New vulnerabilities – clearly explained

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows NTFS: Out-of-bounds write allows local code execution

An out-of-bounds write in the Windows NTFS file system driver allows a local attacker with low privileges to execute code. Exploitation requires local access and a valid low-privileged account; the flaw is not directly reachable over the network. The CVSS 3.1 score is 7.8 (High), with high impact on confidentiality, integrity and availability.

Microsoft · Windows NTFS

Microsoft Windows: Privilege escalation in Device Association Service

A use-after-free flaw in the Windows Device Association Service allows a local, authenticated attacker to elevate privileges. Microsoft states that exploitation requires winning a race condition. The vulnerability does not provide remote access on its own, but an attacker or malware with a foothold on a system could gain SYSTEM-level control.

Microsoft · Windows

Microsoft Windows NTLM: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Windows NTLM authentication component allows privilege escalation. The CVE record lists Windows 10 Version 1607 and Windows Server 2016 among the affected products. An attacker with a valid local user account and low privileges can exploit it to gain higher privileges on the system. It is not remotely exploitable, so it is mainly a risk on shared or multi-user systems after an initial compromise.

Microsoft · Windows 10 1607

Windows Installer: Local privilege escalation through stack-based buffer overflow

A stack-based buffer overflow in the Windows Installer service allows a local user with low privileges to elevate their privileges. The attacker needs a local foothold first, for example a compromised standard user account or malware, and no user interaction is required. The CVSS 3.1 score is 7.0 (High).

Microsoft · Windows Installer

Windows Event Tracing: Use after free leads to local privilege escalation

A use-after-free vulnerability (CWE-416) in Windows Event Tracing (ETW) allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.0 (HIGH), with high attack complexity, low privileges required and no user interaction. Exploitation requires a local, low-privileged account, so the flaw is not directly internet-facing, but it is relevant where attackers already have a foothold.

Microsoft · Windows Event Tracing

Microsoft Windows 11 24h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Search Component: Link following leads to local privilege escalation

A link-following weakness (CWE-59) in the Microsoft Windows Search Component allows a locally authorized attacker to elevate privileges. The attacker needs a valid low-privilege account on the affected machine and must run code locally; the flaw is not remotely exploitable. CVSS 3.1 base score is 7.8 (High). No exploitation is known.

Microsoft · Windows Search Component

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Installer: Privilege escalation via use-after-free

A use-after-free flaw (CWE-416) in the Windows Installer component allows an authorized local user to elevate privileges. Successful exploitation requires a local logon and high attack complexity, and it can lead to SYSTEM-level control of the affected Windows host. The vulnerability is not reachable from the internet.

Microsoft · Windows Installer

Windows: Use-after-free in Now Playing Session Manager (privilege escalation)

A use-after-free vulnerability in the Windows Now Playing Session Manager component allows an authorized local attacker to elevate privileges. The attacker needs local access and low privileges, and the CVSS vector rates the attack complexity as high, so the flaw is not directly reachable from the internet. The highest risk is on multi-user systems such as terminal servers and shared workstations, where users already hold valid accounts.

Microsoft · Windows

Windows Now Playing Session Manager: Use-after-free elevation of privilege

A use-after-free vulnerability in the Windows Now Playing Session Manager component allows an authorized local user with low privileges to elevate their privileges. Exploitation requires an existing local account or foothold on the system. The vulnerability is not reachable directly from the internet.

Microsoft · Windows

Microsoft Windows CSC Service: Stack-based buffer overflow enables privilege escalation

A stack-based buffer overflow in the Windows Client-Side Caching (CSC) Service allows an authorized local attacker to elevate privileges. An attacker needs a low-privileged account and local access, for example code already running as a user. Successful exploitation can lead to full control of the affected system (SYSTEM level).

Microsoft · Windows Client-Side Caching (CSC) Service

Windows: Heap-based buffer overflow in Client-Side Caching (CSC) Service

A heap-based buffer overflow in the Windows Client-Side Caching (CSC) Service allows an authorized local user to elevate privileges. An attacker needs a low-privileged logon or code already running on the device, so the flaw is not remotely exploitable by itself. The CVSS 3.1 base score is 7.8 (high), with high impact on confidentiality, integrity and availability.

Microsoft · Windows

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Windows Cloud Files Mini Filter Driver: Use after free allows privilege escalation

A use-after-free flaw in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authorized local user to elevate privileges. An attacker who already has local access and low-privileged credentials could gain higher rights, potentially up to full control of the system. Microsoft fixed the flaw in the October 13, 2026 security update and rates it Important.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Volume Manager Extension Driver: Local privilege escalation

An out-of-bounds read in the Windows Volume Manager Extension Driver allows an authorized local user to elevate privileges. Exploitation requires local access, a high attack complexity and a low-privileged account. Successful exploitation would affect confidentiality, integrity and availability, so the flaw is a serious step in an attack that already has a foothold on the system.

Microsoft · Windows

Windows 10 1607: Remote code execution in Windows Error Reporting

A heap-based buffer overflow in Windows Error Reporting affects Windows 10 Version 1607 and Windows Server 2016, among other Windows releases. An unauthenticated attacker on the network can send a specially crafted packet to an affected service and execute code, with no user interaction or login required. Microsoft rates the flaw critical (CVSS 9.8) and reports no public disclosure or exploitation at the time of the research.

Microsoft · Windows 10 1607

Windows 10: Heap-based buffer overflow in Bind Filter Driver allows privilege escalation

A heap-based buffer overflow in the Windows Bind Filter Driver (bindflt.sys) on Windows 10 Version 21H2 allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privilege local account and no user interaction is required. Successful exploitation could give high impact to confidentiality, integrity and availability.

Microsoft · Windows 10 Version 21H2

Windows DHCP Server: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow in the Windows DHCP Server component allows an authorized attacker to elevate privileges on the affected host. The attack requires local access and a valid low-privilege account on the system. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability of the host (CVSS 3.1: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Microsoft · Windows DHCP Server

Microsoft Windows Kernel: Use-after-free leads to local privilege escalation

A use-after-free vulnerability (CWE-416) in the Windows kernel allows a local attacker with low privileges to elevate their privileges to a higher level, with a CVSS score of 7.8. It affects Windows 10 version 1809 and Windows Server 2019, among other Windows versions. Exploitation requires an existing local foothold, such as a compromised user account on the affected system. Microsoft has released fixed builds, and no public exploit or CISA KEV listing is known.

Microsoft · Windows

Windows 10 1607: Use after free in Windows Error Reporting

A use-after-free flaw (CWE-416) in the Windows Error Reporting component allows an authorized local attacker to elevate privileges. The attacker needs a local account with low privileges, and the attack complexity is high. Microsoft rates the issue Important and has released fixes for the affected Windows builds on October 13, 2026.

Microsoft · Windows 10 1607