New vulnerabilities – clearly explained

Windows LSASS: Denial of service via out-of-bounds read

An out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to cause a denial of service over the network. Only availability is rated as affected; no confidentiality or integrity impact is listed. No login or user interaction is required, but the sources do not state which network service reaches the vulnerable code path.

Microsoft · Windows

Microsoft Windows: Information disclosure in RPC Runtime

The RPC Runtime component of Microsoft Windows uses an uninitialized resource, which can lead to the disclosure of information. A remote attacker can send crafted RPC requests over the network to read sensitive data; the impact is limited to confidentiality. Affected are Windows 10, Windows 11, Windows Server 2012, 2012 R2 and 2016 builds listed by Microsoft. The sources disagree on the CVSS score (7.5 in the input, 6.5 in the research notes), and the score has not been verified.

Microsoft · Windows

Microsoft Windows: Heap-based buffer overflow in Partition Management Driver

A heap-based buffer overflow in the Windows Partition Management Driver allows an authorized local user to elevate privileges. The CVSS 3.1 score is 7.8 (HIGH), with high impact on confidentiality, integrity and availability. The attacker needs an existing local account with low privileges and no user interaction is required; the flaw is not reachable from the network.

Microsoft · Windows Partition Management Driver

Windows UDFS driver: Elevation of privilege vulnerability

The Windows Universal Disk Format File System Driver (UDFS) contains a memory corruption flaw that allows an authorized local user to elevate privileges. The CVE description calls it a use-after-free, but the CWE is CWE-122 (heap-based buffer overflow), so the exact vulnerability class is not settled. Exploitation requires a local account with low privileges, so the risk is mainly as a second stage after a user account has been compromised.

Microsoft · Windows

Microsoft AD FS: Spoofing vulnerability due to weak authentication

Microsoft Active Directory Federation Services (AD FS) on several Windows Server and Windows 10 builds contains a spoofing vulnerability caused by weak authentication (CWE-1390). An unauthenticated attacker on the network can exploit it without privileges or user interaction, but attack complexity is high. Successful exploitation could impact confidentiality and integrity; no exploitation or public exploit code is known.

Microsoft · Active Directory Federation Services (AD FS)

Windows: Local privilege escalation via TOCTOU race condition in Setup Files Cleanup

A time-of-check time-of-use race condition (CWE-367) in the Windows Setup Files Cleanup component allows an authorized local user to elevate privileges. Microsoft states that a successful attacker could gain SYSTEM privileges. Exploitation requires a local logon with low privileges and a suitable timing condition (high attack complexity); remote exploitation is not possible.

Microsoft · Windows

Windows: Elevation of privilege via untrusted search path in Setup Files Cleanup

The Windows Setup Files Cleanup component in several Windows 10, Windows 11 and Windows Server versions contains an untrusted search path weakness (CWE-426). A local attacker with a low-privileged account can exploit it to gain elevated privileges, with high impact on confidentiality, integrity and availability. The attack complexity is high, and no user interaction is needed. Microsoft fixed the issue in the October 2026 Patch Tuesday.

Microsoft · Windows

Microsoft Windows NTFS: Local elevation of privilege via out-of-bounds read

A flaw in the NTFS file system component of Windows allows an out-of-bounds read (CWE-125) that can be used for local privilege escalation. An attacker needs a valid local account or code already running as a user; the vulnerability is not reachable over the network. Successful exploitation can impact confidentiality, integrity and availability of the system.

Microsoft · Windows

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows Servicing Stack Updates: Elevation of privilege via untrusted search path

A flaw in the Servicing Stack Updates (SSU) component of multiple Windows 10, Windows 11 and Windows Server versions allows an authorized local user to gain elevated privileges. The attack requires local access and low privileges, and no user interaction is needed. An attacker who already has a foothold on a system, for example through malware or a compromised user account, could obtain higher privileges, potentially up to SYSTEM.

Microsoft · Windows Servicing Stack Updates

Windows Setup Files Cleanup: Privilege escalation via TOCTOU race condition

A time-of-check time-of-use (TOCTOU) race condition in the Windows Setup Files Cleanup component allows a local user with low privileges to elevate their privileges to a higher level. An attacker needs to already run code on the system, for example through phishing, malware or a compromised account. Microsoft rates the impact as high for confidentiality, integrity and availability, and the attack complexity as high.

Microsoft · Windows Setup Files Cleanup

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607: Local privilege escalation in WSUS component

A flaw in a Windows Server Update Service (WSUS) component of Windows 10 Version 1607 and Windows Server 2016 (build 14393) allows an authorized local user to gain higher privileges. The attacker needs a valid low-privileged account on the system, and the CVSS vector does not assume network access. The advisory does not state whether the flaw affects only the WSUS server role or also client systems.

Microsoft · Windows 10 1607

Windows 10 1607 NTFS: Race condition allows local privilege escalation

A race condition in the NTFS file system component of Windows 10 Version 1607 allows an authorized local user to elevate privileges. The attack complexity is high and low privileges are required, but no user interaction is needed. The flaw is not reachable from the internet and is mainly a step after an attacker or malware already has a user foothold on the device.

Microsoft · Windows 10 Version 1607

Microsoft Windows Server Update Service: Elevation of privilege

A flaw in the access control of Windows Server Update Service (WSUS) allows an attacker with a valid local, low-privilege account to gain higher privileges on the system. The attacker needs local access first, for example through phishing or malware running as a standard user; the flaw cannot be used remotely. Microsoft has released security updates for the affected Windows client and server versions, and the CNA record lists a wider range of versions than the CPE in the record.

Microsoft · Windows Server Update Service

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows IIS: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in Microsoft Windows Internet Information Services (IIS) allows an authorized local attacker to elevate privileges. The attacker needs valid low-privilege access to the system, for example through a compromised user account or malware. A successful attack can lead to full compromise of confidentiality, integrity and availability on the affected host. The vulnerability is not remotely exploitable by itself.

Microsoft · Windows Internet Information Services

Microsoft Exchange Server: Elevation of privilege via incorrect authorization

An authorized low-privilege user of on-premises Microsoft Exchange Server can elevate privileges over the network due to incorrect authorization (CWE-863). According to unverified secondary reporting, the attacker can manipulate a shared Exchange Control Panel cache and install a malicious mail add-in into another user's mailbox. The attack requires a valid account but no user interaction; CVSS is 8.8 (High).

Microsoft · Exchange Server

Microsoft Office Excel: Remote Code Execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated remote attacker to execute code. Exploitation requires that a user opens a crafted Excel file, for example from an email attachment, a download or a link. The CVSS base score is 8.8 (High), with high impact on confidentiality, integrity and availability.

Microsoft · Office Excel

Microsoft Windows Imaging Component: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in the Windows Imaging Component allows an unauthenticated attacker to execute code remotely on affected Windows systems. The attacker needs a user to take an action, such as opening or previewing a crafted image file or visiting a malicious page. Exploitation is not known, and no public proof of concept was found.

Microsoft · Windows Imaging Component

Microsoft Windows: Local privilege escalation in Windows Setup Files Cleanup

A local vulnerability in the Windows Setup Files Cleanup component allows the external control of a system or configuration setting. An attacker with an existing low-privileged account on the system can elevate privileges, with high impact on confidentiality, integrity and availability. No user interaction is required, but the attacker must already have local access.

Microsoft · Windows

Microsoft Windows: Use-after-free privilege escalation in Program Compatibility Assistant

A use-after-free flaw in the Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges on the local system. The service runs with elevated rights, so a successful attack can lead to SYSTEM-level access. An attacker needs a local foothold and low privileges first, for example through malware or a stolen user session; the attack complexity is high (CVSS 3.1: 7.0, High).

Microsoft · Windows

Windows: Use-after-free in Program Compatibility Assistant Service

A use-after-free vulnerability in the Windows Program Compatibility Assistant Service allows an authorized local user to elevate privileges. Exploitation requires local access with low privileges and high attack complexity, and no user interaction. Successful exploitation can give the attacker high confidentiality, integrity and availability impact on the system (CVSS 3.1: 7.0, High). The flaw is not reachable remotely by itself.

Microsoft · Windows

Microsoft Windows: Use after free in Application Compatibility Cache

A use-after-free flaw in the Windows Application Compatibility Cache allows an authorized local attacker to elevate privileges. An attacker who already runs code as a low-privileged user could gain SYSTEM rights. The attack complexity is high, and no user interaction is required. The vulnerability is a post-foothold risk, not an entry point from the internet.

Microsoft · Windows