A out-of-bounds read in the Windows Text Shaping component affects several Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607 and Windows Server 2016. An unauthenticated attacker who can get a user to open crafted content, such as a document, file or web page, may execute code remotely. The CVSS 3.1 base score is 8.8 (High) and the vector requires user interaction, while Microsoft rates the flaw Critical.
Microsoft · Windows
Research and translation in progress – available shortly.
The Windows VHD miniport driver, which handles virtual hard disk images, contains a use-after-free flaw (CWE-416) that allows an authorized local user to elevate privileges. An attacker needs a low-privileged account on the system and no user interaction, but could then gain high impact on confidentiality, integrity and availability. The flaw is not directly reachable from the internet and matters mainly once an attacker already has a foothold, for example through phishing or a compromised account.
Microsoft · Windows
A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability. Exploitation requires local access with low privileges, for example through a user or malware already on the system, or through mounting untrusted optical or removable media.
Microsoft · Windows 10 1607
A path equivalence flaw (CWE-41, CWE-22) in the WebDAV component of Windows 10 Version 1607 allows an authorized attacker on the network to elevate privileges. The CVSS base score is 8.8 (HIGH). The attacker needs valid low-privilege access to the system, and the attack complexity is low.
Microsoft · Windows 10
A type confusion flaw in the Windows StateRepository API allows an authorized local user to elevate their privileges. The attacker needs valid local credentials and can then gain higher privileges on the affected system, with a high impact on confidentiality, integrity and availability. CISA SSVC rates the technical impact as total, but exploitation is not automatable and no active exploitation is known.
Microsoft · Windows
A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs a low-privilege account on the affected system, so the flaw is not directly reachable from the internet. Successful exploitation could give the attacker full control over the system (CVSS 3.1 7.8, high).
Microsoft · Windows
A use-after-free vulnerability (CWE-416) in Windows Hyper-V allows an authenticated, low-privileged user to execute code locally. According to Action1, an attacker running code inside a guest VM can affect the Hyper-V host, which could impact all VMs on that host. Exploitation requires an existing foothold inside a guest VM and is not directly reachable from the internet.
Microsoft · Windows Hyper-V
A use-after-free flaw (CWE-416, with a related race condition weakness CWE-362) in the Windows Virtualization-Based Security (VBS) Enclave allows a local attacker to elevate privileges. The attacker must already be able to log on to the system, so the risk is mainly on shared or multi-user machines or where an attacker already has a foothold. NVD and Talos rate the CVSS base score 7.0 (HIGH); VulDB rates it 8.8.
Microsoft · Windows 10 1607
Windows Text Shaping, the OS component that converts characters into glyphs for rendering, contains a heap-based buffer overflow. A remote, unauthenticated attacker without user interaction may be able to execute code, as rated CVSS 9.8 (Critical). The sources do not name the network-facing service or file format that reaches the flaw, so exposure cannot be judged from the vector alone.
Microsoft · Windows
A heap-based buffer overflow in the Microsoft Graphics Component of Windows 11 version 26H1 allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged account or code running on the device, and exploitation is rated as high complexity. If exploited, the impact on confidentiality, integrity and availability is rated high. Other Windows 11 versions are not in the listed affected range.
Microsoft · Windows 11 26H1
A use-after-free flaw in the Win32 kernel subsystem of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker first needs a foothold on the host, for example through a phished user or malware, and exploitation is rated highly complex. Successful exploitation can give full control over the affected system. The flaw does not provide remote access.
Microsoft · Windows 10 1607
A race condition (CWE-362) in the Windows kernel allows an authorized local user to elevate privileges to a higher level, potentially up to full control of the system. An attacker needs a local foothold and a low-privileged account, the attack is complex, and no user interaction is required. The CVSS 3.1 base score is 7.0 (High), and the flaw is not remotely exploitable.
Microsoft · Windows
The Windows Portable Device (WPD) MTP driver, which handles phones, cameras and similar USB-connected devices, contains a heap-based buffer overflow (CWE-122). An attacker with physical access to a device can exploit it to elevate privileges, for example from a standard user to administrator. Exploitation requires no privileges and no user interaction, but the attacker must have physical access to the machine.
Microsoft · Windows Portable Device MTP Driver
A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged logon on the system first, for example through a phished user or malware running as a standard user. The flaw is not reachable from the internet. CVSS 3.1 base score is 7.8 (High).
Microsoft · Windows
Improper link resolution before file access (CWE-59) in Windows Subsystem for Linux (WSL2) allows a local user with low privileges to elevate privileges. The CNA record reports a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity and availability, and elevation to SYSTEM is reported. An attacker needs an existing local account on the affected machine and no user interaction; the flaw is not reachable from the internet. Shared PCs and developer workstations with WSL are most exposed.
Microsoft · Windows Subsystem for Linux
A type confusion flaw in the Windows RPC Runtime component affects multiple Windows client and server editions, including Windows 10 1607. An unauthenticated remote attacker can execute code over the network if a user interacts with a crafted request or resource. The CVSS base score is 8.8 (High). Microsoft's CNA record gives no exploitation status beyond the CISA SSVC assessment (exploitation: none, automatable: no, technical impact: total).
Microsoft · Windows
An improper access control flaw in the Windows Container Isolation FS Filter Driver (unionfs.sys) affects several Windows 11 and Windows Server versions. An authenticated local user with low privileges can exploit it to gain higher privileges, potentially up to SYSTEM. Exploitation requires local access and no user interaction.
Microsoft · Windows
A use-after-free vulnerability (CWE-416) in the Microsoft Windows Media Foundation component allows a local attacker with low privileges to elevate their privileges. The attacker first needs local code execution or a low-privileged account. The flaw is not reachable from the internet; the main risk is chaining it with another bug after a phishing or malware foothold, especially on terminal or RDS servers.
Microsoft · Windows Media Foundation
A stack-based buffer overflow in the Microsoft Windows Codecs Library, which decodes media and image formats, can be triggered over the network. An unauthenticated attacker can crash or hang affected Windows systems, causing denial of service. Exploitation requires user interaction, such as opening or previewing a crafted file, and confidentiality and integrity are not affected.
Microsoft · Windows Codecs Library
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows an authorised local user to elevate privileges. The attacker must already have a local, low-privileged foothold on the system. The impact on confidentiality, integrity and availability is rated high if exploited.
Microsoft · Windows
A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows a local user with low privileges to elevate privileges. The attacker must already be able to run code or log on to the affected system, and no user interaction is required. Successful exploitation can lead to full control of the affected host (CVSS 3.1: 7.8, High).
Microsoft · Windows 10 1809
A use-after-free flaw in the Windows Broadcast DVR User Service allows an authorised local user to elevate privileges to a higher level. The attacker needs local access with low privileges and must win a race-type condition (AC:H), so it is a follow-on step after an initial compromise rather than an entry point. The CVSS score is 7.0 (High) per NVD and the CNA, with a total impact on confidentiality, integrity and availability. Microsoft has released fixes in the October 2026 security update.
Microsoft · Windows 11
A use-after-free flaw (CWE-416) in the Windows Graphics Kernel allows an attacker who already has a local, low-privileged account to elevate privileges to a higher level. The attack is local only, not internet-facing, and needs an existing foothold such as a phished or weak account. Windows 10 Version 1607 and Windows Server 2016 are at or near end of support, so this flaw may not be fixed later.
Microsoft · Windows 10 Version 1607
