A heap-based buffer overflow in the Win32k kernel subsystem of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. Exploitation requires local access and low privileges, such as a user account or malware already running on the device. The flaw is not reachable over the network. Microsoft rates exploitation as more likely, but no public exploit code or active exploitation is confirmed.
Microsoft · Windows 10 1607
A heap-based buffer overflow in the Windows OLE component allows an attacker with a local, low-privilege account to elevate privileges. Successful exploitation can lead to full control over the affected system (high confidentiality, integrity and availability impact). The attacker must already have local code execution or a logged-in user account, so this is a follow-on step after an initial compromise.
Microsoft · Windows OLE
A out-of-bounds write in the Windows DHCP Server role allows an unauthorized attacker to execute code over the network. No authentication or user interaction is required, so any host that can send crafted DHCP traffic to the server can attempt the attack. The NVD CVSS vector scores only availability impact (7.5), while the vendor description refers to code execution, so the impact should be treated as potentially code execution.
Microsoft · Windows DHCP Server
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows Update Service of several Windows 10, Windows 11 and Windows Server versions allows an attacker to elevate privileges locally. The attacker needs a valid low-privilege account on the system and must overcome a high attack complexity, but no user interaction is required. The CVSS v3.1 base score is 7.0 (High). CISA SSVC rates exploitation as none.
Microsoft · Windows
Research and translation in progress – available shortly.
A heap-based buffer overflow in the Windows NetBIOS component of Windows 10 Version 1607 allows an authorized local attacker to elevate privileges to SYSTEM level. The attacker needs a low-privileged account or code execution on the machine first; no user interaction is required. The flaw is not remotely exploitable according to the CVSS vector, and no public exploit or known exploitation was reported at the time of publication.
Microsoft · Windows 10 Version 1607
An integer overflow (CWE-190) with a possible heap-based buffer overflow (CWE-122) in Windows PowerShell affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2022 and 2025. An authorized local user with low privileges can execute code with high impact on confidentiality, integrity and availability. The attack requires local access and no user interaction, so the risk is mainly for compromised accounts, malicious insiders or malware already running on a machine. Microsoft's title refers to remote code execution, but the CVSS vector is local (AV:L), so the local vector is authoritative.
Microsoft · Windows PowerShell
Windows SmartScreen, the reputation and phishing filter built into Windows, contains a type confusion flaw (CWE-843). An authorized local user with low privileges can exploit it to elevate privileges on the system. An attacker therefore needs an existing low-privileged account on the affected machine, for example after a phishing or malware infection. No user interaction is required. The CVSS base score is 7.8 (High).
Microsoft · Windows
A SQL injection flaw in Microsoft Configuration Manager (ConfigMgr) allows an authenticated attacker with a low-privileged account to elevate privileges. The attack requires adjacent network access, not internet access, and high attack complexity. ConfigMgr holds privileged control over many endpoints, so a successful attack could affect a large part of the managed environment. The CVSS 3.1 base score is 8.0; NVD analysis was still pending at the time of writing.
Microsoft · Configuration Manager
A heap-based buffer overflow in the Windows Resilient File System (ReFS) allows an authorized local user to elevate privileges. Exploitation requires local access and a valid low-privilege account on the system, so the risk is mainly on multi-user systems and file servers. Microsoft has released fixes for the affected Windows versions.
Microsoft · Windows
A use-after-free flaw in the Windows Work Folders component allows an attacker to elevate privileges on the local system. The attacker needs local access and a valid low-privileged account, and the attack is complex to carry out. The flaw is a post-compromise risk and is not reachable from the internet.
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free flaw in the Windows iSCSI component allows an unauthenticated attacker on the network to execute code. Attack complexity is rated High, and no user interaction or privileges are required. Exposure is mainly a concern for servers with iSCSI roles or connected iSCSI volumes, especially storage and file servers.
Microsoft · Windows iSCSI
Deserialization of untrusted data in .NET allows an unauthenticated remote attacker to execute code. The affected components include the .NET 8, 9, 10 and 11 runtimes, .NET Framework 3.5 and 4.6.2 to 4.8.1, and Visual Studio 2022 17.14 and 2026 18.10. Microsoft rates it CVSS 8.8 (High). Per third-party research, exploitation requires a user to open attacker-supplied content in a WPF application and follow a link in it.
Microsoft · .NET
A missing memory release in the Remote Desktop Gateway service of several Windows client and server versions allows an unauthorized remote attacker to cause a denial of service. No privileges or user interaction are required, and the attack can be carried out over the network. Only availability is affected; confidentiality and integrity are not (CVSS 3.1: 7.5, High). Exploitation is not known, and the vulnerability is not listed in CISA KEV.
Microsoft · Windows Remote Desktop Gateway
A heap-based buffer overflow in the Windows iSCSI component can be triggered over the network. An unauthenticated remote attacker can crash the affected service or host, causing a denial of service. Data confidentiality and integrity are not affected according to the CVSS vector, and no user interaction is required.
Microsoft · Windows
A heap-based buffer overflow in the Windows Subsystem for Linux (WSL) allows an authorized local attacker to elevate privileges. The attacker needs an existing low-privileged account on the system and no user interaction is required. The impact is rated High for confidentiality, integrity and availability (CVSS 3.1 7.8).
Microsoft · Windows Subsystem for Linux
A use-after-free flaw (CWE-416) in Windows Secure Kernel Mode allows an authorized local attacker to elevate privileges. The attacker needs an existing low-privilege account or foothold on the system, so the flaw cannot be reached from outside the network. It matters most after phishing, a malicious application or a compromised user account. NVD lists a CVSS 3.1 base score of 7.0, but this score is unverified; an independent calculation gives 6.4.
Microsoft · Windows
Research and translation in progress – available shortly.
Windows Internet Information Services (IIS) contains a stack-based buffer overflow that allows an unauthenticated attacker to execute code remotely over the network. The CVSS 3.1 base score is 9.8 (Critical), with no privileges or user interaction required. Internet-facing IIS servers are the highest priority, while internal servers remain exposed to attackers who already have network access.
Microsoft · Windows Internet Information Services
A use-after-free vulnerability (CWE-416) in Windows Hyper-V allows an authorized local user to elevate privileges. Exploitation requires local access and low privileges, and no user interaction. The CVSS 3.1 base score is 7.8 (High), and the risk is greatest on Hyper-V hosts and multi-user systems.
Microsoft · Windows Hyper-V
A use-after-free flaw in the Windows Direct Composition graphics component allows a local attacker with low-privilege access to elevate privileges. Exploitation requires that the attacker can already run code in the user context, for example after phishing or malware. The vulnerability is not remotely exploitable.
Microsoft · Windows
Research and translation in progress – available shortly.
