A broken or risky cryptographic algorithm in Windows Remote Desktop (RDP) allows an unauthorized attacker to bypass a security feature over the network. The attack complexity is high and user interaction is required, but no privileges are needed. A successful attacker could affect confidentiality and integrity, while availability is not affected. Exposure is highest where RDP is reachable from the internet or through weakly protected VPNs.
Microsoft · Windows Remote Desktop
Microsoft .NET runtimes and .NET Framework contain an uncontrolled recursion flaw in the processing of XML digital signatures and XML encryption (System.Security.Cryptography.Xml and System.Private.Xml). An unauthenticated attacker on the network can send a deeply nested or recursive XML document and crash the process, causing a denial of service. Exposure is highest for internet-facing applications that accept XML signatures or encrypted XML from external parties. No loss of confidentiality or integrity is expected.
Microsoft · .NET
Microsoft has fixed a vulnerability in the UEFI firmware component of Windows. An authorized local attacker with a low-privileged account can bypass the UEFI Secure Boot security feature. No user interaction is required. Because UEFI runs before the operating system, a successful bypass can undermine boot-time protections such as BitLocker's trusted boot chain. No in-the-wild exploitation or public proof of concept is known.
Microsoft · Windows
A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver of Windows allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account and local access, and exploitation is rated as high complexity. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability (CVSS 3.1: 7.0, High).
Microsoft · Windows
A flaw in Windows Virtualization-Based Security (VBS) Enclave allows a locally authenticated attacker with low privileges to elevate privileges. The attacker can leak data from the target enclave or run code in its context. The attack is local only and requires an initial foothold on the system, so it is mainly a post-compromise risk. NVD rates it CVSS 8.8 (High).
Microsoft · Windows 10 1809
A use-after-free vulnerability (CWE-416) in Windows Installer, the component that installs, repairs and removes MSI packages, affects Windows 10 Version 1607 and Windows Server 2016. An authorized local attacker can exploit it to elevate privileges, potentially to SYSTEM. Exploitation requires winning a race condition and a local logon or an existing foothold on the system, so the vulnerability is not remotely exploitable. Microsoft marks it as not exploited at release.
Microsoft · Windows 10 Version 1607
A heap-based buffer overflow in the Microsoft PostScript Printer Driver of Windows allows code execution over the network. The attacker needs valid low-privilege access, but no user interaction is required (CVSS 3.1 8.8). Action1 describes the attack as a crafted network request sent to an affected server, so print servers are most at risk.
Microsoft · Windows PostScript Printer Driver
Research and translation in progress – available shortly.
A use-after-free flaw in the Windows Update Delivery Optimization component allows a local, authenticated user to elevate privileges. The attack complexity is high and no network access is needed, so the main risk comes from standard users, compromised accounts or malicious insiders on systems with local logons. The vendor rates the impact as total on confidentiality, integrity and availability.
Microsoft · Windows
A use-after-free vulnerability in the Software Protection Platform (SPP) component of Windows allows an authorized local user to elevate privileges. The attack requires a local account with low privileges and is harder to carry out reliably (high attack complexity). An attacker who already has a foothold on a multi-user system could gain full control of the host.
Microsoft · Windows
Windows SmartScreen, the Windows feature that blocks phishing sites and untrusted downloads, contains an improper resolution of path equivalence flaw (CWE-41). A remote, unauthenticated attacker can bypass this security feature over the network, but user interaction is required, for example by opening a crafted file or link. The CVSS vector rates the impact on confidentiality, integrity and availability as high.
Microsoft · Windows SmartScreen
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privilege account on the system and must run code locally, and attack complexity is high. CISA SSVC rates technical impact as total, but exploitation is rated none and the vulnerability is not automatable.
Microsoft · Windows
Windows Message Queuing contains a use-after-free flaw (CWE-416) that allows remote code execution. According to Microsoft, an unauthorized attacker can execute code over the network without privileges or user interaction, but attack complexity is rated high. Microsoft does not mark the flaw as publicly disclosed or exploited, and no public proof of concept was found. The affected list includes many Windows 10, Windows 11 and Windows Server builds, including Windows Server 2012, 2012 R2 and 2016, and the fixes were released in October 2026.
Microsoft · Windows
A use-after-free flaw (CWE-416) in the Remote Desktop Client of several Windows 10, Windows 11 and Windows Server releases allows remote code execution. The flaw is in the client, not the RDP server. An attacker needs no privileges, but the victim must take an action, such as connecting to a malicious or compromised RDP endpoint. CVSS 3.1 base score is 8.8 (High).
Microsoft · Remote Desktop Client
A out-of-bounds write in the Microsoft Windows PDF component allows remote code execution over a network. Microsoft rates it critical (CVSS 3.1 base score 8.1). Exploitation requires a high attack complexity, and no user privileges are needed, but the victim may need to open a crafted PDF. The sources report no known exploitation or public proof-of-concept code at the time of publication.
Microsoft · Windows
An integer overflow or wraparound in the Microsoft Windows Codecs Library allows an unauthenticated attacker to execute code over a network. The affected component is the HEVC Video Extensions, which decode H.265 video. Exploitation requires user interaction, for example opening a crafted media file, according to the CVSS vector UI:R.
Microsoft · HEVC Video Extensions
A heap-based buffer overflow in the Windows Hyper-V hypervisor role allows an authenticated attacker to elevate privileges locally. According to the research notes, an attacker with admin rights inside a guest VM could gain higher privileges on the host, which is a guest-to-host escape. Exploitation requires high privileges, user interaction and local access, so the risk is mainly insider misuse or lateral movement from a compromised VM.
Microsoft · Windows Hyper-V
Microsoft .NET Framework contains an untrusted search path weakness (CWE-426) that allows an authenticated local attacker to bypass a security feature. According to the sources, the bypass affects Windows Defender Application Control (WDAC), so an attacker could load a crafted .NET assembly into a protected process and run code there without user interaction. The attack requires local access and a low-privileged account, typically gained through a phished user or a compromised workstation.
Microsoft · .NET Framework
A time-of-check time-of-use (TOCTOU) race condition in the Windows Modern Device Management (MDM) component allows an authorized local user to elevate privileges. The affected range covers supported Windows 10, Windows 11 and Windows Server builds, including Windows 10 version 1809 and Windows Server 2019. An attacker needs a local, low-privileged account and must win a timing race, which is hard to exploit reliably. A successful attack would give full control over confidentiality, integrity and availability of the system.
Microsoft · Windows
A use-after-free flaw (CWE-416) in the Microsoft Windows Search Component allows an authorized local attacker to elevate privileges. The attacker needs a local account with low privileges and no user interaction is required. The flaw is not remotely exploitable; the risk is highest on multi-user systems such as terminal or file servers.
Microsoft · Windows Search Component
The Windows Backup Engine in Windows 10 Version 21H2 contains an improper link resolution flaw before file access (CWE-59, 'link following'). An authorized local user with a low-privileged account can exploit it to elevate privileges on the affected machine. Exploitation requires local access and a high attack complexity; the flaw is not reachable from the internet.
Microsoft · Windows 10
A use-after-free vulnerability (CWE-416) in the Windows Autopilot component of Windows 11 allows an authorized local user to elevate privileges. An attacker needs low-privileged local access, such as a standard user session or user-level malware, and the attack complexity is high. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected endpoint. No exploitation in the wild is confirmed in the sources.
Microsoft · Windows 11
A flaw classified as CWE-763 (release of invalid pointer or reference) in the Windows Modern Device Management (MDM) component of Windows Server 2022 allows an authorized attacker to elevate privileges locally. The attack requires a low-privileged account on the system and is not remotely exploitable by itself. Successful exploitation could grant an attacker full control (SYSTEM level) over the affected host.
Microsoft · Windows Server 2022
A double free in the Windows Kerberos authentication component allows a local attacker to elevate privileges. The attacker needs a valid, low-privileged local account, so the flaw is not directly reachable from the internet. Once an attacker has a foothold on a domain-joined host, such as through a phished user or a compromised service account, they can gain higher privileges on that system. The CVSS base score is 7.0 (High).
Microsoft · Windows Kerberos
