Use After Free

Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.

Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.

Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.

Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).

Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.

Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.

Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.

A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.

Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.

A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.

Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.

A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.

Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.

In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.

Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.

Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.

A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.

Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.

Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.

Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.

Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.

Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.

Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.

Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.

A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.

Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.

Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.

Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.

Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.

Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.

Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).

Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.

Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.

Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.

Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).

Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.

Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.

Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.

Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.

A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.

Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.

Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.

Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.

Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.

Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of the current user when a victim opens or previews a specially crafted spreadsheet, making this a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no credentials or pre-existing privileges are needed, but because user interaction is required (UI:R) and no non-default configuration is involved, exploitation depends on social engineering - typically a phishing attachment, a malicious link, or a web-hosted document - rather than direct remote triggering. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per Microsoft's advisory.

Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.

Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.

Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.

Local privilege escalation in Microsoft OneNote stems from a use-after-free memory corruption flaw (CWE-416) that an authenticated attacker with low-privilege local access can trigger to execute code in a higher-privileged context. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the corresponding Mac editions. No public exploit has been identified at time of analysis, and vendor patches are available; given the local access prerequisite and patch availability, this is a patch-priority item rather than an emergency.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.

Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.

Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.

Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.

Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.

Local privilege escalation in the Windows Client License Service allows an authenticated low-privileged attacker to gain SYSTEM-level code execution by triggering a use-after-free (CWE-416) with a crafted local process, with high impact to confidentiality, integrity, and availability. Affected are unpatched Windows 10, Windows 11, and Windows Server builds (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2022 below 10.0.20348.5761); exploitation requires pre-existing local low-privileged access (CVSS AV:L/PR:L, UI:N) and no public exploit or active exploitation is identified at time of analysis, with SSVC reporting exploitation: none. This is a credible but not emergency-priority local privilege escalation driven by a post-foothold memory-corruption primitive.

Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.

Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.

Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.

Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows USB Print Driver lets an authenticated attacker who already holds a foothold on a vulnerable Windows host corrupt kernel memory and obtain SYSTEM-level code execution. The flaw is a use-after-free (CWE-416) reachable only through the USB printing driver path; the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, base 7.0) requires valid local credentials and a successful race on freed kernel memory, so exploitation is timing-dependent, non-deterministic, and rated non-automatable by CISA SSVC. Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases, and no public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.

Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.

Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an attacker who already holds low-privileged code execution on a WSL-enabled host to trigger a use-after-free and obtain full control over confidentiality, integrity, and availability (CVSS 7.8, CWE-416). Exploitation is strictly local (AV:L) and requires an existing account or foothold with low privileges (PR:L), but needs no user interaction and has low attack complexity, so a reliable trigger is plausible once the prerequisites are met; hosts where the optional WSL feature is not installed are not exposed. No public exploit code and no confirmed active exploitation have been identified, and Microsoft has released fixed builds for every affected Windows 10, Windows 11, and Windows Server version, so patching is the decisive risk-reduction step.

Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.

Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.

A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.

A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.

A use-after-free in the Windows USB Print Driver (CWE-416) allows an attacker who already holds low-privileged local access to a Windows host to escalate privileges and obtain full control over confidentiality, integrity, and availability of the affected system. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025 (including Server Core installations), per the EUVD version ranges. Exploitation requires winning a timing-dependent race in the driver (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), which CISA's SSVC rates as not automatable, and no public exploit has been identified at time of analysis - this is a post-compromise privilege-escalation primitive rather than an opportunistic remote threat, and Microsoft has shipped a vendor update addressing it.

Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.

Local privilege escalation in the Windows USB Print Driver (usbprint.sys) lets an authenticated, low-privileged user on the target host raise their privileges to SYSTEM by winning a use-after-free race in the driver's request-handling path. CVSS 3.1 scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker must already have a foothold on the machine, no user interaction is needed, and the high attack complexity reflects the probabilistic nature of reclaiming the freed object. The affected builds are Windows 10 21H2/22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2022 and Windows Server 2025 (including Server Core); no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and Microsoft has published fixes, so this is a moderate-priority local escalation rather than an emergency remote threat.

Local privilege escalation in the Microsoft Windows Win32 kernel subsystem lets an authenticated attacker holding low-privileged access on an affected host corrupt kernel memory via a use-after-free race and escalate to full system privileges. Microsoft rates it CVSS 7.8 (AV:L/PR:L/UI:N, with high confidentiality, integrity and availability impact) and has shipped fixed builds for Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025; no public exploit identified at time of analysis, and CISA's SSVC assessment records no known exploitation and marks the flaw as not automatable, since winning the UAF timing is attacker-dependent rather than reliably scriptable. Because the vector is entirely local and requires prior code execution in a low-privilege context, this is a credible but not emergency-level priority - it matters most as a post-compromise elevation step on unpatched builds.

Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.

Local privilege escalation in Windows Hyper-V allows an authenticated, low-privileged user on a Hyper-V-enabled Windows host to trigger a use-after-free and execute code at a higher integrity level, ultimately reaching SYSTEM-level privileges on the host. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 builds prior to their fixed levels, and is only reachable once the attacker already holds local access on a system where the Hyper-V role is enabled. No public exploit identified at time of analysis, and CISA's SSVC decision framework records exploitation as none with the attack assessed as not automatable.

Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.

Local privilege escalation in the Windows Desktop Window Manager (DWM) allows an authenticated local attacker with low privileges to execute arbitrary code at a higher integrity level, typically SYSTEM, on affected Windows 10, 11, and Server installations. The flaw is a use-after-free (CWE-416) in DWM, requiring no user interaction (UI:N) and only low privileges (PR:L), so any unprivileged process on a vulnerable build can trigger it. Microsoft has released patches, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.

Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privileges of the opening user by delivering a specially crafted presentation that must be opened or rendered. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions; vendor patches are available. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none', though the raw CVSS score is 9.8 because successful exploitation yields total confidentiality, integrity, and availability impact.

Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.

A use-after-free in the Windows Background Intelligent Transfer Service (BITS) lets an attacker who already holds low-privilege local code execution on a Windows host elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The service ships by default on every supported Windows client and server edition, but the flaw is a post-compromise escalation primitive rather than an initial-access vector - there is no remote or network-reachable path and no victim interaction is required, so exploitation is limited to hosts where an attacker or malware is already running as a standard user on a pre-patch build. Microsoft has released fixes; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), making this a genuine patch-priority item rather than an emergency. Patched builds are enumerated per Windows version (for example Windows 11 24H2 fixed in 10.0.26100.9711, Windows Server 2022 in 10.0.20348.5761), so only unpatched systems remain exposed.

Use-after-free memory corruption in Microsoft PowerPoint enables unauthenticated remote attackers to execute arbitrary code on a victim's machine when a maliciously crafted presentation is opened. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no authentication is required, but exploitation depends on the target opening the attacker-supplied file, making email attachments, chat-delivered documents, and shared links the practical delivery vectors. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the macOS Office SKUs; the vendor has released updates, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in the Windows Kernel lets an authenticated attacker who already has low-privileged code execution on the host win a use-after-free race condition to obtain SYSTEM-level rights, yielding full compromise of confidentiality, integrity, and availability (CVSS 7.0, CWE-416). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds in the ranges listed by Microsoft are affected; the flaw is not remotely reachable, requires local authenticated access, and carries high attack complexity, so exploitation is likely unreliable and may need repeated attempts. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, not in KEV), and vendor patches are available, making this a credible but not top-tier priority for most environments.

Local privilege escalation in the Windows Kernel (CWE-416 use-after-free) affects Windows 11 versions 24H2, 25H2, 26H1, 26H2, and Windows Server 2025 including Server Core; an authenticated attacker with low privileges can exploit this to gain kernel-level or SYSTEM privileges on the local machine. The vulnerability requires local access and high attack complexity (likely a race condition or specific heap state), with no remote vector and no user interaction required; SSVC reports exploitation none and no public exploit identified at time of analysis. Microsoft has released patches addressing the issue, and updating to the fixed builds removes the vulnerability.

Local privilege escalation in the Microsoft Windows Kernel lets an attacker who already holds authenticated, low-privileged local code execution on a target host elevate to SYSTEM-level rights by triggering a use-after-free memory corruption condition. The flaw affects a broad range of unpatched Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - and Microsoft has published a fixing update via its MSRC advisory. No public exploit code or active exploitation has been identified at time of analysis: CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so this is a genuine but moderate-priority, patch-now issue rather than a top-tier emergency.