Windows Schannel, the TLS/SSL component of Windows, does not properly verify cryptographic signatures. A remote, unauthenticated attacker can exploit this over the network to spoof a trusted peer. The attack complexity is high, and no user interaction or privileges are required. Microsoft rates the flaw as Important and reports no public disclosure or known exploitation.
Microsoft · Windows Schannel
Windows PowerShell relies on untrusted inputs in a security decision, which allows an unauthorized attacker to execute code over a network. Microsoft scores it CVSS 8.8 (High), but the vector also requires user interaction, which conflicts with the description's wording on the attacker. Supported and unsupported Windows 10, Windows 11 and Windows Server 2012 to 2016 systems below the fixed builds are affected.
Microsoft · Windows PowerShell
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A heap-based buffer overflow in the Windows Media Foundation component allows an unauthenticated attacker to execute code remotely over a network. The CVSS 3.1 base score is 9.8 (critical), and the vector requires no privileges and no user interaction. Microsoft has released security updates; no in-the-wild exploitation or public proof-of-concept was found at the time of research.
Microsoft · Windows Media Foundation
Research and translation in progress – available shortly.
A use-after-free vulnerability in Network Policy Server (NPS) on Windows allows an unauthenticated attacker to execute code. The attack requires adjacent network access and a high-complexity condition, but no user interaction. The CVSS 3.1 base score is 7.5 (High).
Microsoft · Windows Network Policy Server
Research and translation in progress – available shortly.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) allows an attacker to run code on an affected machine. The CVSS vector (9.8, Critical) rates it as network-reachable with low complexity, requiring no privileges and no user interaction. The CVE record describes a heap-based buffer overflow (CWE-122). Windows 10, Windows 11 and Windows Server 2012 to 2016 are affected, as listed below.
Microsoft · Windows Routing and Remote Access Service (RRAS)
Microsoft has fixed an out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) in October 2026. An unauthenticated attacker with network access can send crafted traffic to crash the service, causing a denial of service. The flaw has no confidentiality or integrity impact, and no exploitation in the wild is known.
Microsoft · Windows Routing and Remote Access Service (RRAS)
A flaw (CWE-190, integer overflow or wraparound) in the Windows USB Video Driver allows a local attacker with an existing low-privilege account or code running as a normal user to elevate privileges. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability of the affected system (CVSS 7.8). Microsoft rates the issue Important and exploitation as less likely; no exploitation in the wild or public proof of concept is known.
Microsoft · Windows USB Video Driver
Microsoft Network Policy Server (NPS) contains an integer underflow (CWE-191, CWE-121) that allows an unauthorized network attacker to execute code. The CVSS score is 9.8 (critical) and no user interaction or privileges are required. Exposure of NPS to untrusted networks determines how urgent the risk is for your organisation.
Microsoft · Network Policy Server (NPS)
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows Win32 Kernel Subsystem allows an attacker with local access and low privileges to elevate privileges to SYSTEM. No user interaction is required. The flaw is not remotely exploitable, but it is a serious second stage after phishing, malware or a stolen low-privilege account, especially on shared or multi-user systems.
Microsoft · Windows 11
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Microsoft Windows Error Reporting, the built-in crash-reporting component, contains a heap-based buffer overflow (CWE-122). An attacker with an existing low-privileged local logon can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. The attack is local only and is not reachable from the internet.
Microsoft · Windows Error Reporting
Microsoft Windows Network Policy Server (NPS), the RADIUS and network access policy component of Windows Server, contains a use-after-free vulnerability (CWE-416). An unauthenticated attacker on the network can exploit it to execute code. The CVSS base score is 8.1 (High) with high attack complexity. Exposure depends on whether an NPS server is reachable from untrusted networks.
Microsoft · Windows Network Policy Server (NPS)
Research and translation in progress – available shortly.
An out-of-bounds read in the Windows GDI graphics component allows an unauthenticated attacker to disclose information over a network. The CNA record states that no user interaction is required, but the CVSS score differs between sources (7.5 or 6.5). The impact is limited to confidentiality; integrity and availability are not affected.
Microsoft · Windows
Windows Installer, the Windows component that installs and maintains MSI packages, contains a numeric truncation error that allows an authorized attacker to elevate privileges locally. The attacker needs a local foothold with low privileges, for example through malware, a phishing payload or an insider, and no user interaction is required. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected system. The CVSS 3.1 base score is 7.8 (High).
Microsoft · Windows Installer
A use-after-free flaw in the Windows Text Services Framework allows an authorized local user to elevate privileges. An attacker needs a valid low-privileged account on the affected machine, so the flaw is not remotely exploitable. Successful exploitation can give full control of the system (high confidentiality, integrity and availability impact).
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free flaw (CWE-416) in the Routing and Remote Access Service (RRAS) of supported Windows 10, Windows 11 and Windows Server versions allows remote code execution. An unauthenticated attacker can send crafted network traffic to a reachable RRAS service and gain unauthorized access to the machine, with no user interaction needed. The CVSS 3.1 base score is 9.8 (critical). Systems that do not run RRAS are not affected.
Microsoft · Windows Routing and Remote Access Service (RRAS)
