New vulnerabilities – clearly explained

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Windows NPS: Denial of service via out-of-bounds read

An out-of-bounds read in the Windows Network Policy Server (NPS) allows an unauthenticated attacker on the network to cause a denial of service. The vendor rates the impact as availability only, with no confidentiality or integrity impact. A successful attack can block RADIUS-based authentication for Wi-Fi, VPN or network access.

Microsoft · Windows

Microsoft Windows: Elevation of privilege in Modern Device Management (MDM)

A missing authentication check for a critical function in the Windows Modern Device Management (MDM) component allows an authorized local user to elevate privileges. An attacker needs local access and low-privileged credentials, and no user interaction is required. Successful exploitation can lead to high impact on confidentiality, integrity and availability of the affected system.

Microsoft · Windows

Windows NTFS: Heap-based buffer overflow leads to local privilege escalation

A heap-based buffer overflow in the Windows NTFS file system driver affects several supported and unsupported Windows 10, Windows 11 and Windows Server releases, including Windows 10 1607 and Windows Server 2016. An authorized local user can exploit it to elevate privileges, for example to SYSTEM level. Exploitation requires local access and a valid account, so the flaw is not remotely exploitable.

Microsoft · Windows

Windows: Information disclosure via out-of-bounds read in GDI

CVE-2026-83651 is an out-of-bounds read in the Windows Graphics Device Interface (GDI) that affects several Windows 10, Windows 11 and Windows Server 2012 builds, plus some Office for Mac and Android versions. An unauthorized attacker on the network can read memory outside the intended buffer and disclose information, with no privileges or user interaction required according to the CVSS vector in the CVE record. The impact is limited to confidentiality; the record does not describe code execution. The CVSS score differs between sources (7.5 in the input data, 6.5 in some secondary sources), so verify it in NVD.

Microsoft · Windows

Microsoft Windows: Elevation of privilege in Windows Media via heap-based buffer overflow

A heap-based buffer overflow in a Windows Media component allows an authenticated local user to elevate privileges. The flaw affects Windows 10 up to build 10.0.14393.9612 (Version 1607, end-of-life), several other Windows 10 and 11 releases, and Windows Server 2012, 2012 R2 and 2016. Exploitation requires local low-privilege access and no user interaction. Microsoft has released patches, and no exploitation is known.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows Active Directory Domain Services: Denial of service via out-of-bounds read

An out-of-bounds read in Active Directory Domain Services (AD DS) on Windows allows an unauthenticated attacker on the network to cause a denial of service. No credentials or user interaction are required. A successful attack can disrupt the directory service on affected domain controllers and thereby block logons across the business.

Microsoft · Windows Active Directory Domain Services

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

AD FS: Denial of service through uncontrolled resource allocation

Active Directory Federation Services (AD FS), a Windows Server role for identity federation and single sign-on, allocates resources without limits or throttling. An unauthenticated attacker with network access can exhaust these resources and make the service unavailable. Confidentiality and integrity are not affected, but an outage blocks SSO to dependent applications. Exposure is highest where AD FS has an internet-facing endpoint.

Microsoft · Active Directory Federation Services (AD FS)

Windows: Use-after-free in Windows Audio Service enables local privilege escalation

A use-after-free vulnerability (CWE-416) in the Windows Audio Service allows an authorized local attacker to elevate privileges. The attacker needs a local account with low privileges, and no user interaction is required. The CVSS 3.1 base score is 7.0 (High), and CISA SSVC lists exploitation as none.

Microsoft · Windows

Microsoft Windows Error Reporting: Remote code execution (stack buffer overflow)

A stack-based buffer overflow in Windows Error Reporting (WER), the Windows component that collects crash data, allows an unauthorized attacker to execute code over a network. The attack requires user interaction, such as opening a crafted file or link, and no privileges. The CVSS base score is 8.8 (high), and the CVE record lists impact on confidentiality, integrity and availability.

Microsoft · Windows Error Reporting

Microsoft Windows DNS Server: Remote code execution via type confusion

A type confusion weakness (CWE-843) in the Windows Domain Name Service (DNS Server role) allows an unauthorized attacker to execute code over the network. The CVSS 8.8 vector also includes user interaction (UI:R), which Microsoft should clarify, since a DNS server bug normally needs none. The CNA record lists Windows 10, Windows 11, Windows Server 2012 to 2016 and several builds, while the CPE data lists Windows 10 1607.

Microsoft · Windows DNS Server

Windows: Heap-based buffer overflow in Windows Media enables privilege escalation

A heap-based buffer overflow in the Windows Media component of Windows allows an authorized local attacker to elevate privileges, potentially up to SYSTEM. The attacker needs existing low-privileged access to the system, and no user interaction is required. The flaw is not remotely exploitable on its own, but it matters once an attacker has a foothold through phishing, stolen credentials or malware. MSRC rates exploitation as unlikely, and no exploitation or public disclosure is known.

Microsoft · Windows

Windows NTFS: Heap-based buffer overflow allows local code execution

A heap-based buffer overflow in the Windows NTFS file system component allows an authorized local attacker to execute code, per the CVE description (CWE-122, CVSS 7.8). The CNA record title says Remote Code Execution, which conflicts with the local attack vector in the description, so the exact attack path should be confirmed with Microsoft. The attacker needs local access and low privileges, so the main risk is privilege escalation or code execution after a foothold, such as a compromised user account on a shared multi-user host or server.

Microsoft · Windows NTFS

Windows Sensor Data Service: Heap-based buffer overflow enables privilege escalation

A heap-based buffer overflow in the Windows Sensor Data Service allows an authorized local user to elevate privileges to a higher level. The attack requires local access and a low-privilege account; the CVSS base score is 7.8 (HIGH). Systems with shared logons, terminal servers or RDP access are most exposed.

Microsoft · Windows Sensor Data Service

Windows USB Driver: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow (CWE-122) in the Windows USB driver affects many Windows 10, Windows 11 and Windows Server versions, including Windows 10 Version 1607 and Windows Server 2016. An attacker with a low-privileged local account can exploit it to gain higher privileges, up to SYSTEM. Remote exploitation is not possible; the attacker needs prior local access, for example after phishing or malware infection.

Microsoft · Windows USB Driver

Windows Kernel-Mode Drivers: Out-of-bounds read enables local privilege escalation

An out-of-bounds read in the Windows Kernel-Mode Drivers allows an authorized local user to elevate privileges. Several supported Windows 10, Windows 11 and Windows Server versions are affected. An attacker needs a valid low-privileged account on the system, and no user interaction is required. The flaw is not directly reachable from the internet, but it can turn a compromised user account into full system control. Microsoft rates it as Important.

Microsoft · Windows

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Windows Server DNS Server: Denial of service through out-of-bounds read

An out-of-bounds read in the DNS Server role of Windows Server 2012 through 2025 allows an unauthenticated attacker on the network to cause a denial of service. Per the CVSS vector, the impact is limited to availability, with no confidentiality or integrity loss. No privileges or user interaction are required, so an internal DNS server can be targeted from the LAN or from a compromised internal host. Internet exposure is the worst case and only applies if public DNS runs on Windows Server.

Microsoft · Windows Server

Microsoft Windows 11 BitLocker: Elevation of privilege via double free

A double free (CWE-415) in the Windows BitLocker component allows a locally authenticated user with low privileges to elevate their privileges to a higher level on the affected system. Successful exploitation can lead to a complete compromise of confidentiality, integrity and availability of the device. Exploitation requires a valid local account and a foothold on the machine; it is not remotely exploitable.

Microsoft · Windows 11

Windows USB Driver: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Windows USB Driver allows a locally authorized attacker with low privileges to escalate privileges, potentially to SYSTEM level. Successful exploitation would give full control over the affected host (confidentiality, integrity and availability impact rated high). The attack requires local access or a low-privilege foothold and is not reachable directly from the internet. Microsoft reports no public disclosure and no known exploitation.

Microsoft · Windows USB Driver

Microsoft Windows Core Messaging: Elevation of privilege via untrusted pointer dereference

An untrusted pointer dereference in the Windows Core Messaging component allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account and local code execution on the affected system. The flaw cannot be exploited remotely; CVSS 3.1 base score is 7.8 (High).

Microsoft · Windows Core Messaging

Windows 11: Elevation of privilege in ReFS Deduplication Service

A flaw in the Deduplication Service of the Windows Resilient File System (ReFS) allows a local user with low privileges to elevate their rights, potentially up to SYSTEM level. The weakness is classified as weak authentication (CWE-1390). Exploitation requires an existing local account and is not possible remotely; the vendor rates the impact on confidentiality, integrity and availability as high.

Microsoft · Windows 11