New vulnerabilities – clearly explained

Windows: Denial of service in Netlogon due to use-after-free

Windows Netlogon, the component that handles authentication for domain logons, contains a use-after-free flaw (CWE-416). An authenticated attacker on the network can crash or hang the service, which can disrupt domain logons, especially on domain controllers. Microsoft describes the impact as denial of service only.

Microsoft · Windows

Microsoft IIS: Remote code execution via stack-based buffer overflow

Windows Internet Information Services (IIS) contains a stack-based buffer overflow that allows an unauthenticated attacker to execute code remotely over the network. The CVSS 3.1 base score is 9.8 (Critical), with no privileges or user interaction required. Internet-facing IIS servers are the highest priority, while internal servers remain exposed to attackers who already have network access.

Microsoft · Windows Internet Information Services

Microsoft Windows Hyper-V: Use after free allows local privilege escalation

A use-after-free vulnerability (CWE-416) in Windows Hyper-V allows an authorized local user to elevate privileges. Exploitation requires local access and low privileges, and no user interaction. The CVSS 3.1 base score is 7.8 (High), and the risk is greatest on Hyper-V hosts and multi-user systems.

Microsoft · Windows Hyper-V

Windows Direct Composition: Local privilege escalation via use-after-free

A use-after-free flaw in the Windows Direct Composition graphics component allows a local attacker with low-privilege access to elevate privileges. Exploitation requires that the attacker can already run code in the user context, for example after phishing or malware. The vulnerability is not remotely exploitable.

Microsoft · Windows

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Windows 10 Version 1607: Use after free in LSASS enables privilege escalation

A use-after-free vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) on Windows 10 Version 1607 and Windows Server 2016 allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged local account and must already be able to run code on the system. Microsoft fixed the issue in its October 2026 security update. CVSS 7.8 (High).

Microsoft · Windows 10 Version 1607

Microsoft Windows Cryptographic Services: Use-after-free allows remote code execution

A use-after-free flaw (CWE-416) in Windows Cryptographic Services affects several supported and legacy Windows 10, Windows 11 and Windows Server versions. An authorized attacker with low privileges can exploit it over the network to execute code, with high impact on confidentiality, integrity and availability. The attack complexity is high, so exploitation requires specific conditions and a foothold on the target. CISA SSVC data lists no known exploitation.

Microsoft · Windows

Microsoft Windows iSCSI: Use after free leads to remote code execution

A use-after-free flaw in the Windows iSCSI component allows an unauthenticated remote attacker to execute code on an affected system over the network. The CVSS base score is 8.1 (High). Attack complexity is rated High, and no user interaction or privileges are required. Exposure is mainly relevant where iSCSI is enabled and reachable from untrusted networks.

Microsoft · Windows

Windows Remote Desktop Client: Remote code execution through use-after-free

A use-after-free flaw (CWE-416) in the Remote Desktop Client of Windows allows code execution over the network. According to the NVD record, attack complexity is high and user interaction is required. An attacker who succeeds could compromise confidentiality, integrity and availability of the affected system. The sources do not describe the exact trigger scenario, and exposing an RDP server to the internet does not by itself create this flaw.

Microsoft · Windows Remote Desktop Client

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.

Microsoft Windows NTFS: Heap-Based Buffer Overflow Allows Local Privilege Escalation

A heap-based buffer overflow in the Windows NTFS file system component allows an authorized local user to elevate privileges. An attacker who already has a low-privilege account on the system, for example through phishing or stolen credentials, could gain SYSTEM rights. The flaw cannot be exploited remotely. Microsoft has released fixes for the affected builds.

Microsoft · Windows

Microsoft Windows IP Over USB Service: Elevation of privilege

A flaw in the Windows IP Over USB Service, caused by an integer overflow or wraparound (CWE-190), allows a local attacker to elevate privileges. The attacker needs a valid local user account with low privileges, and no user interaction is required. Successful exploitation could give the attacker full control (high impact on confidentiality, integrity and availability) of the affected system.

Microsoft · Windows IP Over USB Service

Microsoft .NET Framework: Remote code execution via out-of-bounds write

A out-of-bounds write flaw in the .NET runtime and .NET Framework, in the WPF (Windows Presentation Foundation) pixel-shader translation, allows an unauthenticated attacker to execute code. Exploitation requires that a user opens a specially crafted file or shader content, so the risk is client-side and user-triggered rather than an internet-facing service flaw. Microsoft rates the impact as total (confidentiality, integrity and availability), and CISA SSVC lists exploitation as none.

Microsoft · .NET Framework

Remote Desktop Client: Use-after-free enables remote code execution

A use-after-free flaw (CWE-416) in the Remote Desktop Client component of Windows allows an unauthorized attacker to execute code over the network. Exploitation requires high attack complexity and user interaction, for example connecting to a malicious or compromised RDP host. Affected are supported Windows 10, Windows 11 and Windows Server versions listed by the CNA, with CVSS 7.5 (High).

Microsoft · Remote Desktop Client

Microsoft Windows Server 2019

Research and translation in progress – available shortly.

Remote Desktop Client: Use after free allows remote code execution

A use-after-free vulnerability (CWE-416) in the Windows Remote Desktop Client allows an unauthorized attacker to execute code over the network. Exploitation requires high attack complexity and user interaction, for example connecting to a malicious or spoofed RDP host. The CVSS 3.1 base score is 7.5 (High). Many Windows 10, Windows 11 and Windows Server versions are affected.

Microsoft · Windows Remote Desktop Client

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Microsoft Windows Remote Desktop Client: Remote code execution via use after free

A use-after-free flaw in the Remote Desktop Client component of Windows allows an unauthorized remote attacker to execute code on the affected system. Exploitation requires user interaction, for example opening a malicious connection or document, and high attack complexity. The main exposure is user workstations and endpoints, not internet-facing servers.

Microsoft · Remote Desktop Client

Windows Remote Desktop Client: Remote code execution via use-after-free

A use-after-free flaw (CWE-416) in the Remote Desktop Client of Microsoft Windows allows an unauthenticated remote attacker to execute code. Per the CVSS vector, the attack is rated high complexity and requires a user action, such as connecting to a malicious RDP host, but no privileges. The CVSS 3.1 base score is 7.5 (High).

Microsoft · Windows

Microsoft Remote Desktop Client: Use-after-free leads to remote code execution

A use-after-free vulnerability (CWE-416) in the Windows Remote Desktop Client allows remote code execution over the network. The CVSS vector requires user interaction and high attack complexity, so an attacker must lure a user into connecting to a malicious RDP endpoint or otherwise triggering the flaw. Windows 10 Version 1607 and Windows Server 2016 are affected and cannot receive the fix on devices without extended security updates, because 1607 LTSB reached end of support on 13 October 2026.

Microsoft · Windows Remote Desktop Client

Remote Desktop Client: Use-after-free allows remote code execution

A use-after-free vulnerability (CWE-416) in the Remote Desktop Client component of Windows allows an unauthorized attacker to execute code over the network. Exploitation is rated high complexity and requires user interaction, for example connecting to or opening attacker-controlled content. The CVSS 3.1 base score is 7.5 (High). Our research found no public proof of concept and no reported exploitation in the wild.

Microsoft · Remote Desktop Client

Microsoft Remote Desktop Client: Use-after-free leads to remote code execution

A use-after-free vulnerability (CWE-416) in the Remote Desktop Client (mstsc) of several Windows 10, 11 and Server versions allows an unauthorized attacker to execute code over the network. The CVSS vector requires high attack complexity and user interaction, for example luring a user into connecting to a malicious RDP host. No privileges are required. As of 2 Nov 2026, no in-the-wild exploitation and no public proof-of-concept code were found.

Microsoft · Remote Desktop Client

Microsoft Windows Remote Desktop Services: Remote code execution via use after free

A use-after-free memory corruption flaw in Windows Remote Desktop Services (the server side of RDP) allows an attacker to execute code over the network. According to the CVSS vector, the attack complexity is high and user interaction is required, which lowers the likelihood of exploitation. The impact is rated high for confidentiality, integrity and availability.

Microsoft · Windows Remote Desktop Services

Microsoft Remote Desktop Client: Remote code execution due to use after free

A use-after-free weakness (CWE-416) in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. Exploitation requires user interaction, for example connecting to a malicious or spoofed RDP host, and the attack complexity is high. CISA SSVC rates exploitation as none, and no public exploit was found in the research.

Microsoft · Remote Desktop Client

Microsoft Remote Desktop Client: Use-after-free allows remote code execution

A use-after-free (CWE-416) in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. According to the CVSS vector (AV:N/AC:H/PR:N/UI:R), exploitation requires high complexity and user interaction, for example a user connecting to an attacker-controlled RDP endpoint. The Microsoft CNA record lists many Windows 10, Windows 11 and Windows Server builds as affected. No exploitation or public proof of concept was found at the time of research.

Microsoft · Remote Desktop Client