New vulnerabilities – clearly explained

Microsoft Windows NTFS: Elevation of privilege via format string

A local attacker with an existing foothold on a Windows system can exploit an externally controlled format string flaw in the NTFS file system component to elevate privileges. The attacker needs valid low-privileged access, such as a user account or malware on the machine. The CVSS base score is 7.8 (High), and the flaw is not remotely exploitable from the internet.

Microsoft · Windows

Windows Smart Card: Use-after-free allows local privilege escalation

Microsoft Windows with the Smart Card component contains a use-after-free flaw (CWE-416) that Microsoft lists as an elevation of privilege vulnerability. An attacker with a valid low-privilege local account can exploit it to gain higher privileges, which Microsoft and NVD rate as high impact to confidentiality, integrity and availability (CVSS 3.1 base score 7.0). Remote exploitation is not possible, and exploitation requires local logon access and a high attack complexity.

Microsoft · Windows

Microsoft Windows: Elevation of privilege in Geotag Broker

A flaw in the Windows Geotag Broker component is caused by improper access control (CWE-862). An authorized local attacker with low privileges can exploit it to elevate privileges on the affected Windows system, potentially up to full control of the host. No user interaction is required, and the attack is local only. CVSS 3.1 base score is 7.8 (High).

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows: Heap-based buffer overflow in Client-Side Caching (CSC) Service

A heap-based buffer overflow in the Windows Client-Side Caching (CSC) Service allows an authorized local user to elevate privileges. Exploitation requires local code execution or an existing local foothold, and the attack complexity is high. Microsoft rates the flaw as Important with a CVSS 3.1 base score of 7.0, and no public exploitation is known.

Microsoft · Windows

Microsoft Windows Smart Card: Local privilege escalation via heap overflow

The Windows Smart Card component in several Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow (CWE-122). An attacker with local access and a low-privileged account can exploit it to elevate privileges, which may give full control over the affected system. Exploitation requires an existing foothold on the machine; no remote attack vector is indicated. Fixed builds are available for the affected versions, except for Windows Server 2012 and 2012 R2, where no fix is listed.

Microsoft · Windows Smart Card

Microsoft Windows PowerShell: Remote code execution via integer underflow

A integer underflow in Windows PowerShell allows an unauthenticated attacker to execute code remotely over the network. The CVSS base score is 9.8 (critical). Exposure matters most: hosts reachable from untrusted networks are at highest risk, while internal-only hosts face lower but still significant lateral-movement risk.

Microsoft · Windows PowerShell

Microsoft Windows Search: Local privilege escalation via use-after-free

A use-after-free vulnerability in the Windows Search Service allows an authorized local attacker to elevate privileges. An attacker needs an existing foothold on the system, such as a user account or malware running as a user, and the attack is not directly reachable from the internet. Successful exploitation can grant SYSTEM rights, which is most relevant on shared terminal servers, multi-user PCs and systems exposed to phishing.

Microsoft · Windows Search

Microsoft Windows Search: Elevation of privilege through use-after-free

A use-after-free vulnerability in the Windows Search Component allows an authorized local user to elevate privileges. An attacker needs an existing low-privilege account on the affected system and a high-complexity condition must be met. Successful exploitation could give the attacker full control of the host, as the impact on confidentiality, integrity and availability is rated high.

Microsoft · Windows Search

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows: Elevation of privilege via use after free in Windows Search

A use-after-free flaw in the Microsoft Windows Search component allows an authorized local user to elevate privileges. An attacker needs local access and low privileges, so the flaw is a privilege escalation step rather than an entry point. Successful exploitation could give the attacker SYSTEM rights on the affected machine. Microsoft rates exploitation as less likely, and no public exploit is known.

Microsoft · Windows

Microsoft Windows: Heap-based buffer overflow in HID Parser Library

A heap-based buffer overflow in the Windows HID Parser Library allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged account on the affected machine, so this is a privilege escalation step rather than a remote entry point. Microsoft rates the issue Important (CVSS 3.1 base score 7.8), and CISA SSVC data lists no known exploitation.

Microsoft · Windows

Microsoft Windows 11: Elevation of privilege in Windows Kernel-Mode Drivers

Improper access control in the Windows Kernel-Mode Drivers allows an authorized local attacker to elevate privileges to system level. The attacker needs low privileges, such as a standard user account or code already running as a logged-in user, and no user interaction. The flaw is not directly reachable from the internet, but it matters most on shared workstations, terminal servers and machines with stored credentials.

Microsoft · Windows 11

Microsoft Windows NTFS: Elevation of privilege via out-of-bounds read

Windows NTFS, the default file system of Windows, contains an out-of-bounds read (CWE-125) that allows an authorized local user to elevate privileges. An attacker needs a local, low-privileged logon and can then gain higher privileges, potentially up to SYSTEM, with high impact on confidentiality, integrity and availability. The vulnerability is not reachable from the internet, but it matters after a compromise, for example when a phished user or malware on one workstation tries to take over the system.

Microsoft · Windows NTFS

Microsoft Windows Win32k: Use-after-free allows local privilege escalation

A use-after-free vulnerability in the ICOMP component of the Win32k kernel-mode subsystem in Windows allows an authorized local attacker to elevate privileges. Exploitation requires local code execution or a logged-in account with low privileges, and the attack complexity is high. According to the CVSS vector, successful exploitation can fully compromise confidentiality, integrity and availability of the system.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Search: Use-after-free leads to local privilege escalation

A use-after-free vulnerability (CWE-416) in the Windows Search component allows an authorized local attacker to elevate privileges. The attacker needs a low-privilege account and local access, and the attack complexity is rated high. Exploitation is not known, and the vulnerability is not remotely exploitable.

Microsoft · Windows Search

Windows: Remote code execution in Windows Image Acquisition

A heap-based buffer overflow (CWE-122) in the Windows Image Acquisition component allows an unauthenticated remote attacker to execute code. Microsoft rates user interaction as required, so an attack needs a user to take an action. The NVD record in the request lists CVSS 9.8, but Microsoft's advisory vector is reported as 8.8 (High) with user interaction (UI:R); the 9.8 figure could not be verified against a source.

Microsoft · Windows

Windows IKE Extension: Spoofing due to reliance on untrusted inputs

The Windows IKE Extension, which handles IKE key exchange for IPsec and VPN tunnels, contains a spoofing vulnerability. It arises because a security decision relies on untrusted inputs. A remote attacker on the network can exploit it without privileges or user interaction. CVSS 3.1 rates it 8.1 (High) with high attack complexity; Microsoft classifies the impact as Spoofing, while the vector rates confidentiality, integrity and availability as high. Hosts that accept IKE/IPsec traffic from the internet are most at risk.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft .NET: Remote code execution through deserialization of untrusted data

Deserialization of untrusted data in Microsoft .NET, including the WPF desktop runtime on Windows, allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted document, such as an XPS or fixed-format file, in a vulnerable application. Microsoft and NVD rate the issue CVSS 8.8, while CISA SSVC lists no exploitation and total technical impact.

Microsoft · .NET

Windows Error Reporting: Heap-based buffer overflow allows remote code execution

Microsoft's Windows Error Reporting component contains a heap-based buffer overflow (CWE-122) that Microsoft classifies as remote code execution. According to the NVD record, an unauthorized attacker can execute code over the network without privileges or user interaction, with high impact on confidentiality, integrity and availability. The CNA record lists several Windows 10, Windows 11 and Windows Server versions, including Windows 10 Version 1607, but the sources do not describe the reachable network attack path. The CVSS base score is 9.8 (critical).

Microsoft · Windows Error Reporting

Windows 11: Heap-based buffer overflow in RPC Runtime leads to privilege escalation

A heap-based buffer overflow in the Windows RPC Runtime allows an authorized local attacker to elevate privileges. The attacker needs local access and a valid low-privileged account, and no user interaction is required. Microsoft rates the issue Important and reported no public disclosure or exploitation at publication. Fixes are available for the affected Windows 11 versions.

Microsoft · Windows 11

Windows Media Foundation: Remote code execution through heap-based buffer overflow

A heap-based buffer overflow in the Windows Media Foundation multimedia framework allows an unauthenticated attacker to execute code over a network. According to the CVSS vector, no authentication and no user interaction are required. The advisory does not say which service or media path is reachable, so exposure depends on whether media parsing is reachable from the attacker's network. CVSS 9.8 (critical); the record reports no known exploitation.

Microsoft · Windows Media Foundation