A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver (vhdmp.sys) of Windows allows an authorized local user to elevate privileges to SYSTEM. The attacker needs local logon and low privileges, so the risk arises mainly after an initial foothold, for example through phishing or malware. Microsoft rates the issue Important with a CVSS 3.1 score of 7.0; no public exploit and no confirmed exploitation are known.
Microsoft · Windows
Microsoft Windows, including Windows 10 Version 1809 and Windows Server 2019, contains a use-after-free flaw in the Broadcast DVR User Service. A locally authenticated attacker with low privileges can exploit it to gain higher privileges on the system. The attack requires local access and a high-complexity condition, so the flaw is not directly reachable from the internet but matters after an attacker has a foothold, for example through a phished user or malware.
Microsoft · Windows
The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows an authorized local attacker to elevate privileges. The CVSS base score is 7.8 (High), and the CISA SSVC assessment rates the technical impact as total. Exploitation requires local access with low privileges and no user interaction, so the risk comes from compromised standard accounts or malicious local users, not from the internet.
Microsoft · Windows
The Blazor WebAssembly debugger, shipped in the Microsoft.AspNetCore.Components.WebAssembly.Server and .DevServer NuGet packages, does not safely handle debugger expressions. When a developer evaluates an expression that contains attacker-controlled data, the value can escape a generated string literal and execute arbitrary code on the developer's machine. The attacker needs no privileges, but exploitation requires user interaction. The flaw affects a development-time tool, so production servers are generally out of scope.
Microsoft · Blazor WebAssembly debugger
A type confusion flaw (CWE-843) in .NET Framework and Visual Studio allows an attacker to elevate privileges over the network. According to the research notes, the Visual Studio component is Microsoft.DiaSymReader.Native, a debugging-symbol library. The CVSS vector requires no privileges but user interaction, so an attacker would typically need a user to open or run crafted content, for example via phishing or a malicious file. Local privilege escalation is most useful to an attacker who already has a foothold on the system.
Microsoft · .NET Framework and Visual Studio
An out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. The attacker needs a user to open or preview a crafted document, for example one received by email or downloaded from the internet. The CVSS score is 6.5 (medium) with impact on confidentiality only.
Microsoft · 365 Apps
An unauthenticated attacker who obtains a valid proof token for a targeted user can modify the token and submit it to an affected on-premises SharePoint Server Subscription Edition. Successful exploitation can allow the attacker to authenticate as the targeted user and access or modify content available to that account. The attack complexity is high and no user interaction is required. Exploitation is not known, and no public proof of concept has been found.
Microsoft · SharePoint Server
Incorrect authorization in Microsoft SharePoint Server Subscription Edition allows an authorized attacker to read information they should not see. The attack can be carried out over the network and requires a valid low-privilege account, but no user interaction. The impact is limited to confidentiality.
Microsoft · SharePoint Server Subscription Edition
Research and translation in progress – available shortly.
Microsoft SharePoint Server Subscription Edition (on-premises) contains a code injection flaw (CWE-94) that lets an authorized attacker elevate privileges over the network. The attacker needs a valid low-privilege account, and no user interaction is required. CVSS 8.8 (High); at the time of review, no confirmed exploitation and no public exploit were found.
Microsoft · SharePoint Server
An incorrect authorization check in Microsoft Office SharePoint allows an authenticated attacker to elevate privileges over the network. The CVSS vector requires only a low-privilege account and no user interaction. The risk is highest for internet-facing or broadly accessible SharePoint servers.
Microsoft · SharePoint Server
Missing authorization in Microsoft Office SharePoint Server Subscription Edition allows an attacker to elevate privileges over the network. Microsoft's own description assumes an authorized attacker, while the CVSS vector (PR:L) assumes low privileges are required. Third-party reports describe it as possibly reachable without a login, which has not yet been confirmed by Microsoft. Exposure is mainly a concern for farms reachable from the internet or untrusted networks.
Microsoft · SharePoint Server Subscription Edition
Microsoft Office SharePoint Server Subscription Edition (on-premises) contains an improper access control flaw that allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privilege account, but no user interaction is required. CVSS 8.8 (High), with high impact on confidentiality, integrity and availability.
Microsoft · SharePoint Server Subscription Edition
Research and translation in progress – available shortly.
A heap-based buffer overflow in Microsoft Office OneNote, part of Microsoft 365 Apps, can be exploited by an unauthorized attacker over a network. The attacker can execute code on the affected system (CVSS 8.8, high). Exploitation requires that a user takes an action, such as opening a crafted OneNote file received by email or as an attachment.
Microsoft · Microsoft Office OneNote
Microsoft Office Visio contains a heap-based buffer overflow that allows remote code execution. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 are affected. An unauthorized attacker can execute code over the network, but only if a user opens a specially crafted file, for example one received by email or downloaded from the internet. Microsoft released fixes on October 13, 2026.
Microsoft · Office Visio
Microsoft Office Visio contains a heap-based buffer overflow that allows code execution over a network. An attacker could run code on the victim's computer, which CVSS rates as a total impact on confidentiality, integrity and availability. The attack requires that a user opens a crafted file, so email attachments and shared files are the main paths.
Microsoft · Office Visio
Microsoft Office Access contains a heap-based buffer overflow (CWE-122) that allows remote code execution. An unauthorized attacker can execute code on a victim's system if the user interacts with crafted content, such as opening a file. Microsoft rates the CVSS base score at 8.8. Microsoft has released security updates, and no exploitation has been reported.
Microsoft · Office Access
A heap-based buffer overflow in Microsoft Office Access allows remote code execution. A user must open a specially crafted file, for example one received by email or downloaded, before an attacker can run code. No authentication is needed, and Microsoft does not report public disclosure of the vulnerability.
Microsoft · 365 Apps
Missing authorization in Microsoft Visual Studio Code allows a local, unauthenticated attacker to bypass a security feature. The specific feature is not described in the sources reviewed. Exploitation requires local access and some user interaction (UI:R), so the flaw is not directly exposed to the internet. The CVSS 3.1 base score is 7.8 (High) with high impact on confidentiality, integrity and availability.
Microsoft · Visual Studio Code
Incorrect authorization in Microsoft Visual Studio Code allows a local attacker to bypass a security feature. The attack requires high attack complexity, user interaction and no privileges. The CVSS vector rates the impact on confidentiality, integrity and availability as high (base score 7.0).
Microsoft · Visual Studio Code
A security feature bypass in Visual Studio Code, caused by improper resolution of path equivalence (CWE-41), allows an attacker to bypass a protection mechanism locally. Per a secondary source, the bypass affects Workspace Trust, which could let untrusted workspaces run code without consent. Exploitation requires local access, high attack complexity and user interaction, such as a developer opening a malicious or untrusted repository.
Microsoft · Visual Studio Code
A path traversal weakness in Visual Studio Code allows an authorized attacker to read information over the network. According to the upstream description, remote webview resource paths were not consistently normalized before being checked against the allowed resource roots. The attacker needs a valid low-privilege account or local session and user interaction, such as opening crafted content, and the impact is limited to confidentiality (CVSS 3.1: 6.8, medium).
Microsoft · Visual Studio Code
A heap-based buffer overflow in the Windows Resilient File System (ReFS) allows an authorized local attacker to execute code. The attacker first needs a valid low-privileged account or foothold on the system, and no user interaction is required. The CNA rates the impact as high for confidentiality, integrity and availability. The MSRC title says 'Remote Code Execution', but the description and CVSS vector describe a local attack, and this entry follows the description.
Microsoft · Windows
A path traversal flaw (CWE-22) in Microsoft Dynamics Business Central allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privilege account but no user interaction. A secondary source lists the issue for Dynamics NAV 2018, so on-premises installations are the main concern.
Microsoft · Dynamics 365 Business Central
