New vulnerabilities – clearly explained

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Windows PCI Bus Driver: Heap-based buffer overflow enables privilege escalation

A heap-based buffer overflow in the Windows PCI Bus Driver allows an authorized local user to elevate privileges. Affected are supported Windows 10, Windows 11 and Windows Server 2019, 2022 and 2025 systems. An attacker needs a local account with low privileges and no user interaction, and a successful attack can lead to full control of the affected machine. The vulnerability is not reachable directly from the internet.

Microsoft · Windows PCI Bus Driver

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows StateRepository API: Use-after-free leads to local privilege escalation

A use-after-free flaw (CWE-416) in the Windows StateRepository API allows an authorized local user with low privileges to elevate their privileges. The flaw is rated CVSS 7.8 (High) and can affect confidentiality, integrity and availability on the local system. An attacker needs a valid local account or a prior foothold on the system, and the flaw cannot be exploited remotely. Microsoft released a fix in its October 2026 updates (published 13 October 2026).

Microsoft · Windows StateRepository API

Microsoft Windows 11 24h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows: Heap-based buffer overflow in Win32k GRFX allows local privilege escalation

A heap-based buffer overflow in the Windows Graphics Component (GRFX) of Win32k allows an authorized local attacker to elevate privileges. The attacker needs local code execution or a valid low-privilege account, for example after phishing malware or a stolen password. Successful exploitation could fully compromise confidentiality, integrity and availability of the affected system. Microsoft has released fixes for the affected Windows builds.

Microsoft · Windows

Windows: Use-after-free in Direct Composition enables local privilege escalation

Several supported Windows 10, Windows 11 and Windows Server versions contain a use-after-free flaw (CWE-416) in the Windows Direct Composition graphics component. A local user with low privileges can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. The attacker needs an existing local logon, no user interaction is required, and the flaw is not directly reachable from the internet. No known exploitation or public exploit code is reported.

Microsoft · Windows

Microsoft Windows: Heap-based buffer overflow in UI Immersive Server API

A heap-based buffer overflow in the Windows UI Immersive Server API allows an attacker with local, low-privilege access to elevate privileges on the affected system. The CVSS vector has a changed scope (S:C), so the impact can reach beyond the vulnerable component. Exploitation requires a local, authenticated user and is not possible over the network. Microsoft rates the severity as Important and reports no public disclosure.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows DNS Server: Remote Code Execution in DNS Server

A flaw in the Windows Domain Name Service (DNS) Server role allows an unauthenticated attacker to execute code remotely over the network via an untrusted pointer dereference (CWE-822). Microsoft rates it Important with a CVSS 3.1 base score of 8.8, and user interaction is listed as required. The risk is mainly relevant for DNS servers that are reachable from untrusted networks, such as the internet, DMZ, partner or guest networks.

Microsoft · Windows DNS Server

Microsoft Windows: Heap overflow in Direct Composition allows privilege escalation

A heap-based buffer overflow in the Windows Direct Composition component allows an attacker with a low-privileged local account to elevate privileges to a higher level. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of the affected system. The vulnerability is not reachable from the internet and requires a foothold on the system first, for example via phishing or malware.

Microsoft · Windows

Microsoft Windows 10 1607: Local privilege escalation in Win32K GRFX

A heap-based buffer overflow in the Win32K GRFX (graphics) component of Windows 10 Version 1607 and Windows Server 2016 allows a local attacker with a low-privilege account to elevate privileges to a higher level. The attacker needs local access and an existing foothold, for example through malware or a malicious insider, so this is a post-compromise escalation step rather than an internet-facing entry point. Successful exploitation can affect confidentiality, integrity and availability of the system.

Microsoft · Windows 10 1607

Microsoft SharePoint Server: Remote code execution via deserialization

A deserialization flaw (CWE-502) in on-premises Microsoft SharePoint Server Subscription Edition allows code execution over the network. An attacker needs a valid account with low privileges, such as a Site Member account or a compromised staff account. NVD lists a CVSS base score of 8.8; VulDB lists 6.3 and CWE-94.

Microsoft · SharePoint Server

Azure HDInsight: Information disclosure vulnerability

Microsoft Azure HDInsight, a managed cloud service for open-source big-data frameworks, contains an information disclosure vulnerability (CWE-200). An unauthorized attacker with network access can obtain sensitive information without authentication or user interaction. Microsoft does not state which data is exposed, and the CVSS vector indicates a confidentiality impact only.

Microsoft · Azure HDInsight

Microsoft Windows 11: Elevation of privilege in Health and Optimized Experiences

A missing authentication check for a critical function in the Windows Health and Optimized Experiences Service allows an authorized local user to elevate privileges. Successful exploitation can give an attacker high impact on confidentiality, integrity and availability of the system. Microsoft classes the attack as local with low privileges required, so an attacker first needs a foothold such as a logged-in account or malware. A public proof-of-concept has been reported, so unpatched systems should be prioritised.

Microsoft · Windows 11

Microsoft Office for Android: Elevation of privilege via stack-based buffer overflow

Microsoft Office for Android contains a stack-based buffer overflow in the Microsoft Office Graphics component. An authorized attacker with a low-privileged foothold on the network can elevate privileges, with user interaction required. The vendor rates the impact on confidentiality, integrity and availability as high. The CPE entry 365 Copilot in the source data is not supported by the CVE record or the MSRC advisory and should be corrected.

Microsoft · Office for Android

Microsoft Windows Subsystem For Linux

Research and translation in progress – available shortly.

Microsoft Windows Message Queuing: Use-after-free allows local code execution

A use-after-free vulnerability (CWE-416) in the Queue Manager component of Windows Message Queuing (MSMQ) allows an authorized local attacker to execute code. The CVSS 3.1 base score is 7.8 (High) with a local attack vector, low privileges required and no user interaction. An attacker needs an existing low-privileged account or foothold on the system, so the main risk is privilege escalation and full compromise after an initial intrusion. The CVE title mentions Remote Code Execution, but the description and CVSS vector describe local exploitation only.

Microsoft · Windows Message Queuing

Windows Storage VSP Driver: Use-after-free leads to local privilege escalation

A use-after-free flaw in the Windows Storage VSP Driver, a kernel-level Windows storage component, allows an attacker who is already authorised on the system to elevate their privileges locally. The attack is local only and is not reachable from the internet. The main risk is privilege escalation after an attacker has gained a foothold, for example through phishing or a compromised low-privilege account.

Microsoft · Windows Storage VSP Driver

Windows 10 1607: Heap-based buffer overflow in Windows Kernel-Mode Drivers

A heap-based buffer overflow in the Windows Kernel-Mode Drivers allows a local user with low privileges to elevate privileges to SYSTEM. Exploitation requires a local logon or code running as a standard user, and no user interaction. Windows 10 Version 1607 and Windows Server 2016 are no longer receiving security updates from Microsoft as of October 13, 2026, so this issue is likely to remain unpatched on those systems unless they are covered by an extension.

Microsoft · Windows 10 1607

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Search Component: Privilege escalation via heap overflow

The Microsoft Windows Search Component contains a heap-based buffer overflow that allows an authorized local user to elevate privileges. A successful attacker can gain SYSTEM-level rights, which affects confidentiality, integrity and availability. Exploitation requires local access with low privileges, and user interaction may be part of the attack chain. Microsoft has released fixes, and no public exploit or in-the-wild exploitation has been reported.

Microsoft · Windows Search Component