A race condition (CWE-362, CWE-416) in the Windows Overlay Filter component allows an authorized local user to elevate privileges. The attacker needs local access and low privileges, and the attack is rated as high complexity. Successful exploitation could lead to full compromise of confidentiality, integrity and availability on the affected system. The flaw is not remotely exploitable and no exploitation has been reported.
Microsoft · Windows 10 Version 1607
A integer overflow or wraparound in the HID Parser Library of Microsoft Windows allows a locally authorized attacker to elevate privileges. The attacker needs local access and a low-privilege account, so this flaw is a privilege escalation step rather than an initial access vector. CVSS 7.8 (High) and CISA SSVC rates technical impact as total.
Microsoft · Windows
A use-after-free flaw (CWE-416) in the Windows Shell component allows a local attacker with a valid low-privilege account to elevate privileges. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability. Exploitation requires a foothold on the system, such as a phished user or a compromised session, and is not possible remotely.
Microsoft · Windows Shell
Research and translation in progress – available shortly.
A heap-based buffer overflow in the Windows Event Tracing component allows a remote attacker to execute code on affected Windows 10, Windows 11 and Windows Server systems. Successful exploitation requires a user to take some action, such as opening crafted content, and no privileges. The CVSS base score is 8.8, and Microsoft rates exploitation as unlikely at publication.
Microsoft · Windows Event Tracing
A relative path traversal flaw (CWE-23) in Windows Shell allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account and local access, so this is typically a follow-up step after phishing or credential theft. Confidentiality, integrity and availability impact is rated high (CVSS 7.8); the CNA record covers multiple Windows 10, Windows 11 and Windows Server builds, including Windows 10 1607.
Microsoft · Windows Shell
A flaw in the Windows TCP/IP stack, caused by an incorrect conversion between numeric types (CWE-681), allows an attacker with local access and a low-privilege account to elevate their privileges. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. The attack is not directly reachable from the internet, but it is relevant wherever untrusted or low-privileged users can log on locally, such as kiosks and fixed-function devices.
Microsoft · Windows 10 1607
A heap-based buffer overflow in Microsoft OpenSSH for Windows allows an authorized local attacker to elevate privileges. Exploitation requires a local account with low privileges and a high-complexity condition (CVSS 7.0 per NVD). According to the available data, remote exploitation is not possible.
Microsoft · OpenSSH for Windows
Research and translation in progress – available shortly.
Microsoft Windows DNS Server contains an integer underflow (CWE-191) that allows an unauthenticated attacker to execute code remotely over the network. No user interaction is required, and Microsoft rates the CVSS 3.1 base score at 9.8 (Critical), although Microsoft's own severity is Important. Systems with the DNS Server role that are reachable from untrusted networks carry the highest risk.
Microsoft · Windows DNS Server
A race condition (CWE-362) in the Microsoft Bluetooth Driver allows an authorized local user to elevate privileges. The attacker needs a valid local logon and must win a timing condition, so the attack complexity is high. Remote exploitation is not possible from the network.
Microsoft · Windows Bluetooth Driver
A heap-based buffer overflow in the Windows Push Notifications component allows an authorized local user to elevate privileges. Successful exploitation can give the attacker full control of the affected system, including confidentiality, integrity and availability. The attacker needs a local low-privilege account and local access, so the flaw is mainly a second-stage risk after an initial compromise.
Microsoft · Windows
A use-after-free vulnerability (CWE-416) in the Win32k kernel driver of Windows 10 version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker who can already run code with low privileges on the system can gain SYSTEM rights. Exploitation requires local access, so the risk is highest on multi-user systems and terminal servers.
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A heap-based buffer overflow (CWE-122) in Windows Servicing Stack Updates allows an authorized local attacker to elevate privileges. The CNA record lists Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2 to 26H2, and Windows Server 2012, 2012 R2 and 2016 as affected. An attacker needs local access with low privileges, for example a standard user account or malware already running on the system, and no user interaction is required. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected host.
Microsoft · Windows
Use-after-free vulnerability in the Windows Network Load Balancing (NLB) component. According to the CVE record, an unauthenticated attacker on an adjacent network can execute code without user interaction. Affected are Windows 10 Version 1607 and 1809 as well as several Windows Server releases with NLB. Some third-party sources list a network vector with CVSS 9.8, so the exposure should be verified.
Microsoft · Windows Network Load Balancing
A heap-based buffer overflow in the Windows Remote Desktop Protocol (RDP) component allows an authorized attacker with low privileges to elevate privileges to a higher level on the local system. Exploitation requires local access and a valid low-privileged account, and there is no user interaction. The vulnerability is not remotely exploitable, but an attacker who already has a foothold on a device (for example through a phished account or exposed RDP login) could gain full control of it.
Microsoft · Windows
Windows GDI, the Graphics Device Interface that Windows uses for 2D rendering, contains a stack-based buffer overflow (CWE-121). The flaw affects several supported Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607, Windows Server 2016 and Windows Server 2012 R2. An unauthenticated attacker on the network can crash or hang affected systems without user interaction. According to the CNA score, the impact is limited to availability; confidentiality and integrity are not affected.
Microsoft · Windows GDI
A use-after-free flaw (CWE-416) in the Windows NTFS file system driver allows an attacker with local access and a low-privilege account to elevate privileges. Successful exploitation can lead to full control of the system, with high impact on confidentiality, integrity and availability. The attack is not reachable over the network and requires a valid local account, so the main risk lies on shared servers, terminal servers and multi-user PCs.
Microsoft · Windows
A flaw in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker with local access and a low-privilege account to elevate privileges, with high impact on confidentiality, integrity and availability (CVSS 7.8). UDF is used for optical discs and many removable media, so the driver is typically reached when such media are mounted. The memory-corruption class is inconsistently reported across sources (use after free in the description, CWE-121 in the record) and remains to be confirmed against the MSRC advisory.
Microsoft · Windows Universal Disk Format File System Driver (UDFS)
An out-of-bounds read in the Windows Event Logging Service allows an unauthorized attacker to execute code over a network, according to the CVE record. Several Windows 11 branches and Windows Server 2022 and 2025 are affected. The NVD vector rates attack complexity as high and requires no privileges, but the sources disagree on whether user interaction is needed. No public proof of concept or known exploitation was found in the sources reviewed.
Microsoft · Windows
An integer underflow in the Windows WLAN Service of Windows 11 and Windows Server 2025 allows an unauthenticated attacker to cause a denial of service over the network. The record states only an availability impact, with no confidentiality or integrity impact. The record does not say whether the attack must come from the same Wi-Fi radio segment, so reachability on wired-only hosts is unknown.
Microsoft · Windows
Research and translation in progress – available shortly.
A use-after-free flaw in Windows Hello allows an authorized attacker to elevate privileges locally. An attacker with a low-privilege account on the affected device could gain higher privileges, potentially up to full control of the system. The attack requires local access and a high-complexity condition, and the vulnerability is not reachable from the internet.
Microsoft · Windows
