A heap-based buffer overflow in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. User interaction is required, for example a user connecting a client to a malicious or compromised RDP host. Windows 10 version 1607 (LTSB 2016) reached end of updates on October 13, 2026, so the October 2026 update is its last regular fix and future RDP client flaws will remain unpatched.
Microsoft · Windows 10 1607
A use-after-free flaw in the Windows Connected User Experiences and Telemetry component affects Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025. A locally authenticated user with low privileges can exploit it to gain elevated privileges, potentially up to SYSTEM. The attack requires local access and has high complexity, so it is not remotely exploitable. The main risk is a local user or a compromised account on a shared system.
Microsoft · Windows 11
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows TCP/IP stack allows an attacker with low privileges on the system to elevate their privileges. The attack requires local access and a high-complexity condition, so it is a second-stage escalation after an attacker has already gained a foothold, for example through a compromised user account or malware. The CVSS 3.1 base score is 7.0 (HIGH). Several Windows client and server versions are affected, not only Windows 10 1607.
Microsoft · Windows TCP/IP
Windows Installer, the Windows component used to install, repair and remove software packages, contains a heap-based buffer overflow (CWE-122). An attacker who already has a local low-privilege account can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. Exploitation requires local access and a low-privilege account; it is not remotely exploitable.
Microsoft · Windows Installer
A use-after-free flaw (CWE-416) in the Windows Defender Firewall Service allows an authorized local attacker to elevate privileges on the affected system. The attacker needs a low-privileged account on the host, so the flaw is not remotely exploitable by itself. Microsoft rates the CVSS 3.1 base score at 7.8 (High).
Microsoft · Windows 11
The Windows TCP/IP network stack, a core component of Microsoft Windows, contains a heap-based buffer overflow. An authorized attacker with low privileges can exploit it locally to elevate privileges. Exploitation requires code execution or a logged-on account on the host, so it is not directly reachable from the internet. The CVSS score is 7.8 (High), and CISA SSVC rates the issue as not automatable.
Microsoft · Windows
A missing memory release in the Windows DHCP Client allows an unauthorized attacker to cause a denial of service over the network. Affected are Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core. The impact is availability only; confidentiality and integrity are not affected. Because DHCP traffic normally stays on the local network segment, the realistic attacker is someone on the LAN or Wi-Fi.
Microsoft · Windows
An integer underflow in Windows Installer, the Windows component that installs, maintains and removes software packages, allows a locally authorized attacker to elevate privileges. The attacker needs a local account with low privileges and a high-complexity condition must be met. Microsoft has published fixes for the affected Windows 10, Windows 11 and Windows Server versions. CISA SSVC assessed exploitation as none, and no public proof of concept was found.
Microsoft · Windows Installer
A use-after-free flaw (CWE-416) in the Windows kernel allows an authorized local user to elevate privileges. Affected are Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025, according to the CNA data. An attacker needs local access and low privileges, and the attack complexity is high. Exploitation is not confirmed, and CISA SSVC lists exploitation as none.
Microsoft · Windows
Microsoft Active Directory Federation Services (AD FS) contains a spoofing vulnerability caused by weak authentication. An unauthorized attacker on the network can perform spoofing, and the attack requires no privileges or user interaction, although Microsoft rates attack complexity as high. Exposure is greatest where the AD FS endpoint is reachable from the internet, because AD FS provides single sign-on for other applications. Microsoft's October 13, 2026 security updates fix the issue.
Microsoft · Active Directory Federation Services (AD FS)
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
An out-of-bounds read in the Function Discovery Service (fdwsd.dll) of Windows 10 Version 1607 and Windows Server 2016 allows an unauthenticated attacker on the network to disclose information. No user interaction or login is required, and the impact is limited to confidentiality (CVSS 3.1: 7.5, HIGH). The leaked data can be useful as a step in a larger attack chain.
Microsoft · Windows 10 Version 1607
Windows Error Reporting in several Windows 10, Windows 11 and Windows Server versions uses an uninitialized resource. An authorized local user with low privileges can exploit this to gain higher privileges on the affected system. Remote exploitation is not described; an attacker needs an existing local account and a foothold on the machine.
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A race condition (CWE-362) in Active Directory Certificate Services (AD CS) allows an authorized local user to elevate privileges. The CVSS 3.1 base score is 7 (High), with high impact on confidentiality, integrity and availability. Exploitation requires local access, high attack complexity and low privileges, so an attacker must already have a foothold on the affected system.
Microsoft · Active Directory Certificate Services (AD CS)
A null pointer dereference in the Windows DHCP Server role allows an unauthenticated remote attacker to crash the service over the network, causing a denial of service. The CVSS score is 7.5 (High), and the impact is limited to availability. No public trigger details were found, and CISA SSVC lists exploitation as none.
Microsoft · Windows DHCP Server
Research and translation in progress – available shortly.
A link following flaw (CWE-59) in the Windows User Profile Service allows an authorized local user to elevate privileges. The service runs at SYSTEM level and handles per-user profile loading. Exploitation requires a valid local account and is not possible remotely, so the risk mainly concerns footholds such as phished users, malware or rogue employees, and is higher on shared or multi-user systems.
Microsoft · Windows 10 1607
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
