A buffer over-read in the Windows Graphics Device Interface (GDI) allows a local user with low privileges to elevate their privileges on affected Windows 10 Version 1607 systems. The flaw is not reachable from the network; the attacker needs a valid low-privilege account or existing code execution on the host. Successful exploitation can fully compromise the affected system (CVSS 7.8, CWE-126).
Microsoft · Windows 10 Version 1607
A use-after-free vulnerability (CWE-416) in the Windows iSCSI component allows an unauthenticated attacker to execute code over the network. The CVSS base score is 9.8 (critical), with low attack complexity and no user interaction required. Exposure exists only on Windows systems where iSCSI is listening on a network reachable by the attacker.
Microsoft · Windows iSCSI
A flaw in the Windows Update component allows a local user to influence which files a privileged process loads, because of an untrusted search path (CWE-426). An authorized attacker with a low-privilege local account can elevate privileges to a higher level, with a CVSS base score of 7.8 (High). Exploitation requires local access, so an attacker must first gain a foothold on the machine, for example through a phished user or malware.
Microsoft · Windows
The Desktop Window Manager (DWM), the Windows component that composites window graphics, contains a type confusion flaw (CWE-843). An authorized local user can use it to elevate privileges on the affected host. The attacker needs a valid low-privileged logon, requires no user interaction, and a successful attack would seriously affect confidentiality, integrity and availability of that host. The flaw is not directly reachable from the internet; the risk is highest after an attacker already has a foothold through phishing, stolen credentials or malware.
Microsoft · Windows
Microsoft's Azure CLI and the Azure DevOps CLI Extension contain an origin validation error (CWE-346) that allows an unauthorized attacker on the network to disclose sensitive information. According to the vendor, the exposed data could include a sign-in access token for a user's work account, which could grant access to data and services that user is authorized to use. Exploitation requires a user to take an action (UI:R). No public proof-of-concept or known exploitation exists, and the vendor rates exploitation as less likely.
Microsoft · Azure DevOps CLI Extension
A local out-of-bounds read in the SQLite library shipped with supported Windows versions allows an authorized local user to elevate privileges. An attacker needs local code execution or a low-privileged account on the affected system; remote exploitation without a foothold is not indicated. The main risk is escalation after a compromise, for example through phishing or a hijacked user session.
Microsoft · Windows
A use-after-free vulnerability (CWE-416) with a race condition component (CWE-362) in the Windows Storage component allows an authorized local attacker to elevate privileges. A successful attacker could gain SYSTEM privileges. The attacker needs local code execution or a low-privilege account, and the attack complexity is high. The vulnerability cannot be exploited remotely over the network.
Microsoft · Windows 10
An untrusted pointer dereference in the Windows Certificates component allows an authorized local attacker to elevate privileges. The attacker needs a low-privilege account on the system and no user interaction is required. The vulnerability is not reachable from the internet by itself, but it can be used after an initial foothold, for example via a phished user or malware, to gain SYSTEM rights.
Microsoft · Windows
A use-after-free vulnerability (CWE-416) in the Windows Certificates component allows an authorized local attacker to elevate privileges. Exploitation requires an attacker who already has local access, for example through phishing, stolen credentials or another vulnerability. Microsoft's CNA record lists CVSS 3.1 7.0 (High), but third-party scores vary.
Microsoft · Windows
A race condition in the Windows DHCP Server component allows an unauthenticated attacker to execute code over the network. The attack complexity is rated high, and no user interaction is required. Successful exploitation could affect confidentiality, integrity and availability of the DHCP server.
Microsoft · Windows DHCP Server
A weakness in the Network Device Enrollment Service (NDES), a Windows Server role service used for certificate enrollment of network and mobile devices, allows an unauthenticated attacker to execute code remotely over the network. According to the CVSS vector, no privileges or user interaction are required, but attack complexity is high. Exploitation has not been publicly disclosed, and Microsoft rates exploitation as less likely.
Microsoft · Windows Server (NDES)
A use-after-free vulnerability in the Windows Wired AutoConfig Service allows an authorized local attacker to elevate privileges. The attacker needs valid low-privileged access to the affected Windows host, and no user interaction is required. Successful exploitation can result in full loss of confidentiality, integrity and availability on the host, but the flaw is not directly reachable from the internet.
Microsoft · Windows
A null pointer dereference in the Windows Clipboard Server component allows an authorized local attacker to elevate privileges. The attacker needs local access and an existing low-privilege account, and exploitation is complex (CVSS 3.1 base score 7.0, High). The risk is highest after another compromise, such as phishing or stolen credentials, on multi-user, terminal or RDS hosts.
Microsoft · Windows
A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows remote code execution. An unauthenticated attacker on the same adjacent network segment can trigger it without user interaction, which makes it a risk for lateral movement after an initial foothold on the LAN. The CVSS base score is 7.5 (High), with high attack complexity and total impact on confidentiality, integrity and availability.
Microsoft · Windows Reliable Multicast Transport Driver (RMCAST)
A flaw in Windows Update allows external control of a file name or path. An authorized local user or an attacker with a low-privileged foothold can elevate privileges to SYSTEM on the affected machine. Exploitation requires local access and a valid low-privilege account; no remote attack path is indicated.
Microsoft · Windows Update
A use-after-free vulnerability (CWE-416, CWE-362 race condition) in the Windows Storage component allows an authorized, low-privileged local user to elevate privileges. The attack is hard to carry out and requires no user interaction. A successful attacker could gain full control over confidentiality, integrity and availability of the affected system.
Microsoft · Windows
A use-after-free vulnerability in the Windows Storport Miniport Driver of Windows Server 2025, including Server Core installations, allows code execution over a network. According to the CVE description, an unauthorized attacker can exploit it, but the CVSS vector requires user interaction (UI:R), and the public sources do not describe the required user action or the network path to the vulnerable code. Microsoft has fixed the issue in its October 2026 security update; no exploitation in the wild is known.
Microsoft · Windows Server 2025
A use-after-free flaw in the Windows Storage component allows an attacker who is already authorized on the system to elevate privileges locally. Successful exploitation can lead to high impact on confidentiality, integrity and availability. The attack requires local access and is not possible remotely from the internet.
Microsoft · Windows
A use-after-free vulnerability in the Windows Program Compatibility Assistant Service allows a local, authorized attacker to elevate privileges. The attacker needs low privileges and a foothold on the system, and the attack complexity is high. Successful exploitation can give high impact on confidentiality, integrity and availability, which makes shared and terminal servers especially exposed.
Microsoft · Windows 11
A race condition (CWE-362, CWE-416) in the Windows Credential Manager allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account and local access, and attack complexity is high. The NVD CPE lists only Windows 10 version 1607, while Microsoft's CNA data lists several other Windows client and server versions as affected. The CVSS 3.1 base score is 7.0 (High).
Microsoft · Windows
A flaw in the Windows Update component allows an authorized local attacker to gain higher privileges through an untrusted search path (CWE-426). An attacker must already have a valid local account and be able to run code on the device, so the risk is mainly post-compromise escalation. Microsoft rates the impact as high for confidentiality, integrity and availability (CVSS 3.1: 7.8).
Microsoft · Windows 11 23H2
Research and translation in progress – available shortly.
Windows Update in Windows 11 and Windows Server 2025 contains a command injection flaw (CWE-77). An authorized, low-privileged local user can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. Exploitation requires a valid account on the affected system and no user interaction. Microsoft has released fixes in the October 2026 security updates, and no exploitation is known.
Microsoft · Windows 11
A memory corruption flaw (out-of-bounds write, CWE-787) in the Windows iSCSI component allows an unauthenticated attacker on the network to execute code. No privileges or user interaction are required according to the CVSS vector (9.8, critical). Microsoft rates exploitation as unproven at release, and no public proof of concept was found in the research.
Microsoft · Windows iSCSI
Research and translation in progress – available shortly.
