New vulnerabilities – clearly explained

Windows 11: Use-after-free in Bind Filter Driver allows local privilege escalation

A use-after-free flaw (CWE-416) in the Windows Bind Filter Driver allows an authorized local attacker to elevate privileges. An attacker needs a foothold on the affected machine and an account with low privileges, such as a standard user account. Successful exploitation can give full control of the system (CVSS 3.1: 7.0, high complexity).

Microsoft · Windows 11

Windows Partition Management Driver: Heap-based buffer overflow

A heap-based buffer overflow in the Windows Partition Management Driver allows an attacker to elevate privileges. NVD scores it CVSS 3.1 8.8 with the vector AV:N/AC:L/PR:N/UI:R, so user interaction is required. The attack path has not been verified, and no exploitation in the wild is known.

Microsoft · Windows

Microsoft Windows Search: Heap-based buffer overflow allows local privilege escalation

The Windows Search Component of several Windows 10, Windows 11 and Windows Server releases contains a heap-based buffer overflow. An authorized local user with low privileges can exploit it to elevate privileges, with high impact on confidentiality, integrity and availability. Local access is required, so the risk mainly arises after a phishing or malware compromise. Public exploit code is not known from the sources reviewed.

Microsoft · Windows

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Windows: Elevation of privilege in COM+ Event System Service

The Windows COM+ Event System Service contains an untrusted pointer dereference that allows a local, authorized attacker to elevate privileges. Affected are Windows 10 (1607 to 22H2), Windows 11 (23H2 to 26H2), Windows Server 2012, 2012 R2 and 2016. An attacker needs a foothold on the system first, for example through a compromised standard user account, and can then gain SYSTEM rights. The attack is not directly reachable from the internet.

Microsoft · Windows

Windows 10 Version 1607: Privilege escalation via heap-based buffer overflow

Windows 10 Version 1607 (and Windows Server 2016, which shares build 14393) contains a heap-based buffer overflow in the Microsoft Account component. An authorized local user with low privileges can exploit it to elevate privileges. Network exploitation is not expected according to the CVSS vector (AV:L), and the function of the affected component is not documented in the sources. Version 1607 is end of support, so the October 2026 update is the last security fix for these systems.

Microsoft · Windows 10 Version 1607

Windows Cdpsvc: Use-after-free leads to local privilege escalation

Microsoft Windows contains a use-after-free vulnerability (CWE-416) in the Connected Devices Platform Service (Cdpsvc). A local attacker with low privileges can exploit it to elevate privileges on the affected system. Exploitation is rated high complexity, requires an existing foothold on the system, and is not remotely exploitable.

Microsoft · Windows

Microsoft Windows: Spoofing vulnerability in Windows Internet (wininet.dll)

A spoofing vulnerability in the Windows Internet library (wininet.dll) affects several supported Windows 10, Windows 11 and Windows Server versions. An authenticated local user with low privileges can exploit it without user interaction, which changes the security scope and can lead to high impact on confidentiality and integrity. The vulnerability is not remotely exploitable on its own, and the CVSS base score from NVD is 8.4. Risk is highest on shared workstations, terminal servers and multi-user systems.

Microsoft · Windows

Microsoft Paint: Out-of-bounds read enables remote code execution

Windows Paint contains an out-of-bounds read (CWE-125) that allows an unauthenticated attacker to execute code remotely. The attack requires the victim to open crafted content, such as an image file, in Paint. A successful attack can run code with the rights of the logged-in user and may lead to full host compromise.

Microsoft · Paint

Windows Internet Key Exchange (IKE): Out-of-bounds read causes denial of service

An out-of-bounds read in the Windows Internet Key Exchange (IKE) component allows an unauthenticated remote attacker to crash or hang the IKE service over the network. The impact is limited to availability; no code execution or data theft is reported. Hosts with IPsec or VPN roles reachable on UDP 500 and 4500 are the relevant exposure.

Microsoft · Windows

Windows TCP/IP: Privilege escalation via double free

A double free (CWE-415) in the Windows TCP/IP stack allows an attacker with a valid local, low-privileged account to elevate privileges locally. Successful exploitation requires local code execution or an authenticated local user, so the bug is a follow-on risk rather than an internet-facing entry point. Microsoft has released a fix, no public exploit is known, and CISA data shows no exploitation. Windows 10 1607 and Server 2016 are the most urgent because Windows 10 LTSB 2016 reached end of updates on the day the CVE was published.

Microsoft · Windows TCP/IP

Microsoft Windows Win32k: Local privilege escalation via race condition

A race condition (CWE-362) in the Win32k graphics subsystem of Windows allows a local attacker with low privileges to gain higher privileges, potentially up to SYSTEM. The attacker must already be able to run code on the affected machine, for example through phishing, malware or stolen credentials. The CVSS 3.1 base score is 7.0 (HIGH), and CISA SSVC lists no known exploitation and no automation.

Microsoft · Windows

Windows Error Reporting: Local privilege escalation due to weak authentication

Weak authentication in the Windows Error Reporting component allows an authorized local user with low privileges to elevate their privileges on the affected host. The CVSS v3.1 base score is 7.8 (High), with a full impact on confidentiality, integrity and availability of that host. An attacker needs an existing local foothold, for example a phished user account or malware running as a standard user, and the flaw is not directly reachable from the internet.

Microsoft · Windows

Microsoft Windows Hyper-V: Elevation of privilege via TOCTOU race condition

A time-of-check time-of-use race condition (CWE-367) in the Windows Hyper-V hypervisor allows an authorized local attacker to elevate privileges. A successful attack could compromise confidentiality, integrity and availability of the affected host. Exploitation requires local access with low privileges and a race that is hard to win reliably.

Microsoft · Windows Hyper-V

Windows 10 1607: Integer underflow in Bluetooth A2DP driver allows privilege escalation

Microsoft has published CVE-2026-83838, an integer underflow (CWE-191) in the Windows Bluetooth A2DP driver, which handles Bluetooth audio streaming. An attacker with low-privilege access on an adjacent network, in practice within Bluetooth range, can use it to gain elevated privileges. The CVSS base score is 8.0 (High). CISA SSVC lists no known exploitation and the CVE is not in the CISA KEV catalogue.

Microsoft · Windows 10 1607

Microsoft Windows: Elevation of privilege in Kernel-Mode Drivers

A flaw in the Windows Kernel-Mode Drivers allows an authorized local user to elevate privileges on the affected system. Successful exploitation can give an attacker full control of the host, because kernel-mode drivers run in the core of the operating system. Access to a local account with low privileges is required, and the vulnerability cannot be exploited over the network.

Microsoft · Windows

Windows Event Tracing: Heap-based buffer overflow allows local code execution

A heap-based buffer overflow in Windows Event Tracing affects multiple supported and legacy Windows 10, Windows 11 and Windows Server versions. An attacker with local access, such as a logged-on user or code already running on the host, can execute code with the rights of the affected process and may gain full control of the system. The CVSS vector is local (AV:L) and requires user interaction (UI:R); the official title says "Remote Code Execution", but this is not a network-exploitable flaw.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows 10 1607: Use after free in Windows Kernel-Mode Drivers

A use-after-free vulnerability (CWE-416, with a related race condition, CWE-367) in the Windows Kernel-Mode Drivers component of Windows 10 version 1607 allows a local attacker to elevate privileges to SYSTEM. The attacker needs a low-privileged account on the affected system, and the attack complexity is high. The flaw is not reachable from the internet. Windows 10 1607 has reached end of support, so the October 2026 fix may be the last security update for this branch.

Microsoft · Windows 10 1607

Windows Kernel: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Windows Kernel of Windows 10 Version 1607 and Windows Server 2016 allows a local attacker to elevate privileges. The attacker needs a valid low-privilege account on the host and must run code locally, but no user interaction is required. The flaw is not remotely exploitable by itself and is most relevant after an initial foothold, for example through phishing or a compromised account.

Microsoft · Windows 10 1607

Microsoft Windows: Local privilege escalation via out-of-bounds read in Spaceport.sys

An out-of-bounds read (CWE-125) in the Windows driver Spaceport.sys allows a local attacker with low privileges to elevate privileges on the affected host. The attacker must already have a user session on the system, for example through phishing, malware or a stolen account. Successful exploitation gives the attacker full control of the local machine (high confidentiality, integrity and availability impact).

Microsoft · Windows

Windows COM+ Event System Service: Heap-based buffer overflow

A heap-based buffer overflow in the Windows COM+ Event System Service allows an authorized local user with low privileges to elevate privileges on the affected system. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of that system. The attacker needs an existing foothold on the machine, and no user interaction is required. Microsoft reports no public disclosure and no exploitation at the time of release.

Microsoft · Windows COM+ Event System Service

Microsoft Windows Search: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow in the Microsoft Windows Search Component allows an authorized local attacker to elevate privileges. The CNA record lists several Windows 10, Windows 11 and Windows Server versions as affected, including Windows 10 Version 1607 and Windows Server 2016. An attacker needs a local account with low privileges and could gain SYSTEM rights, with high impact on confidentiality, integrity and availability. CISA SSVC data lists exploitation as none and the vulnerability as not automatable.

Microsoft · Windows Search Component

Windows 11: Heap-based buffer overflow in Windows MIDI Service Module

A heap-based buffer overflow in the Windows MIDI Service Module of Windows 11 allows an authorized local user to elevate privileges. The attacker needs an existing logon on the affected machine and no user interaction is required. Successful exploitation gives the attacker full control over confidentiality, integrity and availability of the system.

Microsoft · Windows 11

Windows 10 1607: Heap-based buffer overflow in Bluetooth Port Driver

A heap-based buffer overflow in the Windows Bluetooth Port Driver of Windows 10 Version 1607 (LTSB 2016) allows a local attacker with low privileges to elevate their privileges to a higher level. Successful exploitation can lead to a full compromise of confidentiality, integrity and availability on the affected device. An attacker first needs a local, authenticated foothold, so the risk is mainly a second-stage threat.

Microsoft · Windows 10 Version 1607