Windows Hyper-V, the virtualization component of Windows 11 and Windows Server, contains a double free flaw (CWE-415). An attacker with a local low-privilege account can exploit it to gain elevated privileges, which could affect the host and the virtual machines running on it. Exploitation requires local access and a valid account; the CVSS vector rates confidentiality, integrity and availability impact as high.
Microsoft · Windows Hyper-V
Windows 10 Version 1607 (and Windows Server 2016 per the CVE record) is affected by an out-of-bounds read in the Windows BitLocker full-disk encryption feature. A local user with low privileges can exploit it to elevate their privileges, with a CVSS base score of 7.8. The attack requires an existing foothold on the system, such as a low-privileged account or malware, and no user interaction.
Microsoft · Windows 10 1607
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler driver allows an attacker with existing local access to elevate privileges. The CNA record describes the impact as code execution with SYSTEM rights. The attack requires a local user session or code already running on the system and is not remotely exploitable (CVSS 7.8, High).
Microsoft · Windows 10
A stack-based buffer overflow in Windows Installer allows an authorized local user to elevate privileges on the affected Windows system. The attack requires local access with low privileges and no user interaction, so it is not directly exposed to the internet. It is most relevant when an attacker already has a foothold, for example through a phished or low-privilege account.
Microsoft · Windows Installer
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A heap-based buffer overflow (CWE-122) in the Windows Fax and Scan Service allows an attacker with a low-privileged local account to elevate privileges to a higher level. No user interaction is required, but the attacker must already be able to run code on the affected system. Microsoft rates the flaw Important with a CVSS 3.1 base score of 7.8.
Microsoft · Windows Fax and Scan Service
A heap-based buffer overflow in the Windows Storage Spaces Controller allows an authorized local user to elevate privileges. An attacker needs an existing foothold on the system, such as a compromised user or service account, and low privileges. Successful exploitation can lead to full control of the affected host (CVSS 3.1: 7.8, High).
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
An integer overflow or wraparound in the Windows Resource Management (MRM) component allows an authorized local user to elevate privileges. The attacker needs an existing low-privileged account on the affected system and no user interaction is required. Impact on confidentiality, integrity and availability is rated high by NVD (CVSS 3.1: 7.8).
Microsoft · Windows
Windows Installer, the Windows component for MSI package installs and maintenance, contains a use-after-free flaw (CWE-416). An authorized local user with low privileges can exploit it to gain higher privileges, up to SYSTEM level, on affected Windows 10, Windows 11 and Windows Server systems (CVSS 7.8). Network access and user interaction are not required, so an attacker needs an existing local foothold. Microsoft reports no public disclosure and no known exploitation.
Microsoft · Windows Installer
A heap-based buffer overflow in the Windows logon component Winlogon allows an attacker with a local, low-privileged account to elevate privileges. Successful exploitation can have high impact on confidentiality, integrity and availability. No user interaction is required, and the vulnerability is not reachable from the internet. Microsoft lists it as not exploited.
Microsoft · Windows
Research and translation in progress – available shortly.
A deserialization flaw in the Microsoft .NET runtime (including the WPF desktop framework) and in Visual Studio 2022 and 2026 allows code execution on the affected system over the network. Microsoft's advisory describes WPF XPS synthetic hyperlinks as the vulnerable path, and an attacker needs a user to open a crafted XPS document and activate a link. Exploitation is rated less likely by Microsoft, and the vulnerability has not been publicly disclosed.
Microsoft · .NET
Research and translation in progress – available shortly.
Microsoft Exchange Server (on-premises) contains an untrusted control sphere inclusion weakness (CWE-829) that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (High). Exploitation requires an existing low-privileged foothold on the Exchange server, for example a compromised account, and no user interaction. A successful attacker can gain full control of the server and its mailboxes, so the flaw mainly raises the impact of any other compromise on the host.
Microsoft · Exchange Server
A use-after-free flaw (CWE-416) in Windows Installer allows an authorized local user to elevate privileges on the affected Windows client and server builds. The attacker needs a valid low-privileged account or code already running as a user, for example after phishing or malware. There is no network attack path, but a successful attack gives full control of the affected machine.
Microsoft · Windows Installer
Research and translation in progress – available shortly.
Deserialization of untrusted data in on-premises Microsoft Exchange Server allows an attacker with a local, low-privileged account on the server to elevate privileges. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability. This is a post-compromise escalation and is not remotely exploitable on its own, but a SYSTEM-level foothold on a mail server exposes mailboxes, credentials and the Active Directory trust.
Microsoft · Exchange Server
