Memory Corruption

Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.

Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.

Local privilege escalation in the Windows Win32K ICOMP subsystem allows an authenticated attacker holding only low-privilege local code execution to elevate to kernel/SYSTEM context by triggering a use-after-free (CWE-416) in a Win32K object-lifetime code path. The flaw is confined to local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and requires winning a timing-dependent race, so it cannot be used for initial access or remote compromise and is only meaningful as a post-exploitation escalation step. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; Microsoft has released a vendor patch.

Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.

Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authorized attacker who already holds a foothold on a Windows host to run code at higher integrity by triggering a use-after-free memory corruption condition (CWE-416). Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local authenticated access and a hard-to-win timing or object-lifecycle state (AC:H) that the attacker does not fully control, but yields total loss of confidentiality, integrity and availability once achieved. Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds are affected; Microsoft has shipped fixed builds, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).

A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.

Local privilege escalation in the Windows Application Compatibility Cache (ShimCache) allows an attacker who already holds low-privileged local code execution to elevate to higher integrity on unpatched Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 systems. The defect is a use-after-free (CWE-416) that must be won in a narrow race window, and the assessed vector (AV:L/AC:H/PR:L/UI:N) reflects a post-compromise escalation path rather than a remote entry point, which is why SSVC records Exploitation: none, Automatable: no, and our assessment treats this as a genuine but moderate-priority local privilege escalation rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and no CISA KEV entry exists, though the CVSS base score of 7.0 is driven by total confidentiality, integrity, and availability impact once the elevation succeeds.

Use-after-free in the Windows Program Compatibility Assistant Service (PcaSvc) allows an attacker who already holds a low-privileged, authenticated local session to escalate privileges to a higher-integrity context on the same host, achieving total compromise of confidentiality, integrity, and availability (CVSS 7.0, C:H/I:H/A:H). The flaw is a memory-corruption race that the attacker must win to reliably corrupt freed memory, so the high attack-complexity rating limits repeatability, and exploitation requires prior local code execution - remote, unauthenticated attackers are not in scope (AV:L/AC:H/PR:L/UI:N). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2025 builds are affected; no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records exploitation as 'none' with the vulnerability not automatable. This is a genuine but moderate-priority elevation-of-privilege issue rather than a top-tier emergency, and vendor patches are available.

Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.

Local privilege escalation in Microsoft Office Click-To-Run arises from a use-after-free memory corruption flaw that lets an attacker who already holds low-privileged local access on a Windows host elevate to higher integrity, with high impact to confidentiality, integrity, and availability. Affected installations include Microsoft 365 Apps for Enterprise (16.0.1 branch), Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; the attack is local-only (AV:L), requires authenticated low-privileged code execution (PR:L), needs no user interaction (UI:N), and carries high attack complexity (AC:H) because of the heap-state/race conditions inherent to reliable use-after-free exploitation. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', so this is a moderate-to-high priority patching item rather than an emergency; a vendor patch is available.

Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an authenticated attacker who can already execute code as a low-privileged user on the host to corrupt kernel memory and escalate to SYSTEM privileges. The flaw is a use-after-free reachable through the driver with no user interaction required (CVSS 7.8, AV:L/PR:L/UI:N, S:U, C:H/I:H/A:H), and it affects unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds as well as Windows Server 2025 (including Server Core) builds below the fixed build numbers. Microsoft has published a vendor patch; there is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit identified at time of analysis, so this is a post-compromise escalation step rather than a remote entry point.

Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated attacker who already holds low-privileged code execution on an affected host to gain full control of the system (CVSS 7.0, C:H/I:H/A:H) by triggering a use-after-free in kernel memory. Exploitation is constrained by high attack complexity (AC:H), since the attacker must reliably win a timing/race window and groom kernel heap state; there is no remote or unauthenticated vector. Affected are unpatched Windows 11 24H2, 25H2, 26H1, and 26H2 builds and Windows Server 2025 builds below the fixed versions, and no public exploit or confirmed active exploitation was identified at time of analysis; Microsoft has released a patch.

Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.

Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.

Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.

Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.

Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.

Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.

Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user on an affected host to corrupt kernel memory and seize full control of the operating system, including reading and modifying protected data. The root cause is a use-after-free (CWE-416) in core kernel code, reachable only from a local session and rated high attack complexity because exploitation depends on winning a race/timing condition to reclaim the freed object. Affected builds are Windows Server 2025 (including Server Core) below 10.0.26100.33650 and Windows 11 Version 23H2 below 10.0.22631.7652; no public exploit code identified at time of analysis and no KEV listing, so this is a moderate-priority patching item rather than an emergency, with patched builds not exploitable.

Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.

Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.

Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).

Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.

Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.

Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.

Remote code execution in Microsoft PowerPoint stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated remote attacker can trigger by delivering a maliciously crafted PowerPoint/Office document to a victim, who must then open it (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the macOS Microsoft 365/Office LTSC releases identified in EUVD-2026-100169. CISA SSVC records exploitation as 'none' and automatable as 'no', so no public exploit identified at time of analysis, and Microsoft has published fixed versions through the MSRC update guide.

Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.

Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.

Memory corruption in Microsoft .NET's System.Net.Sockets component allows an unauthorized attacker to execute code over a network on Windows hosts, but only against applications that reuse a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP datagram sockets. The flaw (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) manifests as an out-of-bounds write in the ReceiveFromAsync path once an undersized cached native address buffer is retained; no authentication or user interaction is required, though the high attack complexity reflects the non-default coding pattern required to reach the vulnerable state. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and non-automatable, and no KEV listing applies; Microsoft has shipped fixed runtime builds, making this a meaningful but non-emergency patching priority.

Unauthenticated remote code execution affects the Remote Desktop Gateway service on Windows Server, where a use-after-free memory corruption flaw (CWE-416) can be triggered by a network attacker who can reach the service. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are needed, but exploitation is gated behind high attack complexity - the memory corruption likely requires winning a race condition or arranging a precise heap state, consistent with CISA's SSVC assessment of Exploitation: none and Automatable: no. Only servers with the optional RD Gateway role explicitly installed and internet- or network-reachable are exposed; there is no public exploit identified at time of analysis, and a vendor patch is available.

Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.

Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.

Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.

Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.

Local privilege escalation in Windows Direct Composition (the dcomp/DWM compositing subsystem) lets an attacker who already holds low-privileged code execution on a target box corrupt freed memory and elevate to a higher-integrity context, including SYSTEM. Every supported Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2022/2025 build ships the affected component by default, but the CVSS vector (AV:L/PR:L/UI:N) confirms exploitation requires an existing local foothold and no user interaction, making this a post-compromise escalation primitive rather than an initial access vector. With a base score of 7.8 and high confidentiality, integrity and availability impact, it is a credible but not emergency-tier priority: vendor patches are available, and no public exploit identified at time of analysis.

A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).

Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker running as a low-privileged user to abuse a use-after-free condition in a kernel object and elevate to full system privileges, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) below Microsoft's fixed builds are affected; exploitation is not remote, requires no user interaction, and hinges on winning a timing-dependent race window, which lowers exploit reliability. No public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has shipped a vendor patch, so fully updated hosts are not exploitable - the overall priority is moderate rather than emergency.

Local privilege escalation in the Windows Audio Service lets an attacker who already holds low-privilege code execution on a Windows host trigger a use-after-free (CWE-416) and elevate to a more privileged context. The flaw is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and local code execution, and the high attack complexity reflects a race/timing window that must be won, making exploitation non-deterministic. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and non-automatable, and the issue does not appear in CISA KEV; completely patched builds are available from Microsoft.

Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker with a low-privileged local account corrupt memory and potentially execute code at a higher integrity level. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires prior authentication, needs no user interaction, and carries high attack complexity because the attacker must reliably reclaim a freed object. Microsoft has released vendor patches; no public exploit code has been identified, and CISA's SSVC assessment records exploitation as none with the issue not automatable (technical impact: total).

Local privilege escalation in the Windows Event Tracing (ETW) subsystem allows an attacker who already holds low-privileged code execution on a host to raise their privileges, with high confidentiality, integrity and availability impact (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use-after-free (CWE-416) that is only reachable locally and additionally requires winning a timing race, so reliable exploitation is non-trivial; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, with CISA SSVC scoring exploitation as 'none' and automatable as 'no'. Microsoft has released a vendor patch, and risk is concentrated on multi-user, terminal/RDP, or shared systems where untrusted low-privilege accounts can run code - a moderate, not emergency, priority.

Unauthenticated remote code execution in the Windows DNS Server role stems from a use-after-free (CWE-416) that lets an attacker who can reach the service over the network run code in the context of the DNS service. All supported Windows Server generations carrying the DNS role are affected - 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), plus Windows 10 1607 and 1809 where the role is installed - while hosts without the DNS Server role are not exposed. The practical risk is tempered by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), since reliable exploitation depends on winning a race or landing a specific heap state; no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available - making this serious but not emergency-tier.

Local privilege escalation in the Windows Audio Service (audiosrv) affects Windows 11 versions 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core), allowing an attacker who already holds a low-privileged foothold on the host to execute code in a more privileged context. Exploitation requires an authenticated local attacker with the ability to interact with the audio service (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity indicates the use-after-free hinges on a race or specific heap/object state that is difficult to trigger reliably; the service runs by default, so every affected build is exposed once a foothold exists. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, so this is a genuine but moderate-priority local privilege escalation rather than an urgent remote threat; a vendor patch is available.

Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds valid low-privilege credentials on an affected Windows host free an object and then reallocate it under their control, corrupting memory inside the component's elevated process. Impacted builds are Windows 11 24H2, 25H2, 26H1 and 26H2 alongside Windows Server 2025 (including Server Core installations) at versions below the fixed build numbers published by the vendor. No public exploit code identified at time of analysis and CISA's SSVC assessment records exploitation as none with the flaw rated non-automatable, but the vendor has shipped a patch and the technical impact is assessed as total (high confidentiality, integrity and availability loss).

Local privilege escalation in the Microsoft Windows Storage Spaces driver (Spaceport.sys) lets an authenticated, low-privileged attacker who already has code execution on a host corrupt kernel memory and obtain SYSTEM-level rights. The defect is a use-after-free (CWE-416) that is locally reachable with low attack complexity and no user interaction, and it affects Windows 10, Windows 11 and Windows Server builds below the fixed versions enumerated in the vendor update. No public exploit code has been identified and CISA's SSVC decision data records no exploitation activity, so this is a genuine but second-tier patching priority relative to any actively exploited issue in the same release cycle.

Local privilege escalation in Microsoft's Windows Search Component lets an authenticated attacker who already holds a low-privileged session on a Windows host trigger a use-after-free and elevate to a more privileged security context on the same machine. Exploitation is constrained by a high attack complexity rating (AC:H), reflecting a race/timing condition on the freed object that must be won reliably, and the vector (AV:L/PR:L/UI:N) confirms the attacker must already be logged in locally with low privileges; there is no remote attack surface and no victim interaction required. Patches are available from Microsoft (fixed builds such as Windows 11 24H2 10.0.26100.9711 or later), CISA's SSVC assessment records exploitation as none and the issue as not automatable, and no public exploit code has been identified at time of analysis.

Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds low-privileged, authenticated local access on a vulnerable Windows host corrupt kernel memory and elevate to higher privilege, including SYSTEM-level execution. Only specific builds are exposed: Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), at build levels below the vendor's fixed releases. Exploitation is constrained by high attack complexity - the use-after-free must be won as a race/timing condition to reclaim the freed Win32 kernel object before it is reused, which limits reliability and makes the flaw non-automatable per CISA SSVC; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (KEV), though the high confidentiality, integrity and availability impact and full technical impact score make timely patching important.

Local privilege escalation to SYSTEM in the Windows Win32k kernel subsystem affects Windows 10, Windows 11, and Windows Server releases, allowing an authenticated low-privileged attacker already executing code on the host to exploit a use-after-free (CWE-416) condition and gain full kernel-level control (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The high attack complexity (AC:H) reflects the need to reliably win a race or groom the kernel heap, and there is no remote or network vector, so multi-user, RDP/terminal-server, and kiosk systems are the most relevant risk surface. No public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in Windows DHCP Server lets an authenticated, low-privileged user trigger a use-after-free (CWE-416) in the DHCP Server service and obtain SYSTEM-level code execution on the host. It is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already have local access and must win a non-deterministic race to reach the freed-memory window, so the flaw is not remotely reachable and is best treated as a post-compromise escalation step on provisioned DHCP infrastructure rather than an emergency. No public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patch is available per the Microsoft advisory.

Memory corruption in the Microsoft Windows DHCP Server role allows unauthenticated remote attackers to execute arbitrary code on affected servers over the network. Only systems with the DHCP Server role installed and running are exposed - the attack surface is the DHCP service itself (typically UDP 67), while ordinary Windows clients and servers without that role are not vulnerable. Affected builds span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809 below the listed patch levels. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation and a non-automatable attack profile, although technical impact is rated total; a vendor patch is available. Note that the vendor-published base vector (7.5) reflects an availability-only impact, whereas the independent assessment scores confidentiality, integrity and availability all High (full code execution).

Local privilege escalation in the Windows Update Service allows an attacker who already possesses valid low-privileged local access on an affected Windows host to elevate to a higher-integrity context (including SYSTEM) by triggering a use-after-free. The attack is entirely local - there is no network-facing path - and the assessed vector (AV:L/AC:H/PR:L/UI:N) means successful exploitation depends on winning a race/timing window inherent to the memory-reuse condition, so reliable elevation may require multiple attempts and is not a deterministic one-shot. Affected unpatched builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019/2022/2025 (Server Core included); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, making this a legitimate but moderate-priority LPE rather than an urgent, broadly exploited threat.

Local privilege escalation in Windows SmartScreen allows an attacker who already holds a low-privileged interactive session on a Windows host to corrupt memory through a type-confusion condition and elevate to a higher-integrity context, with full loss of confidentiality, integrity, and availability if successful. Exploitation is local only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8): there is no remote or network vector, and the attacker must first establish code execution on the target before triggering the flaw. Microsoft has released fixes, and CISA's SSVC review rates exploitation as none observed and not automatable, so this is best treated as a manual post-compromise escalation step rather than a mass-exploitation threat; no public exploit code or KEV listing is associated with the CVE at time of analysis.

Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.

Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.

Local privilege escalation in Microsoft Windows Hyper-V lets an authenticated, low-privileged attacker who already has code execution on a host with the Hyper-V role enabled trigger a use-after-free in a Hyper-V component and gain SYSTEM-level code execution (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H). Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022, and 2025 including Server Core installations; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none with Automatable: no, so risk is concentrated on multi-tenant, shared, or virtualization hosts where untrusted low-privilege principals already run. Microsoft has released fixes through the standard Windows cumulative update channel (MSRC advisory CVE-2026-70023, mirrored in ENISA EUVD-2026-100338), and administrators of Hyper-V hosts should treat this as a priority local escalation patch rather than a remote emergency.

Local privilege escalation in Windows Direct Composition (DComp) lets an attacker who already has low-privileged code execution on an affected Windows 11 or Windows Server host escalate to SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) that requires winning a heap-grooming race window, so it is rated high complexity (AC:H) and carries a CVSS of 7.0; exploitation is local and the attacker must be authenticated (PR:L, AV:L) with no user interaction needed (UI:N). Microsoft has released fixes for every affected branch, and there is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as "none," making this a moderate-priority patch item rather than an emergency.

Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.

Remote code execution in the Windows iSCSI initiator stack (CVE-2026-70013) allows a network-adjacent attacker to execute arbitrary code with high confidentiality, integrity and availability impact. Affected are the Windows iSCSI components shipped across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025, including Server Core installations, with vendor fixes now published. Exploitation requires an active iSCSI session - typically a target the attacker controls or can inject responses into - and, because the flaw is a use-after-free race (CWE-416, AC:H), success depends on winning a memory-reuse timing window rather than issuing a single deterministic request; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, so this is a serious-but-not-emergency priority rather than an active incident.

Use-after-free in the Windows Remote Desktop Client lets an unauthenticated attacker execute arbitrary code on a connecting client by luring a user into initiating an RDP session to an attacker-controlled or compromised server. The vector is network-reachable with no privileges required (PR:N), but practical exploitation depends on the victim starting the outbound connection (UI:R) and on the attacker winning a specific memory-state or timing condition (AC:H), which is consistent with CISA's SSVC rating of non-automatable and no observed exploitation. No public exploit code has been identified at time of analysis and Microsoft has published fixed builds covering all affected Windows 10, Windows 11 and Windows Server platforms; because the trigger is client-initiated rather than a passive listening service, the realistic delivery paths are malicious .rdp files, crafted links, or a hijacked RDP endpoint.

Remote code execution in Microsoft's Windows Desktop (WPF) runtime lets an unauthenticated attacker execute arbitrary code in the context of a victim who opens crafted WPF content containing a malicious pixel-shader. The flaw is a heap out-of-bounds write (CWE-787) in the shader-processing routine CPSTrans::Initialize, triggered when crafted pixel-shader bytecode desynchronizes the component's two parsing passes; per the CVSS vector the attacker needs no credentials (PR:N) but the victim must interact with the malicious content (UI:R), and exploitation yields code execution at the user's privilege level rather than elevated (S:U), which is why the independent assessment rates this as high priority but not an emergency. Affected software spans .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 preview/RC builds before 11.0.0-rc.2, multiple .NET Framework 3.5/4.6.2-4.8.1 servicing branches on Windows, and Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4). No public exploit code has been identified and there is no KEV listing at time of analysis, but vendor patches are available and should be applied promptly given the ease of triggering (AC:L) once a user opens the file.

A use-after-free (CWE-416) in the Microsoft Windows Remote Desktop Client allows an unauthenticated attacker to execute code on a victim's machine when that user initiates an outbound connection to an attacker-controlled RDP server. The flaw is client-side rather than a remotely reachable service bug: the attacker must control the server endpoint and also win a race condition inherent to the use-after-free (AC:H), while the victim must open a crafted .rdp file or otherwise accept the connection (UI:R), which is why the CVSS 3.1 base score sits at 7.5 even though a successful exploit yields full confidentiality, integrity and availability impact. Vendor-released patches are available, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a moderate-priority issue rather than an urgent one.

Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to execute code on a Windows machine that connects to it, affecting builds across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation is client-side: an attacker must induce a victim to open a crafted .rdp file or otherwise initiate an outbound RDP session, and with AC:H plus mandatory UI:R, reliable code execution depends on winning a heap race rather than a single deterministic response, so mass opportunistic exploitation is unlikely while targeted social-engineering delivery is plausible. No public exploit identified at time of analysis; CISA's SSVC rates exploitation as none and automation as not automatable, and the PR:N vector means the victim need not authenticate to the attacker.

A use-after-free (CWE-416) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on the connecting client, as described in Microsoft's MSRC advisory for CVE-2026-69998. Exploitation is not passive: the victim must actively initiate an RDP session to the hostile endpoint (UI:R), and the unauthenticated attacker (PR:N) must still win a memory-management race or reliably groom the freed heap object to convert the corruption into code execution (AC:H), giving a CVSS 3.1 base score of 7.5. All supported Windows client and server builds below the patched build levels are affected; there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and CISA SSVC records exploitation as none and automatable as no, so the practical risk is driven by social engineering of an outbound RDP connection plus patch lag.

Use-after-free memory corruption in the Microsoft Windows Remote Desktop Client (mstsc.exe) can let an unauthenticated remote attacker execute arbitrary code on a vulnerable client, but only after the victim initiates an outbound RDP connection to an attacker-controlled, compromised, or spoofed RDP server. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) confirms the mandatory user interaction and high attack complexity, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'; no public exploit code has been identified at time of analysis. Microsoft has released fixes via the MSRC update guide, so the practical risk is moderate and concentrated on hosts that routinely open RDP sessions to untrusted or third-party endpoints.

Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to corrupt memory and execute code on the machine that connects to it (CVSS 7.5, C:H/I:H/A:H, SSVC Technical Impact 'total'). The attack is client-initiated and outbound - it requires the victim to establish an RDP session to the hostile endpoint (UI:R) and a favorable memory/race condition to be won (AC:H) - so it does not target a listening RDP service, and no privileges are required on the client (PR:N, unauthenticated). Current intelligence indicates no public exploit code and no confirmed active exploitation (CISA SSVC Exploitation: none; Automatable: no), while Microsoft has released a vendor patch, making this a high-impact-but-not-urgent issue at time of analysis.

Code execution in the Windows Remote Desktop Client (mstsc) is possible when a user initiates an outbound RDP session to a malicious or attacker-controlled server, triggering a use-after-free that can be leveraged for arbitrary code in the client's context. Affected are unpatched Windows client and server builds below their fixed versions - including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012/2012 R2/2016/2019/2022/2025 - while the attacker requires no credentials (PR:N) and the flaw cannot be triggered against a listening host without the victim's outbound connection (UI:R). Exploitation is rated high-complexity (AC:H) because the attacker must reliably win the heap/timing-dependent memory corruption condition; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and Microsoft has released patched builds.

Use-after-free memory corruption in the Windows Remote Desktop Client allows an unauthenticated remote attacker to execute code in the context of the connecting user, but only after the victim initiates an outbound RDP session to an attacker-controlled or compromised server. Microsoft rates the issue 7.5 (High) under CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a total loss of confidentiality, integrity, and availability that is tempered by high attack complexity and mandatory user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis; Microsoft has released fixed builds through its update guide.

Remote code execution in Windows Remote Desktop Services is possible through a use-after-free (CWE-416) in the RDP component, rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can achieve high confidentiality, integrity, and availability impact, but exploitation is not reliable: the attacker must satisfy a race or heap-grooming condition (AC:H), and a victim must initiate or accept a Remote Desktop connection to an attacker-controlled endpoint (UI:R). No public exploit code is identified at time of analysis, CISA SSVC records exploitation as none, and Microsoft has released patches; hosts without the Remote Desktop/RDS role enabled are not exposed, so risk is concentrated on internet- or untrusted-network-facing RDP deployments.

Remote code execution in Microsoft's Windows Remote Desktop Client stems from a use-after-free (CWE-416) triggered when the client processes crafted data supplied by an RDP server. An unauthenticated attacker can exploit this over a network only by inducing a user to connect to an attacker-controlled or compromised RDP server - for example by opening a malicious .rdp file or link - after which heap corruption can lead to code execution in the context of the client. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting required user interaction and high attack complexity; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', no public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed actively exploited (CISA KEV). Vendor patches are available, so the practical risk is concentrated in unpatched Windows clients exposed to untrusted RDP endpoints.

Remote code execution affects the Windows Remote Desktop Client (mstsc) across a wide range of supported desktop and server builds, allowing an attacker who controls or manipulates an RDP endpoint to execute code in the context of the connecting user. The flaw is a use-after-free (CWE-416) rated CVSS 7.5; exploitation requires the victim to actively initiate an RDP session outward to the hostile server (UI:R), and high attack complexity (AC:H) reflects dependence on heap/race conditions rather than a deterministic trigger - no authentication is required of the attacker (PR:N). No public exploit code has been identified at time of analysis and CISA's SSVC records Exploitation=none with no KEV listing, so risk is driven by the breadth of affected Windows builds and the total technical impact should the memory-corruption primitive be reliably converted into code execution.

Outbound RDP sessions from the Windows Remote Desktop Client can be turned against the client itself: when a user connects to an attacker-controlled, compromised, or man-in-the-middle'd RDP server, crafted response data triggers a use-after-free (CWE-416) that can lead to code execution on the victim's machine, with total technical impact if the memory corruption is reliably steered. The attacker needs no credentials on the client (PR:N) and can operate remotely over the network (AV:N), but exploitation is gated by mandatory user interaction (the user must actively initiate the session, UI:R) and high attack complexity (AC:H) reflecting the precision required to trigger and control the freed allocation. Microsoft rates this CVSS 7.5 and has released vendor patches; there is no public exploit identified at time of analysis and no evidence of exploitation - CISA's SSVC assessment records Exploitation: none and Automatable: no.

A use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc.exe / RDP client stack) allows remote code execution in the security context of the connecting user when that user establishes an outbound RDP session to an attacker-controlled or compromised RDP server. Exploitation is unauthenticated with respect to the client (CVSS 3.1 PR:N) but requires user interaction (UI:R) and is rated high attack complexity (AC:H), because the attacker must deliver crafted server-side RDP protocol data and win a race condition over the freed object; the resulting impact is full compromise of confidentiality, integrity and availability within the user's own security scope (S:U, no privilege escalation to SYSTEM). Microsoft has released a vendor patch covering Windows 10, Windows 11 and Windows Server 2012 through 2025, exploitation has not been observed by CISA SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code was identified at the time of analysis.

Use-after-free (CWE-416) in the Windows Remote Desktop Client (mstsc) allows remote code execution on a Windows client that connects out to a malicious or compromised RDP server, affecting all supported Windows 10, Windows 11, and Windows Server builds below the fixed patch levels listed in Microsoft's advisory. Exploitation is not opportunistic: it follows a reverse-RDP pattern in which the victim must initiate the session (UI:R) against attacker-controlled server infrastructure, and public exploitation is not confirmed - CISA SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis. The negotiated CVSS of 7.5 is driven by high attack complexity (AC:H), reflecting the heap-state and timing control needed to win the use-after-free race, while requiring no privileges on the victim (PR:N) and impacting confidentiality, integrity, and availability equally.

Local privilege escalation in Microsoft's Quality Windows Audio/Video Experience (QWAVE) service stems from a use-after-free condition (CWE-416) that can let an already-authenticated local user execute code in the service's more privileged context, with high impact to confidentiality, integrity and availability (C:H/I:H/A:H). Rated CVSS 7.0 with a vector of AV:L/AC:H/PR:L/UI:N/S:U, exploitation requires an attacker who already holds a local account on the host and who can also win a timing or object-lifetime race - CISA's SSVC assessment records Exploitation=none and Automatable=no, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor-released patches for every affected branch, so this is best treated as a moderate-priority post-foothold escalation whose realistic risk is lower than the base score alone suggests, rather than an emergency to be handled outside the normal patch cycle.

Remote code execution in the Microsoft Remote Desktop Client (CWE-416) occurs when a user initiates an RDP connection to an attacker-controlled or compromised server that returns crafted responses, causing the client to reuse a freed memory object. The CVSS vector (AV:N/AC:H/PR:N/UI:R) shows an unauthenticated attacker is required to hold no credentials on the victim host, but must convince the user to start the session and satisfy high-complexity heap-timing conditions for reliable exploitation; impact is confined to the connecting user's security context with no privilege escalation implied. Exploitation only triggers on a client that actively connects outbound, and no public exploit identified at time of analysis.

Local privilege escalation in the Microsoft Streaming Service lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free condition and elevate to full system privileges, yielding high confidentiality, integrity, and availability impact (CVSS 7.0). The flaw is a memory-corruption race condition reachable only from the local machine with a valid low-privileged session (AV:L, AC:H, PR:L, UI:N), so it provides no remote or network-facing attack surface and is not reliably exploitable on every attempt. No public exploit code and no active exploitation have been identified at time of analysis (CISA SSVC exploitation: none), but Microsoft has released patches for every affected Windows branch, so the primary risk is unpatched fleets where an attacker is already resident.

Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.

Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.

Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.

Remote code execution in Windows iSCSI allows unauthenticated attackers to execute code over a network by exploiting a use-after-free (CWE-416) in the processing of crafted iSCSI protocol traffic. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, but the primary limiting factor is that the Microsoft iSCSI Initiator service and iSCSI Target Server role are not enabled by default, so exposure is largely confined to hosts configured for iSCSI storage such as SAN-backed servers. No public exploit identified at time of analysis, and reliable exploitation would require defeating Windows memory mitigations, raising practical difficulty beyond the AC:L rating.

Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.

Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.

Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.

Use-after-free in the Windows Storport Miniport Driver (storport.sys) on Windows Server 2025, including Server Core installations, allows remote attackers to corrupt kernel memory and potentially execute code in the kernel after a user on the host performs an action that reaches the vulnerable driver code path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), no authentication is needed but successful exploitation is conditional on user interaction, which is the primary limiting factor and is consistent with the SSVC assessment of Automatable=no; the specific network-facing feature or protocol that carries the trigger into this storage-stack driver is not named in the available data and should be confirmed against the Microsoft MSRC advisory. A vendor patch is available and hosts at build 10.0.26100.33650 or later are not vulnerable; no public exploit code and no confirmed active exploitation have been identified at time of analysis. Overall, signals are moderately consistent but point to a conditional rather than wormable threat, with technical impact assessed as total if the use-after-free is successfully triggered.

Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a use-after-free that yields high impact to confidentiality, integrity, and availability on affected Windows 11 and Windows Server 2025 hosts. Exploitation is local only and gated by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning the attacker must already hold a low-privileged foothold on the machine and win a heap-grooming or race condition to trigger the bug reliably, so it functions as a post-compromise escalation step rather than a remote attack path. No public exploit has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but patch availability from Microsoft makes unpatched systems the primary exposure.

Remote code execution in Windows iSCSI allows an unauthenticated, network-positioned attacker to trigger an out-of-bounds write and potentially achieve full compromise of confidentiality, integrity, and availability. The vulnerability affects many Windows client and server versions (Windows 10, 11, and Windows Server 2012 through 2025), but exploitation requires the iSCSI service to be enabled and reachable; hosts without that service are not exposed. No public exploit has been identified at time of analysis, though the CISA SSVC framework rates the technical impact as total and the issue as automatable, and a vendor patch is available.

Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).

Use-after-free in the Windows Enterprise App Management component lets an attacker with valid low-level credentials on a target machine, who can reach that machine over the network, corrupt freed memory and elevate to a higher-integrity context. Exploitation is gated by three limiters recorded in the assessed vector: the attacker must already hold a valid account on the target (PR:L), a victim user must perform an interaction (UI:R), and the memory-reuse race that gives an attacker control of the freed object is non-deterministic (AC:H) - so although the attack vector is network-reachable, real-world reliability and prerequisites keep this a moderate-priority issue rather than an emergency. Microsoft has released fixes in the current Windows cumulative updates, and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.