New vulnerabilities – clearly explained

Microsoft Office Outlook: Information disclosure through out-of-bounds read

Microsoft Office Outlook contains an out-of-bounds read vulnerability (CWE-125) that allows an attacker to disclose information. According to the CVSS vector, the attack needs no privileges and no user interaction over the network, and it affects confidentiality only. No exploitation in the wild is known, and CISA SSVC rates exploitation as none.

Microsoft · Office Outlook

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Exchange Server: Cross-site scripting allows spoofing

Microsoft Exchange Server on-premises contains a cross-site scripting (XSS) flaw (CWE-79) that allows spoofing of Exchange web pages. An unauthenticated remote attacker can exploit it, but a victim must act, for example by clicking a crafted link, and the CVSS score is 9.3 (critical) with changed scope and high confidentiality and integrity impact. Microsoft's description states that the impact is spoofing rather than code execution. NVD analysis was still pending at publication.

Microsoft · Exchange Server

Windows Media Foundation: Heap buffer overflow allows local privilege escalation

A heap-based buffer overflow in Microsoft Windows Media Foundation affects multiple supported and older Windows 10, Windows 11 and Windows Server versions. An attacker with a low-privilege account or code already running on the system can exploit it locally to gain higher privileges, with a changed scope that can reach beyond the vulnerable component. Exploitation requires high attack complexity, and no exploitation in the wild is known.

Microsoft · Windows Media Foundation

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Office Click-to-Run: Local privilege escalation via use-after-free

Microsoft Office Click-to-Run, the delivery and update mechanism of Microsoft 365 Apps and Office LTSC 2021 and 2024, contains a use-after-free flaw (CWE-416). An attacker with local access and low privileges can exploit it to elevate privileges on the system. The attack complexity is high, so exploitation requires specific conditions. The flaw is local only and does not by itself allow remote access.

Microsoft · 365 Apps

Microsoft Windows CD-ROM File System Driver: Remote code execution

The Windows CD-ROM File System Driver contains an untrusted pointer dereference (CWE-822) that allows an unauthorized attacker to execute code over a network. The CVE record lists CVSS 9.8 with no user interaction, while Microsoft's data reportedly gives 8.8 with user interaction required, so the exact conditions are not yet confirmed. Affected are many supported and some older Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607 and Server 2016. Microsoft currently assesses exploitation as unlikely and no public exploit is known.

Microsoft · Windows CD-ROM File System Driver

Windows 11: Use-after-free in Bind Filter Driver enables local privilege escalation

A use-after-free vulnerability (CWE-416) in the Windows Bind Filter Driver allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. The attacker needs a local account with low privileges, so the flaw is a post-compromise or insider risk rather than an entry point from the internet.

Microsoft · Windows 11

Microsoft Windows Win32k: Use-after-free leads to local privilege escalation

A use-after-free flaw in the Win32k kernel subsystem of Windows 11 and Windows Server 2025 allows an authorized local user to elevate privileges. The attacker needs local access and a valid logon, and the attack is rated as complex. The flaw is not directly reachable from the internet; it matters once an attacker already has a foothold, for example through phishing or malware.

Microsoft · Windows

Windows 10 1607: Use-after-free in Windows Installer enables local privilege escalation

The Windows Installer component in Windows 10 Version 1607 and Windows Server 2016 contains a use-after-free flaw (CWE-416). A locally authorized attacker can exploit it to elevate privileges on the affected system. Exploitation requires local access, a low-privileged account and a high-complexity condition, and the flaw is not directly reachable from the internet.

Microsoft · Windows 10 Version 1607

Windows 10 1607: Use-after-free in Win32k allows local privilege escalation

A use-after-free weakness in the Windows Win32k kernel subsystem affects Windows 10 Version 1607 (CWE-416). An authorized attacker with local access can exploit it to elevate privileges. Exploitation requires local code execution or a logged-on low-privileged account, and the attack complexity is high. Microsoft rates the CVSS 3.1 base score at 7.0 (High).

Microsoft · Windows 10 Version 1607

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Office Word: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over the network. No user login is required, but the attack complexity is rated high and the attacker needs a user to open or preview a crafted document. Microsoft states that the Preview Pane is an attack vector, so receiving a malicious document by email or opening one from a file share is enough to create risk.

Microsoft · Office Word

Microsoft Office Word: Remote Code Execution through heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted document, for example one received by email, by download or from a file share. No credentials are needed on the attacker side, and no internet-facing service is involved.

Microsoft · 365 Apps

Microsoft SharePoint Server: Remote code execution vulnerability

A flaw in Microsoft Office SharePoint Server Subscription Edition allows the inclusion of functionality from an untrusted control sphere (CWE-829). An authenticated attacker on the network can execute code on the server, with high impact on confidentiality, integrity and availability. According to the CVSS vector, the attacker needs high privileges and no user interaction is required. Microsoft has released a fix in the October 13, 2026 update.

Microsoft · SharePoint Server

Microsoft SharePoint Server: SQL injection leads to privilege escalation

A SQL injection flaw (CWE-89) in Microsoft Office SharePoint allows an authenticated attacker to elevate privileges over the network. Per the CVSS vector (8.8), low-privileged access is required and no user interaction is needed. The sources describe the issue for SharePoint Server Subscription Edition; no exploitation is known.

Microsoft · SharePoint Server

Microsoft 365 Apps

Research and translation in progress – available shortly.

Windows WebDAV: Heap-based buffer overflow enables privilege escalation

A heap-based buffer overflow in the WebDAV component of Microsoft Windows allows an unauthorized attacker to elevate privileges. The NVD description says the attack is possible over a network. Systems with the WebDAV service enabled are affected. Sources disagree on the attacker model and the CVSS score, so the network-reachable, unauthenticated case should be treated as the worst case until Microsoft confirms the details.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Sharepoint Server

Research and translation in progress – available shortly.

Windows Media Foundation: Heap-based buffer overflow enables code execution

A heap-based buffer overflow in the Microsoft Windows Media Foundation component allows an unauthorized attacker to execute code over the network. The attack requires that a user interacts with a manipulated file or content, as the CVSS vector indicates UI:R. The official record lists affected builds across Windows 10, Windows 11 and Windows Server 2012 to 2016, including Windows 10 Version 1607 and Windows Server 2016.

Microsoft · Windows Media Foundation

Microsoft Office Outlook: Heap-based buffer overflow enabling code execution

A heap-based buffer overflow in Microsoft Office Outlook, delivered through Microsoft 365 Apps and Office LTSC, allows an unauthorized attacker to execute code over a network. According to the CVSS vector, exploitation requires user interaction (UI:R) and no privileges, and the impact on confidentiality, integrity and availability is rated high (CVSS 8.8). Microsoft rates the CVE below the critical Outlook vulnerabilities of the same October 2026 update batch, and no public exploitation has been reported.

Microsoft · Office Outlook

Office Outlook: Remote code execution via heap-based buffer overflow

Microsoft Office Outlook contains a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network. The attack requires a user to interact, for example by opening a specially crafted file or message, as described by a third-party source. Outlook runs with the rights of the logged-in user, so a successful exploit gives access to that user's mailbox and cached credentials.

Microsoft · Office Outlook

Microsoft Windows: Local privilege escalation in Desktop Window Manager

A heap-based buffer overflow in the Desktop Window Manager (DWM) component of Windows and Windows Server allows an authorized local user to elevate privileges. An attacker needs an existing low-privilege local account, for example after phishing or malware on the machine, and gains higher rights up to full control of the system. The flaw is not remotely exploitable.

Microsoft · Windows