker must reliably win a memory-timing race, which limits reliability and makes automated or at-scale remote attacks impractical; no public exploit has been identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and vendor patches are available.

Local privilege escalation in Windows Win32K allows an authenticated attacker with low-privileged access to elevate to higher integrity levels by exploiting a use-after-free (CWE-416) condition. Affected systems include a broad range of Windows 10, Windows 11, and Windows Server versions (2016 through 2025); a vendor patch is available. No public exploit code or active exploitation has been identified, and the risk is assessed as credible but not emergency-level.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker holding standard user rights on a host to corrupt the DWM process through a use-after-free and execute code with the elevated privileges that process enjoys. Exploitation requires prior local access at low privilege (CVSS AV:L/PR:L), needs no user interaction and no non-default configuration, because DWM is a default-enabled composition subsystem on every supported Windows 10, Windows 11, and Windows Server build listed by EUVD. Microsoft has published fixed builds and no public exploit has been identified at time of analysis, so this functions as a post-foothold escalation step rather than a remote entry point; severity is high (7.8) but it is not a remotely exploitable crisis.

Local privilege escalation in the Windows Win32k kernel-mode driver (win32kfull.sys/win32k.sys) allows an attacker who already holds low-privileged, authenticated code execution on a host to trigger a use-after-free (CWE-416) on a freed kernel object and elevate to a higher-integrity, kernel-level context. Affected deployments are unpatched Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core) builds below the fixed build numbers published in Microsoft's update guide; CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote or network attack surface, and no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.

Local privilege escalation in Windows Kerberos allows an authenticated attacker who already holds low-privileged code execution on a Windows 11 26H1 host (builds 10.0.28000.0 up to but not including 10.0.28000.3231) to elevate to a higher integrity level, with high impact across confidentiality, integrity, and availability on the affected machine. The root cause is a use-after-free that must be triggered and won as a race, so the high attack complexity (AC:H) materially limits reliable exploitation; there is no remote vector and no victim user interaction is required. No public exploit identified at time of analysis, no exploitation has been observed (CISA SSVC records Exploitation: none, Automatable: no), and a vendor patch is available.

A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated low-privilege access on a Windows host to exploit a use-after-free memory-corruption condition and elevate to SYSTEM-level code execution. The flaw affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations, running builds below the vendor-supplied fixed build numbers. Exploitation is local-only (AV:L), requires an existing foothold with low privileges (PR:L), and carries high attack complexity (AC:H) because success depends on winning a non-deterministic memory-reclamation race; no user interaction by a victim is required, and no public exploit code or active in-the-wild exploitation has been identified at time of analysis (CISA SSVC Exploitation: none). Vendor patches are available from Microsoft, so the practical risk is concentrated in unpatched endpoints and multi-user systems where an attacker already has a standard account.

Local privilege escalation in Windows NTFS allows an authenticated attacker with a low-privileged local session to trigger an out-of-bounds write (CWE-787) and execute code with elevated privileges. Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis (SSVC exploitation: none, Automatable: no), and a vendor-released patch is available.

Local privilege escalation in the Windows Device Association Service lets an authenticated low-privileged user on a Windows host trigger a use-after-free (CWE-416) memory-corruption condition and execute code with elevated rights, yielding high confidentiality, integrity, and availability impact within an unchanged security scope (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025 are affected, but an attacker must already be able to run code on the machine, making this a post-compromise escalation primitive rather than a remote entry point. High attack complexity (AC:H) means reliable exploitation depends on winning a race or forcing a specific freed-memory reuse, which SSVC reflects as not automatable; no public exploit code has been identified at time of analysis and there is no KEV entry, while Microsoft has released fixed builds.

Local privilege escalation in Microsoft Windows Event Tracing (ETW) lets an authenticated attacker who already holds low-privileged local access on a target host trigger a use-after-free condition (CWE-416) and execute code in a more privileged security context, potentially reaching SYSTEM. The flaw carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is a local-only primitive that requires pre-existing low-privilege credentials, no user interaction, and is gated by High Attack Complexity because reliable exploitation hinges on winning a memory-lifecycle race rather than a deterministic trigger. All supported Windows client and server builds below the vendor-patched revision levels are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2016/2019/2022/2025 and their Server Core installations, and Microsoft has released fixes; there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC framework rates exploitation as none and the activity as not automatable, so this should be treated as a high-value post-compromise escalation primitive rather than an imminent mass-exploitation threat.

Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.

Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.

Local privilege escalation in the Windows Now Playing Session Manager (NPSM) - a default component of supported Windows 10, Windows 11, and Windows Server builds - lets an attacker who already holds authenticated, interactive local access (CVSS 3.1 AV:L/PR:L/UI:N, score 7.8) corrupt memory via a use-after-free and execute code with elevated privileges. Exploitation is not automatable and requires the victim host to already be compromised or a low-privileged local user to be present; no public exploit code was identified at time of analysis and the CISA SSVC evaluation records exploitation as none, while CISA's technical-impact assessment is total (full loss of confidentiality, integrity, and availability on the vulnerable host). The flaw is a standard local privilege-escalation primitive rather than a remote entry point, and Microsoft has published fixed builds for every affected version.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.

Local privilege escalation in the Windows Kernel lets an authenticated attacker who already holds a low-privileged foothold on an affected Windows 10, Windows 11, or Windows Server build corrupt kernel memory and elevate to SYSTEM-level privileges. The defect is a use-after-free (CWE-416) that is reachable on default installations with no user interaction, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Microsoft has shipped a vendor patch through its Security Update Guide. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no, so this should be handled as a standard monthly-patching priority rather than an emergency.

Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.

Local privilege escalation in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows an authenticated attacker who already holds a low-privileged foothold on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 to elevate to SYSTEM-level code execution by triggering a use-after-free (CWE-416) inside the service. Exploitation requires winning a race condition to reuse a freed memory object, which raises attack complexity and limits reliability, and there is no remote vector - this is a post-compromise escalation primitive rather than an initial-access flaw. No public exploit code has been identified and no active exploitation has been confirmed; Microsoft has released vendor patches for all affected branches.

A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.

Local privilege escalation in the Windows Defender Firewall Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host trigger a use-after-free condition and elevate to full SYSTEM privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). The vulnerability cannot be reached remotely or by an unauthenticated user, and exploitation is additionally bounded by the affected build ranges, so fully patched systems are not exposed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the independent assessment rates this as a credible but not emergency-level priority, making it a standard monthly-patch item rather than an out-of-band emergency.

Privilege escalation in the Windows Kernel lets an authenticated local attacker with low privileges trigger a timing-dependent use-after-free in kernel memory and, on success, execute code at a higher integrity level (SYSTEM) on the affected host. Only unpatched Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 builds are in scope, and the attacker must already hold a local foothold on the machine - there is no remote or network-facing path. CISA's SSVC assessment records no exploitation and no public exploit has been identified at time of analysis, but because the technical impact is rated total and a vendor patch is already shipping, the update should be treated as a routine-but-priority patch rather than an emergency.

Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.

Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).

Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).

Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.