New vulnerabilities – clearly explained

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows Kernel: Elevation of privilege via heap-based buffer overflow

A heap-based buffer overflow in the Windows Kernel allows an authorized local attacker to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. An attacker needs local code execution or a valid low-privilege account, so the flaw typically serves as a second step after phishing, a stolen credential or malware. Microsoft has published security updates; no exploitation or public exploit code is known.

Microsoft · Windows Kernel

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows Subsystem for Linux: Elevation of privilege via use-after-free

A use-after-free vulnerability (CWE-416) in the Windows Subsystem for Linux (WSL) component of several Windows 10, Windows 11 and Windows Server versions allows an authorized local attacker to elevate privileges. The attacker needs a local account with low privileges and no user interaction is required. It is not directly reachable from the internet, but it matters on shared systems, terminal servers and developer workstations with WSL.

Microsoft · Windows Subsystem for Linux

Windows Installer: Use-after-free enables local privilege escalation

Windows Installer, the Windows component behind MSI installs, repairs and uninstalls, contains a use-after-free flaw (CWE-416). A local user with low privileges and no user interaction can exploit it to elevate privileges on the system. Local access is required, so the main risk lies on shared workstations, multi-user systems and terminal servers rather than internet-facing services. Microsoft released a security update on October 13, 2026.

Microsoft · Windows Installer

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows 10 1607: Local privilege escalation in SysMain service

Windows 10 version 1607 and Windows Server 2016 contain an out-of-bounds read in the Windows SysMain service. An authorized local user can exploit it to elevate privileges, with high impact on confidentiality, integrity and availability. CISA's SSVC assessment lists no exploitation and marks the flaw as not automatable.

Microsoft · Windows 10 1607

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Powershell

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

AD FS: Spoofing through improper SAML signature verification

Active Directory Federation Services (AD FS) does not properly verify the cryptographic signature of SAML responses in affected Windows Server and Windows 10 builds. An unauthenticated attacker on the network can replay a validly signed SAML response intended for a different endpoint against an affected AD FS endpoint, which enables spoofing. Microsoft rates the severity as Important, while NVD scores it 9.1 (Critical). Microsoft reported no exploitation at disclosure.

Microsoft · Active Directory Federation Services (AD FS)

Microsoft PowerShell: Remote code execution via untrusted inputs

Microsoft PowerShell 7 contains a flaw in a security decision that relies on untrusted input (CWE-807). According to Microsoft, an unauthorized attacker can execute code over the network, but user interaction is required. Affected are PowerShell 7.4, 7.5 and 7.6 before the fixed builds. Microsoft rates exploit maturity as Unproven and no public exploit is known.

Microsoft · PowerShell

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows: Use-after-free in Win32 kernel subsystem allows local privilege escalation

A use-after-free flaw in the Windows Win32 kernel subsystem (win32k) allows an authorized local user to elevate privileges to a higher level, including SYSTEM. The attacker needs an existing low-privilege account or code running on the system. Microsoft rates the vulnerability as Important with CVSS 7.8, and it is not remotely exploitable.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.