A flaw in the Windows Overlay Filter component allows an out-of-bounds read (CWE-125) that can be used for local privilege escalation. An attacker needs a valid, low-privileged local user account and can then gain higher privileges with high impact on confidentiality, integrity and availability of the local system. The vulnerability is not reachable directly from the internet.
Microsoft · Windows
Several supported Windows 10, Windows 11 and Windows Server editions contain a buffer over-read in the Windows Overlay Filter component (CWE-126). An attacker with a valid local, low-privileged account can exploit it to gain elevated privileges, which can lead to full control of the affected system. The CVSS 3.1 base score is 7.8 (High). At the time of research, no exploitation in the wild and no public proof of concept were found.
Microsoft · Windows
A heap-based buffer overflow in the Windows Client for NFS component allows an authorized local user to elevate privileges. The CVSS base score is 7.8 (High), and the vector requires local access with low privileges and no user interaction. Remote exploitation is not possible, but multi-user systems, terminal servers and shared machines carry the highest risk.
Microsoft · Windows Client for NFS
A heap-based buffer overflow in the Windows Overlay Filter component affects several supported Windows 10, Windows 11 and Windows Server versions, including Windows 10 21H2. According to the CVE description, an attacker with physical access to a device can execute code. The vector is physical, so there is no internet exposure, but the attack needs no privileges and no user interaction, so brief access to an unattended or stolen device is enough. The CVSS 3.1 base score is 6.8 (MEDIUM), and Microsoft rates the maximum severity as Important.
Microsoft · Windows
A missing authorization check (CWE-862) in the Windows AppX Deployment Extensions component allows a local user with low privileges to elevate their rights on the system. Successful exploitation gives an attacker high impact on confidentiality, integrity and availability, with a changed scope (CVSS 3.1: 8.8). The attacker needs a valid local account or a foothold on the device; the flaw cannot be exploited remotely.
Microsoft · Windows AppX Deployment Extensions
Microsoft SharePoint Server Subscription Edition contains a path traversal flaw (CWE-22) in Microsoft Office SharePoint. An authorized attacker with low privileges on the network can execute code, with a CVSS base score of 8.8. Exposure is highest for internet-facing on-premises farms where users, including external or guest accounts, can authenticate.
Microsoft · SharePoint Server
A buffer over-read (CWE-126) in the Windows Overlay Filter component affects Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022 and 2025. An attacker who already has a local, low-privileged account or foothold can run code with high impact on confidentiality, integrity and availability, without user interaction. The title of the Microsoft record says "Remote Code Execution", but the CVSS vector is local (AV:L), so this is treated as a local issue. Shared and multi-user Windows systems and terminal servers are the most exposed.
Microsoft · Windows
An out-of-bounds read in the Windows Client for NFS component allows an unauthorized attacker to disclose information over the network. Microsoft states that an attacker could potentially read small portions of heap memory. Exploitation requires user interaction, and the flaw affects only systems with the Windows NFS client in use.
Microsoft · Windows
A use-after-free vulnerability in the Windows Storage component allows an authorized local attacker with a low-privileged account to elevate privileges. Successful exploitation requires winning a race condition, and a successful attack would grant SYSTEM rights. The flaw is not remotely exploitable and is mainly relevant as a follow-up step after an attacker has already gained a foothold on a system.
Microsoft · Windows Storage
An authenticated local attacker can exploit an integer overflow or wraparound in the Windows Spaceport.sys kernel driver to elevate privileges. No user interaction is required, and the flaw is not directly reachable from the internet. The risk is mainly for attackers who already have a foothold, such as malware, a compromised standard account or an insider. CVSS 7.8 (High).
Microsoft · Windows
A race condition (CWE-362, also listed as CWE-416 use-after-free) in the Windows Storage component allows an authorized local attacker to elevate privileges. The attack requires a local foothold with low privileges and is not reachable over the network. An attacker who succeeds can gain high impact on confidentiality, integrity and availability, up to SYSTEM level.
Microsoft · Windows
A type confusion flaw (CWE-843) in the Windows Desktop Window Manager allows an authorized local user to elevate privileges. Successful exploitation can seriously affect the confidentiality, integrity and availability of the system. The attacker needs a local foothold with low-privilege access; no user interaction is required and remote exploitation is not possible.
Microsoft · Windows 10 1809
A local privilege escalation flaw in the Windows AI component of Windows 11 and Windows Server 2025 is caused by an uncontrolled search path element (CWE-427). An authorized, low-privileged local user can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability (CVSS 7.8). The attacker needs local access, typically through a compromised standard user account. Microsoft fixed it in the October 2026 security update.
Microsoft · Windows
An out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. According to Microsoft, an attacker could potentially read small portions of heap memory. The attack requires a user to take some action, such as opening a crafted file, and no privileges are needed.
Microsoft · Office Excel (Microsoft 365 Apps, Office LTSC)
Research and translation in progress – available shortly.
A heap-based buffer overflow in Windows Core Messaging allows an authorized local user to elevate privileges. The attack requires a valid low-privilege account on the affected system and cannot be carried out remotely over the network according to the CVSS vector in the NVD record. The impact is rated high for confidentiality, integrity and availability.
Microsoft · Windows Core Messaging
Microsoft Windows NTFS, the file system component of Windows, contains an integer overflow or wraparound (CWE-190) that allows an authorized local user to gain higher privileges on the affected system. The attacker needs local access and a low-privileged account, and no user interaction is required. The vulnerability is not directly internet-exposed, but it makes other compromises, such as a phished user account, more severe.
Microsoft · Windows NTFS
A use-after-free vulnerability in the Windows NTFS file system driver allows an authorized local user with low privileges to elevate their privileges, potentially to SYSTEM. Exploitation requires local access and a valid user account, and the attack complexity is high. Microsoft rates the flaw as Important (CVSS 3.1 base score 7.0), and no public exploit is known.
Microsoft · Windows NTFS
Research and translation in progress – available shortly.
A use-after-free flaw in the Windows TCP/IP networking stack allows an unauthorized attacker to execute code remotely over the network. The attack is rated high complexity and requires no privileges and no user interaction. Systems reachable from untrusted networks are the most exposed.
Microsoft · Windows TCP/IP
A heap-based buffer overflow in Microsoft COM for Windows allows an authorized local attacker to elevate privileges on the affected Windows system. The attacker needs an existing local account with low privileges and cannot exploit the flaw remotely from the internet. If exploited, the attacker could gain full control over the confidentiality, integrity and availability of the host.
Microsoft · COM for Windows
Research and translation in progress – available shortly.
An untrusted pointer dereference in the Windows NTFS file system driver allows an attacker with local access and high privileges to execute code on the affected system. The CVSS score is 6.7 (Medium), with high impact on confidentiality, integrity and availability. Because the attack requires an existing local account with high privileges, the risk is mainly post-compromise, but Windows 10 Version 1607 and Windows Server 2016 are in scope and should be checked first.
Microsoft · Windows NTFS
A heap-based buffer overflow in the Windows Kernel affects Windows 10 version 1809 and Windows Server 2019. An authorized local attacker with a low-privilege account can exploit it to elevate privileges, potentially to SYSTEM. Exploitation requires local access and a valid account but no user interaction, and the flaw is not directly reachable from the internet.
Microsoft · Windows 10 1809
A heap-based buffer overflow in the Windows Imaging Component allows an unauthenticated attacker to execute code over a network. The CVSS score is 9.8 because no privileges or user interaction are required. Microsoft rates the flaw as not publicly disclosed, not exploited, and less likely to be exploited. Windows 10 Version 1607 and Windows Server 2016 are the highest-risk systems because they reach end of support on October 13, 2026.
Microsoft · Windows Imaging Component
