New vulnerabilities – clearly explained

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows RRAS: Information disclosure through uninitialized resource

Windows Routing and Remote Access Service (RRAS) uses an uninitialized resource (CWE-908). A remote, unauthenticated attacker can send network traffic to an affected system and read information from it, with a high confidentiality impact. Integrity and availability are not affected. Exposure depends on whether RRAS runs on a reachable host, mainly Windows Servers with VPN or routing roles.

Microsoft · Windows RRAS

Windows Server AD FS: Denial of service via missing resource limits

Active Directory Federation Services (AD FS) in Windows Server allocates resources without limits or throttling (CWE-770). An unauthenticated remote attacker can exhaust these resources and cause a denial of service, which can block sign-ins to Microsoft 365 and other federated applications. Exposure is highest where AD FS is published to the internet, for example through a web application proxy.

Microsoft · Windows Server AD FS

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft AD FS: Denial of service through unrestricted resource allocation

Active Directory Federation Services (AD FS) in several Windows 10 and Windows Server versions does not limit resource allocation. An unauthenticated attacker on the network can exhaust resources and cause a denial of service. If AD FS is reachable from the internet, for example through a Web Application Proxy, the attack can be launched from outside. Only availability is affected, but a failed AD FS breaks federated sign-ins.

Microsoft · Active Directory Federation Services (AD FS)

Windows 10 1607: Heap-based buffer overflow in Servicing Stack Updates

A heap-based buffer overflow in the Servicing Stack Updates component of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local attacker to elevate privileges. The attacker needs local access and low-privileged credentials, and no user interaction is required. Microsoft rates the impact as high for confidentiality, integrity and availability (CVSS 3.1 7.8).

Microsoft · Windows 10 1607

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows RRAS: Null pointer dereference causing denial of service

A null pointer dereference in the Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to crash the service over the network, causing a denial of service. No login is required, so the risk depends on whether RRAS is enabled and reachable from untrusted networks. The impact is limited to availability; no loss of confidentiality or integrity is stated.

Microsoft · Windows Routing and Remote Access Service (RRAS)

Microsoft Windows 10 1607: Elevation of privilege in EAPHost Service

A out-of-bounds write (CWE-787) in the Windows EAPHost Service allows an authorized local user to elevate privileges. The CVSS vector requires local access and a low-privilege account, with no user interaction. The flaw is not remotely exploitable, but a compromised user account or a malicious insider could gain SYSTEM rights after an initial foothold.

Microsoft · Windows 10 1607

Microsoft Windows: Remote Code Execution in PPP EAP-TLS

A heap-based buffer overflow in the Remote Access Point-to-Point Protocol (PPP) EAP-TLS component of several Windows client and server versions allows an unauthorized attacker to execute code over the network. No privileges or user interaction are required according to the CVSS vector (AV:N/AC:L/PR:N/UI:N), so internet-exposed RRAS or VPN servers using this authentication path are the main risk. Microsoft rates the flaw as Important; the CVSS 3.1 base score is 9.8 (Critical), while Positive Technologies rates it 6.6 (Medium).

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Telephony Server: Use after free leads to local privilege escalation

The Windows Telephony Server component of several Windows 10, Windows 11 and Windows Server versions contains a use-after-free flaw (CWE-416). An attacker who already has a low-privilege account or code running on the affected host can exploit it to gain higher privileges, potentially full control of the system. Remote exploitation is not possible, and no user interaction is required.

Microsoft · Windows Telephony Server

Microsoft Windows: Remote code execution in Remote Desktop Services

A double free vulnerability (CWE-415) in the Remote Desktop Gateway Service of Windows allows an unauthenticated remote attacker to execute code over the network. NVD rates it CVSS 3.1 8.1 (high), with high attack complexity and no privileges or user interaction required. Other sources rate it differently (VulDB 10.0). The risk is highest for internet-facing RD Gateway servers.

Microsoft · Windows Remote Desktop Services

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft .NET: Denial of service in CMS/PKCS#7 signature verification

A flaw in SignedCms.CheckSignature in the .NET System.Security.Cryptography.Pkcs component lets an unauthenticated remote attacker send crafted X.509 data that is repeatedly re-parsed, causing quadratic CPU exhaustion and denial of service. The issue only affects applications that decode and verify CMS/PKCS#7 signed messages from untrusted sources. The NVD score is 7.5 (CVSS 3.1), but real exposure is narrower than the score suggests.

Microsoft · .NET (System.Security.Cryptography.Pkcs)

Microsoft Windows Server 2012

Research and translation in progress – available shortly.

Microsoft Windows: Heap-based buffer overflow in Microsoft XML

A heap-based buffer overflow in Microsoft XML, the XML parsing component used by Windows and applications that call it, allows remote code execution. An unauthenticated attacker with network access can trigger it with crafted XML, without user interaction. NVD rates it CVSS 9.8 (Critical). CISA SSVC data reports exploitation as none and automatable as yes, and no public exploit is listed.

Microsoft · Windows

Windows GDI+: Stack-based buffer overflow allows remote code execution

Windows GDI+, the graphics component of Windows, contains a stack-based buffer overflow (CWE-121). An unauthenticated remote attacker can execute code, but the attack requires a user to take an action, such as opening a crafted file, image or web content. Several Windows 10, Windows 11 and Windows Server versions are affected, including Windows 10 Version 1607 and Windows Server 2016. NVD rates the vulnerability with CVSS 3.1 8.8 (High).

Microsoft · Windows GDI+

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Windows 10 1607: Group Policy heap overflow allows local privilege escalation

A heap-based buffer overflow in the Windows Group Policy component affects Windows 10 Version 1607 and Windows Server 2016. A local user with low privileges can exploit it to gain higher privileges on the affected system. An attacker needs an existing local logon and cannot exploit the flaw remotely, so it is a privilege-escalation step rather than an entry point.

Microsoft · Windows 10 Version 1607

Microsoft Windows Hyper-V: Heap-based buffer overflow allows local code execution

A heap-based buffer overflow in the Windows Hyper-V virtualization component affects Windows 11 and Windows Server systems. An authorized attacker with low privileges and local access, such as a foothold on a guest VM, can execute code, which may lead to a guest-to-host escape. The attack complexity is high. The official CVE record and CISA SSVC data show no known exploitation.

Microsoft · Windows Hyper-V

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.