Windows Update, the built-in component that installs Windows updates, improperly resolves links (CWE-59) before file access. An authenticated local user can exploit this to elevate privileges to a higher level on the affected system. Exploitation requires a valid local account or existing code execution on the device, so the flaw is mainly a follow-up step after an initial compromise.
Microsoft · Windows Update
Microsoft .NET runtimes, .NET Framework and Visual Studio contain an inefficient algorithm in the XML Encryption component (System.Security.Cryptography.Xml and System.Private.Xml). An unauthenticated attacker on the network can send crafted XML to a service that decrypts XML or verifies signed XML, which can make the service unavailable. The risk exists only where an application processes untrusted XML through this code path. Microsoft published fixes on 13 October 2026.
Microsoft · .NET
An improper verification of a cryptographic signature in the Windows Key Distribution Center (KDC), a Kerberos component, allows an authorized local attacker to elevate privileges. The attacker needs a local low-privilege account or an existing foothold on the system, and the flaw is not remotely exploitable. Microsoft states that a successful attacker could gain SYSTEM privileges, which on a domain controller would mean full domain compromise.
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A heap-based buffer overflow in the libarchive component of Windows allows an unauthorized attacker to execute code over a network. No authentication or user interaction is required according to the CVSS vector, and the CVSS base score is 9.8 (critical). Microsoft lists multiple Windows 10, Windows 11 and Windows Server versions as affected, but the network service that exposes libarchive is not documented in the sources reviewed.
Microsoft · Windows libarchive
A heap-based buffer overflow in the Windows Installer component allows an authorized local user to elevate privileges. The attack requires physical access to the device and an existing low-privileged account. The risk is highest on shared, unattended or guest-accessible Windows systems, and Microsoft has released fixes for all listed Windows and Server versions.
Microsoft · Windows Installer
A heap-based buffer overflow in the Windows iSCSI component allows an unauthorized remote attacker to execute code over the network. No privileges or user interaction are required, and the CVSS base score is 9.8 (Critical). Exposure is mainly a concern for systems with a reachable iSCSI listener, especially Windows Server systems running the iSCSI target role on untrusted networks. Internal iSCSI traffic on a segmented SAN carries lower risk.
Microsoft · Windows iSCSI
A heap-based buffer overflow in the Windows Update component of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker needs local access and low privileges, so this is not a remote entry point. The main risk is a user or malware already running on an affected device, especially on shared or poorly managed endpoints.
Microsoft · Windows 10 Version 1607
A use-after-free vulnerability in the Windows Program Compatibility Assistant (PCA) Service affects supported Windows 10, Windows 11 and Windows Server systems, including Windows 10 Version 1607 and Windows Server 2016. An authorized local user with low privileges can exploit it to elevate privileges. Exploitation requires local access and a high-complexity attack, so the flaw is not directly reachable from the network.
Microsoft · Windows
An out-of-bounds read in the Microsoft Azure Attestation service and the Device Health Attestation service allows an unauthenticated attacker to read memory contents over the network. Only confidentiality is affected; integrity and availability are not. The attacker needs network access to the affected service, and the exact trigger is not public.
Microsoft · Windows Server
An integer overflow or wraparound (CWE-190) in the Windows iSCSI component allows code execution over the network. An unauthorized attacker can exploit this, but the CVSS vector requires user interaction (UI:R). Systems that act as an iSCSI initiator or target are relevant, and the affected versions include Windows 10 Version 1607 and Windows Server 2016.
Microsoft · Windows iSCSI
Research and translation in progress – available shortly.
Windows Installer, the Windows component that installs, repairs and removes MSI packages, contains a heap-based buffer overflow. An authorized local user with a logged-on account can exploit it to gain elevated privileges, potentially up to SYSTEM. The flaw is not reachable from the internet by itself and needs no user interaction.
Microsoft · Windows Installer
An out-of-bounds read in the Microsoft Azure Attestation service and the Device Health Attestation (DHA) service allows an unauthenticated remote attacker to read memory and disclose information. The attack requires no privileges and no user interaction, and the impact is limited to confidentiality. The CVSS score is 7.5, but the CISA SSVC data reports no known exploitation and the EPSS score is low.
Microsoft · Azure Attestation and Device Health Attestation
A use-after-free weakness (CWE-416) in the Windows Enterprise App Management component allows an authorized attacker to elevate privileges over a network. Affected are several supported and unsupported Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607 and Windows Server 2016. The attack is considered highly complex, requires valid low-privileged credentials and user interaction, and has a high impact on confidentiality, integrity and availability (CVSS 7.1).
Microsoft · Windows
A use-after-free vulnerability (CWE-416) in the Windows Error Reporting service allows an authorized local user to elevate privileges to SYSTEM level. Affected are Windows 10 1607, Windows Server 2016 and several other Windows versions. An attacker needs a local account with low privileges and the attack is complex, so it cannot be exploited remotely from the internet. Microsoft rates it as Important with a CVSS score of 7.0.
Microsoft · Windows Error Reporting
A command injection weakness (CWE-77) in Microsoft Visual Studio Code allows an unauthenticated attacker to execute code over the network. The CVSS vector requires user interaction, so an attacker most likely needs a developer to open crafted content such as a file, repository or project. The impact on confidentiality, integrity and availability is rated high, so a successful attack could compromise the workstation and the credentials stored on it.
Microsoft · Visual Studio Code
A heap-based buffer overflow (CWE-122) in Windows Error Reporting affects Windows 10 Version 1607 and Windows Server 2016. According to the CVSS vector, an attacker needs a low-privilege account and some user interaction to elevate privileges. Microsoft lists the flaw as fixed in build 10.0.14393.9512, but sources disagree on whether the attack vector is local or network.
Microsoft · Windows 10 Version 1607
A heap-based buffer overflow in Windows Error Reporting allows an authorized local attacker with low privileges to elevate privileges to SYSTEM. No user interaction is required. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability of the affected system. Microsoft reports no public disclosure, and no active exploitation is known.
Microsoft · Windows 10 1607
The Graphic Fonts component of Microsoft Windows contains a heap-based buffer overflow (CWE-122). A remote attacker who gets a user to process a crafted font file can execute code, with the privileges of the current user. Microsoft rates the flaw CVSS 8.8, which assumes no privileges and required user interaction. Microsoft released fixes in the October 2026 Patch Tuesday.
Microsoft · Windows
A heap-based buffer overflow in the Windows kernel32.dll library allows an attacker who already has a low-privileged local account to elevate privileges. Successful exploitation can give full control of the affected host (CVSS 7.8 High, C:H/I:H/A:H). The flaw is not directly reachable from the internet, but it is a serious second step after phishing or malware, especially on shared PCs, terminal servers and multi-user file servers.
Microsoft · Windows
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Windows Perception Simulation Service (PerceptionSimulationService.exe) contains a use-after-free flaw that allows an authorized local attacker to elevate privileges. The attacker needs local access and low privileges, such as a standard user account; the flaw is not reachable from the network. Microsoft lists Windows 10, Windows 11 and Windows Server 2019 as affected, and the service is mainly tied to mixed reality and emulator tooling. Whether the service is installed or running by default is unknown.
Microsoft · Windows
