New vulnerabilities – clearly explained

Microsoft 365 Apps

Research and translation in progress – available shortly.

Windows Search Component: Link following leads to local privilege escalation

A link-following flaw (CWE-59) in the Microsoft Windows Search Component allows an attacker with a local, low-privileged account to elevate privileges. Successful exploitation can give full control over confidentiality, integrity and availability of the affected system. The attacker needs local access and a valid user account; the flaw is not remotely exploitable.

Microsoft · Windows Search Component

Microsoft 365 Apps

Research and translation in progress – available shortly.

Microsoft Windows DWM Core Library: Out-of-bounds read in local privilege escalation

The Windows Desktop Window Manager (DWM) Core Library contains an out-of-bounds read (CWE-125). A local user with existing low-privilege access can exploit it to elevate privileges to a higher level, with high impact on confidentiality, integrity and availability. The attack is not remote. It matters most after another compromise, such as phishing or malware, and on multi-user systems such as terminal or RDS servers.

Microsoft · Windows

Windows: Out-of-bounds read in DWM Core Library allows local privilege escalation

Windows contains an out-of-bounds read (CWE-125) in the Desktop Window Manager (DWM) Core Library. An attacker with local, low-privilege access to an affected system can exploit it to elevate privileges, which can lead to full control of the machine (CVSS 7.8). The attacker needs an existing foothold on the system, and the flaw is not directly reachable from the network.

Microsoft · Windows

Microsoft Office Word: Heap-based buffer overflow leading to remote code execution

A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps, Office LTSC 2021/2024 and Office for Mac, allows an unauthorized attacker to execute code over the network. The attack requires a user to open a crafted document, which is typically delivered by email or download. Successful exploitation would run code with the privileges of the logged-in user, with high impact on confidentiality, integrity and availability.

Microsoft · Office Word

Microsoft Office Word: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The CVSS score is 8.1 and Microsoft rates the flaw as Critical. Attack complexity is high and no privileges are required. The vector specifies no user interaction, but some sources describe the Preview Pane as a trigger, so the risk from untrusted documents should be treated as real. Microsoft reports that exploitation is not known.

Microsoft · Office Word

Microsoft 365 Apps

Research and translation in progress – available shortly.

Microsoft 365 Apps

Research and translation in progress – available shortly.

Microsoft Windows Search Component: Elevation of privilege via use after free

A use-after-free flaw in the Windows Search Component allows an authorized local user to elevate privileges. The attack requires local access with low privileges and no user interaction, and it can fully compromise confidentiality, integrity and availability of the affected system. Exposure is local only, so the main risk is a user account or malware that already has a foothold on a workstation or server.

Microsoft · Windows Search Component

Windows DWM Core Library: Out-of-bounds read enables local privilege escalation

An out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows an authorized local user to elevate privileges. Exploitation requires local access and a valid low-privilege account, so it is typically a second step after another compromise. Microsoft rates the flaw at CVSS 7.8 (High), while CISA SSVC rates it as not automatable.

Microsoft · Windows DWM Core Library

Microsoft Windows DWM Core Library: Out-of-bounds read leads to privilege escalation

An out-of-bounds read in the Windows DWM Core Library (Desktop Window Manager) allows a local attacker with low privileges to elevate privileges. Successful exploitation could give the attacker full control over confidentiality, integrity and availability of the affected system. The attacker needs a local account on the system; the flaw cannot be exploited remotely without prior access.

Microsoft · Windows DWM Core Library

Windows DWM Core Library: Out-of-bounds read allows local privilege escalation

An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library allows an authorized local user to elevate privileges. The attacker needs local code execution or a low-privileged account first. The flaw has a CVSS 3.1 score of 7.8 (High) and affects several Windows 10, Windows 11 and Windows Server versions.

Microsoft · Windows

Microsoft Office PowerPoint: Use-after-free leads to remote code execution

A use-after-free memory flaw (CWE-416) in Microsoft Office PowerPoint allows an unauthenticated attacker to execute code remotely over a network. Per the CVE record, the attack needs no login and no user privileges, and the CVSS base score is 9.8 (critical). Sources disagree on the attack path: Microsoft describes crafted presentations processed by an Office Online service, while CrowdStrike lists the Preview Pane as a vector, so a crafted file delivered by mail, download or a web-based Office service should be treated as a plausible risk.

Microsoft · Microsoft 365 Apps

Windows DWM Core Library: Local privilege escalation via out-of-bounds read

A flaw in the Windows DWM Core Library (Desktop Window Manager) allows an out-of-bounds read (CWE-125). An attacker with a valid local, low-privilege account can use it to elevate privileges to a higher level, with high impact on confidentiality, integrity and availability. The attack requires local access and no user interaction, so the risk is mainly on shared PCs, terminal servers and systems where malware already has a foothold.

Microsoft · Windows

Microsoft 365 Apps

Research and translation in progress – available shortly.

Windows Deployment Services: Remote code execution due to race condition

Windows Deployment Services (WDS) in multiple Windows 10 and Windows Server versions contains a race condition (CWE-362) caused by improper synchronization of a shared resource. An unauthenticated attacker with network access to the WDS service can exploit it to execute code, but the attack requires winning the race, which Microsoft and the CVSS vector rate as high complexity. CVSS 3.1 base score is 8.1 (High), while Microsoft lists the maximum severity as Critical.

Microsoft · Windows Deployment Services

Microsoft Windows BITS: Use-after-free allows remote code execution

A use-after-free flaw in the Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over the network. The attack requires no privileges or user interaction, but its complexity is high. BITS is a background file transfer component used by Windows Update and other software, so affected systems should be treated as a priority.

Microsoft · Windows Background Intelligent Transfer Service (BITS)

Microsoft 365 Apps

Research and translation in progress – available shortly.

Windows DHCP Server: Remote code execution through double free

A double free (CWE-415) in the Windows DHCP Server service allows an unauthenticated attacker on the network to execute code with full impact on confidentiality, integrity and availability. The NVD CPE lists only Windows 10 1607, but the official CNA record covers several Windows 10 and Windows Server versions. Exploitation requires a network position with access to the DHCP service, which is normally limited to the internal LAN. No exploitation in the wild and no public PoC have been reported.

Microsoft · Windows DHCP Server

Microsoft 365 Apps

Research and translation in progress – available shortly.

Windows: Heap-based buffer overflow in Bind Filter Driver allows privilege escalation

Microsoft Windows contains a heap-based buffer overflow in the Windows Bind Filter Driver. An attacker with local access and a low-privileged account can exploit it to elevate privileges on the affected system. Microsoft reports that the vulnerability is not publicly disclosed and not exploited, and CVSS rates it 7.8 (High).

Microsoft · Windows

Microsoft 365 Apps

Research and translation in progress – available shortly.

Microsoft SharePoint Server: Remote code execution through integer overflow

An integer overflow or wraparound in Microsoft Office SharePoint Server allows remote code execution over the network. Microsoft rates the flaw Important with a CVSS score of 8.8. According to Microsoft, an attacker needs an authenticated account with Manage List permission, so anonymous internet attackers should not reach it directly. Risk increases where SharePoint is internet-facing, self-registration is enabled, credentials are weak or reused, or accounts with list rights are compromised.

Microsoft · SharePoint Server

Windows Active Directory Domain Services: Remote code execution

Microsoft has fixed an out-of-bounds write in Windows Active Directory Domain Services (AD DS), the directory service on Windows Server and domain controllers. An authorized attacker with valid low-privilege domain credentials can execute code over the network, and the CVSS rating assumes total loss of confidentiality, integrity and availability. Exposure is mainly internal, because no internet access is required, but compromising a domain controller would give an attacker control of the whole domain.

Microsoft · Active Directory Domain Services