New vulnerabilities – clearly explained

Microsoft Windows GDI: Remote Code Execution through out-of-bounds write

A out-of-bounds write in the Windows Graphics Device Interface (GDI) allows an unauthorized attacker to execute code remotely. The flaw affects several supported and older Windows 10, Windows 11 and Windows Server versions. Exploitation requires a victim to take an action, such as opening a crafted file or web content, which limits the practical risk.

Microsoft · Windows

Microsoft Windows LSASS: Remote code execution vulnerability

A out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows an attacker to execute code remotely on affected Windows systems. Many Windows 10, Windows 11 and Windows Server versions are affected, including Windows 10 1607 and Windows Server 2016. According to the CVSS vector, the attacker needs a valid low-privileged account and no user interaction, while the NVD description speaks of an unauthorized attacker, so the actual preconditions still need to be confirmed by Microsoft.

Microsoft · Windows LSASS

Microsoft Windows 10: Local privilege escalation via registry link following

Windows 10 Version 21H2 contains a flaw in the Windows Registry where links are resolved improperly before a file is accessed (CWE-59, link following). An authorized local user can exploit it to gain elevated privileges. The attacker needs a local account or code execution on the system first, and no remote attack vector is described.

Microsoft · Windows 10

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft OpenSSH for Windows: Remote code execution via relative path traversal

A relative path traversal flaw (CWE-23) in Microsoft OpenSSH for Windows allows code execution over the network. Per the CVSS vector, the attack is low complexity and needs no privileges, but it requires user interaction. The practical scenario described is a user running a recursive scp or sftp download from a malicious or compromised server, which can write files outside the chosen download folder.

Microsoft · OpenSSH for Windows

Windows: Use-after-free in Direct Composition allows local privilege escalation

A use-after-free weakness (CWE-416) in the Windows Direct Composition component allows an authorized local user with low privileges to elevate their privileges. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected system. An attacker needs an existing account or foothold on the machine, so the flaw is not remotely exploitable. Microsoft has released fixes and reports no known exploitation.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Search Service: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Microsoft Windows Search Service allows a local, low-privileged user to elevate privileges. The flaw is not reachable from the internet. An attacker needs an existing foothold on the system, for example through a phished or compromised standard user account, a shared workstation or a terminal server.

Microsoft · Windows Search Service

Microsoft Internet Messaging API: Heap-based buffer overflow

A heap-based buffer overflow (CWE-122) in the Microsoft Internet Messaging API allows code execution. An input buffer is copied to an output buffer without checking that the input fits, which can corrupt memory. The attacker needs local access and low privileges, and no user interaction is required. Microsoft's title says Remote Code Execution, but the NVD vector (AV:L) describes a local attack; the wording should be clarified with Microsoft.

Microsoft · Internet Messaging API

Windows 10 Version 1607: Elevation of privilege in Windows Kernel

Microsoft has fixed an integer overflow (CWE-190) in the Windows kernel of Windows 10 Version 1607 and Windows Server 2016. An authorized local user with a low-privilege account can elevate privileges, for example to SYSTEM. Remote exploitation is not possible; the attacker first needs a local foothold, such as phishing, stolen credentials or a malicious file. The CVSS v3.1 base score is 7.8 (High).

Microsoft · Windows 10 Version 1607

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Microsoft Windows: Remote code execution via use-after-free in Microsoft XML

A use-after-free vulnerability in the Microsoft XML component of Windows allows an unauthorized attacker to execute code over a network. The CVSS base score is 8.1 (High), but attack complexity is rated high. Exposure depends on whether systems parse untrusted XML from the network, for example through web services, mail or document handling.

Microsoft · Windows

Microsoft Windows Kernel: Use-after-free allows local privilege escalation

A use-after-free flaw (CWE-416) in the Windows kernel allows an authorized local user to elevate privileges to SYSTEM. An attacker needs a local foothold, such as malware or a phished user session, plus low privileges. Successful exploitation gives full control over the affected host, but the flaw cannot be used for a direct remote attack.

Microsoft · Windows Kernel

Windows Direct Composition: Elevation of privilege via use-after-free

A use-after-free vulnerability (CWE-416) in the Windows Direct Composition component allows an authorized local user to elevate privileges. An attacker needs a valid low-privileged account or code already running on the host. The vulnerability is not reachable from the internet, but it is a practical second step after phishing, malware or stolen credentials. NVD rates it CVSS 3.1 7.8 (High).

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows: Remote code execution in RPC Runtime Library

The Windows RPC Runtime Library contains an out-of-bounds write (CWE-787) that allows remote code execution. Per the CVE record, an unauthenticated attacker with network access can run code without user interaction. CVSS 3.1 is 9.8 (Critical).

Microsoft · Windows RPC Runtime Library

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.