New vulnerabilities – clearly explained

Microsoft Windows DNS Server: Remote code execution in DNS Server

A untrusted pointer dereference in the DNS Server role of Windows allows an unauthenticated attacker to execute code remotely over the network. The CVSS base score is 8.8 and the CNA rates the impact as total. Per the research notes, user interaction is required according to the CVSS vector, but this should not be relied on to rule out risk.

Microsoft · Windows DNS Server

Microsoft Windows 11 24h2

Research and translation in progress – available shortly.

Microsoft Office Click-to-Run: Elevation of privilege via use-after-free

A use-after-free flaw in the Microsoft Office Click-to-Run component allows a locally authenticated attacker with low privileges to elevate their privileges on the system. Exploitation requires local access and a valid low-privilege account or foothold, and no user interaction. The flaw is not internet-facing, but it is a risk on shared or multi-user systems.

Microsoft · Office Click-to-Run (365 Apps / Office LTSC)

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows: Use-after-free privilege escalation in Broadcast DVR service

A use-after-free flaw in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges to a higher level, with a CVSS 3.1 base score of 7.8. An attacker needs a valid local account or code execution as a low-privileged user, and no user interaction is required. The flaw is not remotely exploitable on its own, but once used it can lead to full compromise of the affected system.

Microsoft · Windows

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows Server: Remote code execution in Failover Cluster

A use-after-free vulnerability (CWE-416) in the Windows Failover Cluster feature allows an unauthenticated attacker to execute code over the network. Microsoft rates the CVSS 3.1 base score as 9.8 (Critical), while its own maximum severity is Important. The risk applies only to servers where the Failover Cluster role is installed and reachable from untrusted networks.

Microsoft · Windows Server

Microsoft Windows IME: Elevation of privilege due to weak authentication

A weak authentication flaw in the Microsoft Input Method Editor (IME) component of Windows allows an authorized local attacker to elevate privileges. The attacker needs local access and a valid low-privilege account, so the vulnerability is not remotely exploitable. Microsoft does not publicly describe the mechanism, and no exploitation has been reported.

Microsoft · Windows

Microsoft Windows Storage Spaces Controller: Elevation of privilege via use-after-free

A use-after-free flaw (CWE-416) in the Windows Storage Spaces Controller allows an authorized local attacker to elevate privileges. The attack requires local access with low privileges and no user interaction. Microsoft has released fixes; the CVE is not known to be exploited in the wild.

Microsoft · Windows Storage Spaces Controller

Microsoft Windows Server 2019

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Azure Storage Library: Injection leading to unauthorized deletion

The Azure Storage Blobs client library for Java and the azure-storage-blob-batch library do not properly neutralize special elements in values used by a downstream component. An authenticated attacker who can supply a blob tag condition to an application using the affected library can add unauthorized deletion options to a permitted storage operation, so that recovery snapshots or blobs are deleted even though the application did not intend this. The attack requires network access and low privileges, and no user interaction; the library itself opens no listening service.

Microsoft · Azure Storage Library

Microsoft Windows: Heap-based buffer overflow in Desktop Window Manager

Desktop Window Manager, the Windows component that composes the desktop, contains a heap-based buffer overflow (CWE-122) that allows privilege escalation. The affected branches include Windows 10 Version 1809, 21H2 and 22H2, Windows 11 (23H2 to 26H2), and Windows Server 2019, 2022 and 2025. A local attacker with low privileges can exploit the flaw to gain SYSTEM privileges, which gives full control over the affected system. The attacker needs a local session on the machine, for example through a user account or malware that is already running.

Microsoft · Windows

Microsoft ASP.NET Core: HTTP request smuggling in Kestrel

ASP.NET Core's Kestrel web server can reparse unread request body bytes of an aborted HTTP/1 connection as a new request. A remote, unauthenticated attacker can use this to smuggle requests, tamper with traffic and potentially bypass proxy or WAF filters. Applications served by Kestrel over HTTP/1.1, particularly internet-facing apps and apps behind reverse proxies, are most at risk.

Microsoft · ASP.NET Core

Windows Management Instrumentation: Elevation of privilege via deserialization

A local user with low privileges can exploit a deserialization flaw in Windows Management Instrumentation (WMI) to gain higher privileges, up to SYSTEM. The CVE covers many Windows 10, Windows 11 and Windows Server builds, including Windows 10 Version 1607. The CVSS 3.1 base score is 7.8, and the attack requires a local foothold such as a standard user account or malware. Microsoft reports the vulnerability as not publicly disclosed and not exploited.

Microsoft · Windows

Microsoft Windows Installer: Use-after-free elevation of privilege

A use-after-free flaw in Windows Installer, the component that installs, repairs and removes MSI packages, allows a locally authorized user to elevate privileges. An attacker needs a local low-privilege account, for example after malware or phishing has gained a foothold. Successful exploitation can lead to full compromise of the affected machine (CVSS 7.8).

Microsoft · Windows Installer

Microsoft Windows 11 24h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Configuration Manager: SQL injection with privilege escalation

Microsoft Configuration Manager (ConfigMgr) contains an SQL injection flaw (CWE-89) that allows privilege escalation. An attacker with a valid low-privilege account who can reach the affected site over the network can inject SQL commands and gain higher privileges. No user interaction is required. Because ConfigMgr holds privileged access to managed endpoints, a successful attack could affect many devices.

Microsoft · Configuration Manager

Windows 11: Elevation of privilege in VBS Enclave via integer overflow

An integer overflow in the Windows Virtualization-Based Security (VBS) Enclave component of Windows 11 allows a local attacker to elevate privileges. The attacker needs a local account with low privileges, so the flaw is not reachable from the internet. Microsoft reports no known exploitation and no public disclosure.

Microsoft · Windows 11

Windows Graphics Kernel: Use after free enables local privilege escalation

A use-after-free flaw (CWE-416) in the Windows Graphics Kernel allows an attacker with local, low-privilege access to elevate privileges. Successful exploitation could give the attacker full control over the affected system (confidentiality, integrity and availability impact rated high). The attack requires local access and an existing user foothold; remote exploitation is not possible. The CVSS base score differs between sources: the brief states 7.8, while NVD-derived trackers and Talos report 8.8 (Scope Changed).

Microsoft · Windows Graphics Kernel

Microsoft Windows Host Guardian Service: Local privilege escalation

Improper access control in the Windows Host Guardian Service allows an authorized local attacker to elevate privileges. The Host Guardian Service is typically used on Windows Server hosts for Shielded VMs and guarded Hyper-V hosts. An attacker needs a valid low-privilege account on the affected system and no user interaction is required. Successful exploitation can lead to full compromise of the host, including protected virtual machines and their keys.

Microsoft · Windows Host Guardian Service

Microsoft Windows Hyper-V: Double free allows local privilege escalation

Windows Hyper-V, the virtualization component of Windows 11 and Windows Server, contains a double free flaw (CWE-415). An attacker with a local low-privilege account can exploit it to gain elevated privileges, which could affect the host and the virtual machines running on it. Exploitation requires local access and a valid account; the CVSS vector rates confidentiality, integrity and availability impact as high.

Microsoft · Windows Hyper-V