Windows Error Reporting, the built-in Windows crash-reporting component, contains an untrusted pointer dereference that allows a local attacker to elevate privileges. The attacker needs a valid logon with low privileges on the affected system and must run code locally. A successful attack could grant higher privileges, which is especially relevant on shared or multi-user systems such as terminal servers.
Microsoft · Windows Error Reporting
Research and translation in progress – available shortly.
The Windows Partition Management Driver, a kernel component for disk partition management, contains an out-of-bounds read (CWE-125). According to the CVE record, an unauthorized attacker can execute code over a network. Exploitation requires user interaction (CVSS 8.8, NVD). Microsoft's CNA record lists affected Windows 10, Windows 11 and Windows Server builds.
Microsoft · Windows Partition Management Driver
A use-after-free flaw in the Windows kernel allows an authorized local user to elevate privileges to the highest level on the system. An attacker needs an existing low-privileged foothold, such as a phished user account or malware on a workstation. There is no network attack vector, and CISA lists no known exploitation at the time of research.
Microsoft · Windows 11
A heap-based buffer overflow in the Windows Internet Key Exchange (IKE) Extension allows an unauthenticated attacker on the network to crash the IKE service. This causes a denial of service for IPsec and VPN connections on affected hosts. Exposure is highest for Windows hosts that run IPsec, IKEv2 or L2TP VPN roles and accept traffic from the internet. The CNA rates the issue 7.5 (High) with availability impact only.
Microsoft · Windows
Research and translation in progress – available shortly.
The Windows Update Orchestrator Service, which coordinates Windows Update scan and install tasks, contains a link-following flaw (CWE-59). An authorized local attacker can exploit it to gain SYSTEM privileges. Exploitation requires an existing local foothold and high attack complexity, and there is no user interaction.
Microsoft · Windows Update Orchestrator Service
Incorrect authorization in the Windows Device Install Service allows a local user with low privileges to elevate their privileges on the affected system. An attacker needs an existing local account or foothold, for example from phishing or a compromised user account. The risk is highest on shared workstations, terminal servers and multi-user systems.
Microsoft · Windows Device Install Service
Improper authorization in the Windows Virtual Input component allows a local, authorized attacker to elevate privileges. The NVD CPE lists only Windows 10 1809, but the CNA record covers several further Windows 10, Windows 11 and Windows Server builds. The attacker needs a local foothold and low privileges, for example via a malicious or compromised user account, and the CVSS impact on confidentiality, integrity and availability is high.
Microsoft · Windows
A use-after-free vulnerability in the Windows Hello authentication component allows an attacker with local, low-privileged access to elevate privileges. The attack requires a local foothold, such as a compromised user session or malware running as a standard user, and its complexity is high. The flaw is not directly reachable from the internet, but it matters most on shared or poorly segmented workstations.
Microsoft · Windows Hello
A heap-based buffer overflow (CWE-122) in the Windows SMB Client affects several Windows 10, Windows 11 and Windows Server versions, including Windows 10 version 1607 and Windows Server 2016. A network attacker may be able to elevate privileges. The sources state that the attack generally requires the victim to connect to an attacker-controlled SMB server. The CVSS score conflicts between sources: the CVE data gives 9.8 with no user interaction, while third-party aggregators give 8.8 with user interaction required, so verify the score on NVD.
Microsoft · Windows SMB Client
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows COM+ Event System Service allows an authorized, low-privileged local user to elevate privileges. The attack is not remotely exploitable and requires a local foothold, such as a phished user account or other malware. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability of the system.
Microsoft · Windows
Microsoft Windows Encrypting File System (EFS) contains an absolute path traversal flaw (CWE-36) that allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privileged account, but no user interaction is required. The CVSS 3.1 base score is 8.8 (High), with total impact on confidentiality, integrity and availability.
Microsoft · Windows
A heap-based buffer overflow in Windows Management Instrumentation (WMI), a Windows component, allows a local attacker with low privileges to elevate their privileges. The CVSS 3.1 score is 7.8 (High) with high impact on confidentiality, integrity and availability. An attacker needs a foothold on the system first, for example through a phished user or a compromised low-privilege account, so the flaw is not remotely exploitable on its own.
Microsoft · Windows Management Instrumentation
A heap-based buffer overflow in the Windows Shell component allows an unauthenticated attacker to execute code remotely over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates that no privileges or user interaction are required and that the impact on confidentiality, integrity and availability is high. The sources do not describe the exact entry point, so it is unknown whether internet-facing services are needed.
Microsoft · Windows Shell
A flaw caused by improper null termination in the Windows Program Compatibility Assistant Service allows an authorized local user to elevate privileges. The attacker needs a low-privilege account on the affected system and local access, so the flaw is not remotely exploitable. A successful attack could give the attacker high confidentiality, integrity and availability impact on the system.
Microsoft · Windows
A use-after-free flaw (CWE-416) in the Windows CCFFilter Driver may allow an attacker to execute code. The CNA scores it CVSS 9.8 as unauthenticated and network-reachable, which would make it critical. ZDI's October 2026 review instead describes it as requiring an authorized local attacker, so the actual exposure is disputed and must be verified against the MSRC advisory. The function of this driver and its default reachability are unknown.
Microsoft · Windows
A heap-based buffer overflow in Windows Installer (CWE-122) allows a locally authenticated user with low privileges to escalate their privileges on the system. Successful exploitation can lead to a total loss of confidentiality, integrity and availability on the affected host. An attacker needs an existing local foothold, for example through a compromised standard user account, and no user interaction is required.
Microsoft · Windows Installer
A heap-based buffer overflow in the Microsoft Internet Messaging API, a Windows component, allows an unauthorized attacker to execute code over a network. The CVSS vector requires user interaction (UI:R), which lowers practical risk. CISA rates exploitation as none, and no public proof of concept was found. Exposure depends on whether the component is reachable from outside the network.
Microsoft · Internet Messaging API
A heap-based buffer overflow in the Windows Bluetooth Service allows an unauthenticated attacker to elevate privileges. The attack vector is adjacent, so the attacker must be within Bluetooth range of the affected device; no user interaction is required. The CVSS 3.1 score is 8.8 (High), with high impact on confidentiality, integrity and availability.
Microsoft · Windows Bluetooth Service
A race condition (improper synchronization of a shared resource) in Windows Installer allows a local user to elevate privileges on Windows 10 version 1607. The attacker needs a valid local account and must win a timing condition, so attack complexity is high. Successful exploitation would give the attacker full control (high confidentiality, integrity and availability impact) on the affected host; the CVSS base score is 7.0 (High).
Microsoft · Windows 10 1607
Research and translation in progress – available shortly.
