New vulnerabilities – clearly explained

Microsoft Windows: Use-after-free in Broadcast DVR User Service allows privilege escalation

A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows an authorized local attacker to elevate privileges. The attacker needs a local account or an existing foothold on the host, and the attack complexity is rated high. The CVSS base score is 7 (High), and CISA SSVC rates the technical impact as total.

Microsoft · Windows

Windows Server 2019: Denial of service in Windows Failover Cluster

Windows Failover Cluster on Windows Server 2019 (including Server Core) contains an integer underflow that allows an unauthorized attacker to cause a denial of service over the network. The CVSS vector indicates low attack complexity and no privileges or user interaction required, with impact on availability only. Exposure is mainly internal, since cluster communication should not be reachable from the internet.

Microsoft · Windows Server 2019

Windows Storage: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow in the Windows Storage component allows an authorized local attacker to elevate privileges. Successful exploitation could lead to high impact on confidentiality, integrity and availability of the affected system. The attacker needs a low-privilege local account and the attack complexity is high, so the flaw is not directly reachable from the internet.

Microsoft · Windows Storage

Windows Storage: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow (CWE-122) in the Windows Storage component allows an authorized local attacker to elevate privileges. The CNA rates the issue CVSS 3.1 7.0 (High). Exploitation requires a low-privileged account and local code execution or an existing foothold on the system, so the risk mainly arises after an initial compromise.

Microsoft · Windows Storage

Windows Storage Port Driver: Privilege escalation via untrusted pointer dereference

The Windows Storage Port Driver, a kernel-level component for storage devices, contains an untrusted pointer dereference (CWE-822). An unauthorized attacker with physical access to an affected device can use it to elevate privileges, with high impact on confidentiality, integrity and availability. Exploitation requires physical access, so the flaw is not reachable remotely over the network.

Microsoft · Windows Storage Port Driver

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Storage: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Windows Storage component allows an authorized local user to elevate privileges. An attacker needs a low-privilege account or code execution on the machine first, the attack complexity is high and no user interaction is required. Successful exploitation would have a high impact on confidentiality, integrity and availability. The vulnerability cannot be exploited remotely.

Microsoft · Windows

Microsoft Windows NPS: Heap-based buffer overflow enables remote code execution

Network Policy Server (NPS) in affected Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow. An unauthenticated attacker on the network can exploit it to execute code. Microsoft rates the flaw critical (CVSS 9.8), and CISA's SSVC assessment reports no known exploitation and not automatable.

Microsoft · Windows

Windows Media Video Decoder: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in the Windows Media Video Decoder allows an unauthenticated attacker to execute code remotely (CVSS 8.8, CWE-122). User interaction is required, for example by opening or processing crafted media content. Successful exploitation would give the attacker the rights of the logged-in user and could lead to full control of the affected system.

Microsoft · Windows Media Video Decoder

Microsoft Windows QUIC: Remote code execution via use-after-free

A use-after-free flaw in the Microsoft QUIC transport of Windows 11 and Windows Server allows an unauthenticated remote attacker to execute code. The attacker only needs to send crafted network traffic to an affected service that uses QUIC. The CVSS base score is 9.8 (critical), and the risk depends on whether QUIC services (UDP 443) are enabled and reachable from untrusted networks.

Microsoft · Windows

Remote Desktop Gateway Service: Use-after-free allows remote code execution

A use-after-free flaw (CWE-416) in the Remote Desktop Gateway Service of Windows allows an unauthorized attacker to execute code over the network. The CVSS 3.1 base score is 8.1 (High), with network access, no privileges and no user interaction required, but high attack complexity. A gateway exposed to the internet is the main risk, while a server without the RD Gateway role is not affected by this service.

Microsoft · Remote Desktop Gateway Service

Microsoft Windows: Improper privilege management in Group Policy

A flaw in the Windows Group Policy component allows an already authorized local user to elevate their privileges. The CNA classifies it as improper privilege management (CWE-862) with a CVSS 3.1 base score of 7.8. Exploitation requires local access with low privileges, and no user interaction is needed.

Microsoft · Windows

Windows Storage: Stack-based buffer overflow allows local privilege escalation

A stack-based buffer overflow in the Windows Storage component of several Windows 10, Windows 11 and Windows Server versions allows an attacker to elevate privileges locally. The attacker needs a valid local account or an existing foothold on the system. Successful exploitation would affect confidentiality, integrity and availability of the system, but the attack is complex and requires local access.

Microsoft · Windows

Microsoft Windows: Heap-based buffer overflow in Graphics Component

A heap-based buffer overflow in the Microsoft Graphics Component of Windows allows an unauthorized local attacker to execute code. According to the CVSS vector, no privileges are required but user interaction is needed, for example by opening crafted content. Microsoft marks the flaw as not publicly disclosed and not exploited.

Microsoft · Windows

Microsoft Dynamics NAV/Business Central: Remote code execution via deserialization

A deserialization flaw (CWE-502) in Microsoft Dynamics 365 Business Central and Dynamics NAV allows an authenticated attacker to execute code over the network. The attack requires a low-privilege account and no user interaction, and the CVSS score is 8.8 (High). Microsoft's CNA record and the linked vendor references list Dynamics NAV 2017 and NAV 2018 as affected; the affected status of Business Central on-premises and SaaS is unknown.

Microsoft · Dynamics 365 Business Central

Microsoft Office Excel: Remote code execution due to use-after-free

A use-after-free vulnerability (CWE-416) in Microsoft Office Excel, part of Microsoft 365 Apps and Office, allows an unauthorized attacker to execute code over a network. The CVSS vector indicates that user interaction is required, for example opening a crafted file, so email and file sharing are the main exposure. Exploitation is not confirmed and the CVE is not listed in CISA KEV. The CVSS base score is 8.8 (High).

Microsoft · Office Excel

Microsoft Office Excel: Remote code execution via use-after-free

Microsoft Office Excel contains a use-after-free flaw (CWE-416) that allows an unauthorized attacker to execute code over the network. Exploitation requires that a user opens a crafted Excel file, for example one received by email or downloaded from the internet. Successful exploitation would run code in the context of the user, with high impact on confidentiality, integrity and availability (CVSS 8.8). No public proof of concept and no confirmed in-the-wild exploitation are known.

Microsoft · Office Excel

Microsoft Office Excel: Remote Code Execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Excel, included in Microsoft 365 Apps, Office LTSC 2021 and 2024, Office for Mac and Office Online Server, allows an unauthenticated attacker to execute code over a network. Exploitation requires a user to open a specially crafted Excel file, typically delivered by email or download. Code runs with the rights of the user, so systems where Excel runs with elevated privileges are at greater risk.

Microsoft · Office Excel

Microsoft Office Excel: Use-after-free allows remote code execution

A use-after-free flaw (CWE-416) in Microsoft Office Excel allows an attacker to execute code over a network. The attack requires a user to open a crafted Excel file, typically delivered by email or download, and the attacker needs no privileges. CVSS 3.1 base score is 8.8 (High).

Microsoft · Office Excel

Microsoft Azure CycleCloud: OS command injection leads to local code execution

Azure CycleCloud, a cluster-management product for HPC and batch workloads on Azure, contains an OS command injection flaw (CWE-78). An attacker with local access to the CycleCloud host, a valid low-privilege account and a user interaction can execute code on the system. CycleCloud usually holds cloud credentials and can start compute resources, so a successful attack may have a significant impact on confidentiality, integrity and availability.

Microsoft · Azure CycleCloud

Windows Sysinternals Process Monitor: Local privilege escalation

Microsoft Sysinternals Process Monitor contains an untrusted pointer dereference (CWE-822) that allows an authorized local user to elevate privileges. An attacker needs an existing low-privilege account on the affected system and cannot exploit the flaw remotely. Process Monitor is mainly installed on administrator workstations and servers, where a successful attack could lead to high confidentiality and integrity impact.

Microsoft · Windows Sysinternals Process Monitor

Microsoft Windows: Heap overflow in Update Service enables local privilege escalation

A heap-based buffer overflow in the Windows Update Service allows an authorized local user to elevate privileges. Affected are Windows 10 Version 1607, Server 2016 and several other Windows 10, Windows 11 and Windows Server versions according to the CNA record. The attacker needs local access and valid low-privilege credentials, and the attack complexity is high. The impact on confidentiality, integrity and availability is high if the flaw is exploited.

Microsoft · Windows

Microsoft Windows Message Queuing: Remote code execution via use-after-free

Windows Message Queuing (MSMQ) Queue Manager in several supported Windows client and server versions contains a use-after-free flaw (CWE-416). An unauthenticated attacker with network access to the MSMQ service can execute code remotely, and the CVSS base score is 9.8 (critical). MSMQ is not installed by default, so exposure depends on whether it is installed and reachable over the network (by default TCP/1801).

Microsoft · Windows Message Queuing

Microsoft Windows: Heap-based buffer overflow in Client License Service

A heap-based buffer overflow in the Windows Client License Service allows an authorized local user with low privileges to elevate privileges to a higher level on the system. Exploitation requires local access and a valid low-privileged account, so the flaw is not directly reachable from the internet. The CNA and NVD rate it as High (CVSS 7.0), with high impact on confidentiality, integrity and availability.

Microsoft · Windows 10 1809