New vulnerabilities – clearly explained

Microsoft Office Excel: Remote Code Execution via out-of-bounds read

Microsoft Office Excel contains an out-of-bounds read vulnerability (CWE-125) that allows remote code execution. An unauthenticated attacker can send a crafted Excel file over the network, and the attack requires that a user opens or previews the file. Microsoft and NVD rate it CVSS 8.8 (High). CISA SSVC data reports no known exploitation.

Microsoft · Office Excel

Microsoft Windows Win32k: Use after free allows local privilege escalation

A use-after-free vulnerability in the Win32k kernel subsystem of Windows allows an authorized local attacker to elevate privileges to a higher level. The attacker needs local access and low privileges, and exploitation is rated as high complexity. Microsoft rates the flaw as Important with a CVSS 3.1 base score of 7.0, and no exploitation has been observed.

Microsoft · Windows

Windows: Use after free in Virtual Hard Disk (VHD) Miniport Driver

A use-after-free flaw (CWE-416) in the Virtual Hard Disk (VHD) Miniport Driver of Windows allows an authorized local attacker to elevate privileges. The attacker needs valid low-privilege access to the system, and the attack complexity is rated high. A successful attack could give the attacker higher rights, up to SYSTEM, on the affected machine.

Microsoft · Windows

SharePoint Server: Server-side request forgery allows privilege elevation

A server-side request forgery (CWE-918) in on-premises Microsoft SharePoint Server Subscription Edition allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privileged SharePoint account and specific conditions apply (AC:H). Microsoft rates the issue Important with a CVSS 3.1 base score of 7.5. It is not known to be exploited in the wild.

Microsoft · SharePoint Server

Windows Server: Use-after-free in DHCP client allows remote code execution

A use-after-free vulnerability in the Windows DHCP Client of Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 allows an unauthorized attacker to execute code. The attack requires the attacker to be on the same adjacent network segment as the server and needs no privileges or user interaction. Successful exploitation can lead to full compromise of confidentiality, integrity and availability of the affected server.

Microsoft · Windows Server

Microsoft Windows 10 1607: Use-after-free in Win32k kernel allows privilege escalation

A use-after-free flaw in the Windows Win32k kernel subsystem allows a local user with a valid low-privilege account to elevate privileges to a higher level. The CVSS base score is 7.0 (HIGH), and the attack complexity is high. The vulnerability is not reachable from the internet and requires local access.

Microsoft · Windows 10 1607

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows HTTP.sys: Out-of-bounds read enables local code execution

An out-of-bounds read in the Windows HTTP.sys kernel driver allows an authorized local attacker to execute code. The attacker needs local access and low privileges, and no user interaction is required. Microsoft's advisory title mentions remote code execution, but the CVE description and CVSS vector (AV:L) describe a local attack, so verify the attack path on MSRC. Microsoft has published fixes for affected builds.

Microsoft · Windows

Microsoft SharePoint Server: Elevation of privilege via incorrect authorization

Incorrect authorization in Microsoft Office SharePoint Server Subscription Edition allows an authenticated attacker to elevate privileges over the network. The CVSS base score is 8.8 (High), and the CVSS vector indicates high impact on confidentiality, integrity and availability. An attacker needs a valid user account with low privileges; no user interaction is required. A compromised SharePoint server can serve as a pivot point into internal systems.

Microsoft · SharePoint Server

Windows AFD for WinSock: Privilege escalation via type confusion

Microsoft has fixed a local elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD), a kernel-mode networking component present on Windows systems. The flaw is a type confusion (CWE-843) that lets an authorized local user with low privileges access memory as an incorrect type and gain higher privileges. Exploitation requires an existing local logon and is not possible remotely. Microsoft reports no public disclosure and no known exploitation.

Microsoft · Windows Ancillary Function Driver for WinSock

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Kernel: Use-after-free allows local privilege escalation

A use-after-free weakness in the Windows Kernel affects Windows 11 version 23H2 and Windows Server 2025, including Server Core installations. An attacker who already has a low-privilege local account can exploit it to gain SYSTEM privileges. Remote exploitation is not described, and the attack complexity is high.

Microsoft · Windows

Microsoft Office Outlook: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code on the affected system. According to Microsoft's CVE record, the attack requires no privileges and no user interaction, and Microsoft lists the Reading Pane as the trigger vector, so a crafted email may be sufficient. The CVSS base score is 9.8 (Critical). Microsoft has released security updates; no exploitation has been reported so far.

Microsoft · Office Outlook

Microsoft Windows Kerberos: Use-after-free leads to local privilege escalation

A use-after-free memory flaw in the Windows Kerberos implementation allows an authorized local user to elevate privileges. An attacker needs an existing low-privilege account and local access, so remote exploitation without prior access is not expected. The CNA record lists many Windows 10, 11 and Server builds, not only Windows 10 1607. Microsoft has published fixes in the October 2026 Patch Tuesday.

Microsoft · Windows Kerberos

Microsoft Windows Storage Spaces Controller: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow in the Windows Storage Spaces Controller allows an authenticated local user to elevate privileges on the affected system. The vulnerability is rated High (CVSS 3.1 7.8) and requires local access and a low-privilege account. An attacker would typically need a foothold first, such as a phished or stolen account or malware, before exploiting it.

Microsoft · Windows Storage Spaces Controller

Microsoft Windows AFD for WinSock: Use-after-free privilege escalation

A use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD), the kernel driver behind Winsock network I/O, allows local privilege escalation. An attacker with low privileges and an existing foothold on the system can gain higher privileges, which can lead to full compromise of the host. Attack complexity is high and no user interaction is required. The flaw is not remotely exploitable on its own.

Microsoft · Windows 10 Version 1607

Windows 10 1607: Use-after-free in Win32k allows local privilege escalation

A use-after-free flaw in the Win32k kernel subsystem of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker who already has a low-privileged account on the system can gain higher privileges, which the CVSS vector rates as high impact to confidentiality, integrity and availability. The attack requires high complexity and local access.

Microsoft · Windows 10 Version 1607

Microsoft Windows 11 24h2

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows: Heap-based buffer overflow in Common Log File System driver

A heap-based buffer overflow in the Windows Common Log File System (CLFS) driver allows an authorized local attacker to elevate privileges. The attacker needs an existing low-privileged foothold, such as a phishing payload or a stolen low-privilege account, and can then gain SYSTEM rights. Internet exposure is not required, and user interaction is not needed. Exploitation is not known and no public proof of concept was found.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Audio Service: Use after free allows local privilege escalation

A use-after-free flaw (CWE-416) in the Windows Audio Service allows an attacker with local access to elevate privileges. The Audio Service is present and running by default on Windows client and server systems unless audio functionality has been explicitly disabled. Exploitation requires an existing low-privilege foothold on the system and a high attack complexity, and the impact on confidentiality, integrity and availability is high if exploited.

Microsoft · Windows Audio Service

Microsoft AD DS: Remote code execution due to incorrect authorization

Incorrect authorization in Active Directory Domain Services (AD DS) allows an unauthenticated attacker to execute code on an affected server over the network. According to Microsoft's vector, no privileges or user interaction are required, but the attack complexity is high. Because AD DS runs on domain controllers, a successful attack could compromise the whole Windows domain.

Microsoft · Windows Active Directory Domain Services

Windows: Local elevation of privilege in Desktop Window Manager

A local elevation of privilege vulnerability (CVE-2026-70228, CWE-125 out-of-bounds read) exists in the Desktop Window Manager component of Windows 10 1809 and other supported Windows versions and Windows Server releases. An attacker who already has a low-privileged logon on the system can exploit it to gain higher privileges, potentially up to SYSTEM. It is not remotely exploitable and requires no user interaction. Microsoft has released fixes.

Microsoft · Windows

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.