New vulnerabilities – clearly explained

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Routing and Remote Access Service: Remote code execution (use-after-free)

A use-after-free flaw (CWE-416) in the Routing and Remote Access Service (RRAS) of supported Windows 10, Windows 11 and Windows Server versions allows remote code execution. An unauthenticated attacker can send crafted network traffic to a reachable RRAS service and gain unauthorized access to the machine, with no user interaction needed. The CVSS 3.1 base score is 9.8 (critical). Systems that do not run RRAS are not affected.

Microsoft · Windows Routing and Remote Access Service (RRAS)

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607: Privilege escalation in CD-ROM driver

A type confusion flaw (CWE-843) in the Windows CD-ROM driver allows an authorized local user to elevate privileges. Windows Server 2016 is also listed as affected. The attacker needs an existing low-privilege local account or foothold, and Microsoft rates the impact on confidentiality, integrity and availability as high (CVSS 3.1: 7.8). Microsoft reports no public disclosure and no known exploitation.

Microsoft · Windows 10 1607

Windows Print Spooler: Elevation of privilege vulnerability

Weak authentication in Windows Print Spooler Components allows an authorized local attacker to elevate privileges. The attack is local only and requires the attacker to already have a foothold on the device, for example through a phished standard user account or malware. NVD and the CVE record rate it CVSS 7.8 (High), with high impact on confidentiality, integrity and availability if exploited.

Microsoft · Windows Print Spooler

Microsoft Windows UPnP Device Host: Use after free allows local privilege escalation

A use-after-free weakness (CWE-416) in the Windows Universal Plug and Play (UPnP) Device Host allows an authorized local user to elevate privileges. The attacker needs local access and a low-privileged account first; the vulnerability is not reachable remotely over the network. Microsoft rates it Important with a CVSS 3.1 base score of 7.8.

Microsoft · Windows Universal Plug and Play (UPnP) Device Host

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows UPnP Device Host: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow (CWE-122) in the Windows Universal Plug and Play (UPnP) Device Host allows an authorised local user to elevate privileges. Successful exploitation would give the attacker SYSTEM-level control of the affected host (CVSS 3.1: 7.8, High). The attacker needs a valid low-privileged local account and no user interaction, so this is a post-compromise escalation rather than an internet-facing entry point.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Network Policy Server (NPS): Use-after-free allows remote code execution

Microsoft's Network Policy Server (NPS) contains a use-after-free vulnerability (CWE-416). An unauthenticated attacker on the network can exploit it to execute code on the affected system. Attack complexity is high, and the CVSS 3.1 base score is 8.1.

Microsoft · Network Policy Server (NPS)

Windows Hyper-V: Elevation of privilege via out-of-bounds read

Microsoft Windows Hyper-V contains an out-of-bounds read vulnerability (CWE-125) that allows an authorized local attacker to elevate privileges. The attacker needs an existing foothold and valid access on the affected machine, so the risk is local and not directly internet-facing. Hyper-V is only relevant on systems where the Hyper-V role or feature is enabled.

Microsoft · Windows Hyper-V

Windows 10 1607: Heap-based buffer overflow in TCP/IP enables privilege escalation

A heap-based buffer overflow in the Windows TCP/IP stack allows an authorized local user to elevate privileges to SYSTEM. Exploitation requires local access with a low-privileged account, so the flaw is not directly reachable from the internet. Microsoft rates it as High (CVSS 3.1 7.8), and no exploitation or public proof-of-concept code is known.

Microsoft · Windows 10 1607

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Installer: Elevation of privilege via heap-based buffer overflow

A heap-based buffer overflow in Windows Installer allows an authorized local attacker to elevate privileges to a higher level, with high impact on confidentiality, integrity and availability. The attacker needs local access and low privileges, and no user interaction is required. The flaw is not remotely exploitable, but it matters once an attacker already has a foothold on a device, for example through phishing or stolen credentials.

Microsoft · Windows Installer

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft .NET: Elevation of privilege via integer overflow

An integer overflow (CWE-190) in the Microsoft .NET runtime and .NET Framework allows an attacker to elevate privileges. Microsoft describes the trigger as attacker-controlled XPS glyph coordinates that cause an out-of-bounds write in WPF rendering, so user interaction is required, for example by opening or displaying a crafted document in a WPF application. The official CVE record and the advisory sources conflict on the attack vector and impact, so the network-vector wording is unconfirmed until NVD analysis is complete.

Microsoft · .NET Framework

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Performance Monitor: Code injection allows local privilege escalation

Windows Performance Monitor contains a code injection flaw (CWE-94) that allows an authorized local user to elevate privileges. The attack requires a valid local low-privilege account and no user interaction, and the CVSS score is 7.8 (High) with a high impact on confidentiality, integrity and availability. The affected versions include supported Windows 10, Windows 11, Windows Server 2012, 2012 R2 and 2016 builds, and Microsoft has published a security update.

Microsoft · Windows Performance Monitor

Windows Installer: Heap-based buffer overflow allows local privilege escalation

Microsoft Windows Installer, the component that installs, maintains and removes MSI packages, contains a heap-based buffer overflow (CWE-122). A local user with low privileges can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. It is not a remote entry point and requires local access, for example after phishing has already provided code execution.

Microsoft · Windows Installer

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Microsoft Windows: Out-of-bounds read in Windows Volume Manager Extension Driver

A local out-of-bounds read in the Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges on the affected system. The attacker needs a valid low-privilege user account on the machine, so the flaw is not reachable remotely. Microsoft rates it as High (CVSS 3.1 7.8), and CISA's SSVC data records no known exploitation.

Microsoft · Windows