New vulnerabilities – clearly explained

Microsoft Windows: Use after free in Application Compatibility Cache

A use-after-free flaw in the Windows Application Compatibility Cache allows an authorized local attacker to elevate privileges. An attacker who already runs code as a low-privileged user could gain SYSTEM rights. The attack complexity is high, and no user interaction is required. The vulnerability is a post-foothold risk, not an entry point from the internet.

Microsoft · Windows

Microsoft Windows: Use-after-free in Program Compatibility Assistant Service

A use-after-free vulnerability (CWE-416) in the Windows Program Compatibility Assistant Service allows an authorized local user with low privileges to elevate privileges. The attack requires local access and has high complexity. Microsoft fixed the issue in the October 13, 2026 updates, and no public exploit or active exploitation is known.

Microsoft · Windows

Windows 10 1607: Race condition in Windows Security Center

A race condition (CWE-362, CWE-416) in the Windows Security Center component of Windows 10 Version 1607 allows an authorized local attacker to elevate privileges. The attacker needs code execution or a logged-in session on the machine and must win a timing race, which makes exploitation harder. Microsoft's records list the flaw with CVSS 3.1 7.0 (PR:L) in NVD-based sources, while a mirror shows 6.4 (PR:H); verify the current vector in NVD. Windows 10 Version 1607 reached end of updates on October 13, 2026.

Microsoft · Windows 10 1607

Windows Credential Guard: Spoofing due to missing authentication

A critical function in Windows Credential Guard lacks authentication, so a local attacker can perform spoofing. The attacker needs a valid low-privilege account on the system, and no user interaction is required. Microsoft scores the impact as high for confidentiality, integrity and availability, with changed scope, and gives a base score of 8.8 (the CVE record shows 7.8). The flaw is not internet-facing, but it matters after a compromise, for example for lateral movement.

Microsoft · Windows

Microsoft Exchange Server: Remote code execution via stack-based buffer overflow

A stack-based buffer overflow in Microsoft Exchange Server allows an unauthenticated remote attacker to execute code on the server. No user interaction is required, so a crafted email sent to an internet-facing Exchange server may be sufficient. Microsoft rates attack complexity as high, so success is not guaranteed. The NVD record was still awaiting analysis at the time of writing.

Microsoft · Exchange Server

Microsoft Windows Schannel: Elevation of privilege via NULL pointer dereference

A NULL pointer dereference in the Windows Schannel TLS/SSL component allows an authorized local user to elevate privileges. Windows 10, Windows 11 and Windows Server 2012, 2012 R2 and 2016 are affected according to the CNA data. An attacker needs a local account with low privileges and no user interaction, so this is a privilege escalation step after an initial compromise, not a remote entry point.

Microsoft · Windows

Microsoft MPEG-2 Video Extension: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in the Microsoft MPEG-2 Video Extension allows an attacker to execute code remotely. No privileges are required, but a user must interact with crafted content, for example by opening a malicious MPEG-1 or MPEG-2 media file. The CVSS base score is 8.8 (High), and the impact on confidentiality, integrity and availability is rated high if exploited.

Microsoft · MPEG-2 Video Extension

Windows Kernel: Out-of-bounds write allows local privilege escalation

An out-of-bounds write in the Windows kernel (CWE-787) affects several Windows 10, Windows 11 and Windows Server versions, including Windows 10 Version 1607 and Windows Server 2016. An attacker who already has a local, low-privileged logon can exploit it to elevate privileges and gain full control of the affected machine. The vulnerability is not directly reachable from the internet and requires a foothold on the system first, for example through phishing or malware.

Microsoft · Windows Kernel

Microsoft Office Word: Heap-based buffer overflow allows remote code execution

A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The attack requires a user to open a manipulated document, most likely delivered by email. Microsoft rates the flaw as Important with a CVSS base score of 8.8.

Microsoft · Office Word

Microsoft Office Word: Heap-based buffer overflow enables remote code execution

A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps and Office LTSC 2021/2024 on Windows and Mac, allows remote code execution. An attacker can run code on the victim's system by tricking the user into opening a crafted Word document, for example from an email or a download. No privileges are required, but user interaction is needed. Microsoft rates the issue Important (CVSS 3.1: 8.8).

Microsoft · 365 Apps

Microsoft Office Word: Remote Code Execution via untrusted pointer dereference

An untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. According to Microsoft, the Reading Pane (Preview Pane) is an attack vector, so a user may not need to open a malicious document. CVSS 9.8 (Critical); Microsoft and CISA SSVC assess automatable exploitation as possible, but no exploitation has been reported.

Microsoft · 365 Apps

Windows Bind Filter Driver: Elevation of privilege through improper access control

A flaw in the Windows Bind Filter Driver (bindflt.sys) allows an authorized local user to elevate privileges. The attacker needs a valid local logon and low privileges, so the vulnerability is not directly reachable from the internet. It is mainly relevant after an initial compromise, for example through phishing or on shared multi-user systems.

Microsoft · Windows 11

Microsoft Sharepoint Server

Research and translation in progress – available shortly.

Microsoft Skype for Business Server: Path traversal allows remote code execution

An absolute path traversal flaw in on-premises Skype for Business Server, also covered under the Lync name, allows an authorized attacker to execute code over the network. The attacker needs low privileges and a valid file token, and the flaw is rated High with CVSS 8.8. Exposure of the Persistent Chat and front-end services to the internet increases the risk.

Microsoft · Skype for Business Server

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Office Outlook: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code remotely over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's exploitability data rates it as unproven, and it is not publicly disclosed or known to be exploited. Research notes indicate that a crafted email may be triggered in the Reading Pane without user interaction, but Microsoft has not confirmed this preview vector, so the attack conditions remain partly unverified.

Microsoft · Office Outlook

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Office Word: Heap-based buffer overflow allows remote code execution

A heap-based buffer overflow in Microsoft Office Word allows remote code execution. An attacker can run code in the context of the logged-on user by convincing a victim to open a crafted document, for example via a phishing email. No privileges are required, but user interaction is needed, and CISA's SSVC rates the technical impact as total.

Microsoft · 365 Apps

Windows Win32K: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Win32K Windows Graphics Component allows an authorized local attacker to elevate privileges. The attacker first needs local code execution or a low-privileged account, for example after phishing or a compromised user. Successful exploitation would give full control over confidentiality, integrity and availability. No exploitation has been reported.

Microsoft · Windows

Windows Win32k: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Windows Win32k kernel subsystem allows an authorized local attacker to elevate privileges. An attacker who already has a low-privileged foothold on a system, for example after a phishing click or malware on a workstation, could gain SYSTEM rights. Microsoft rates the flaw as Important with a CVSS 3.1 base score of 7.8 and does not consider it exploited or publicly disclosed.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Office Outlook: Heap-based buffer overflow allows remote code execution

A heap-based buffer overflow in Microsoft Outlook, part of Microsoft 365 Apps and Office LTSC 2021/2024, allows an unauthorized attacker to execute code over a network. User interaction is required, for example by opening a malicious message or file. Microsoft rates the impact as high for confidentiality, integrity and availability. Exploitation is not known, and CISA SSVC lists exploitation as none.

Microsoft · Office Outlook