New vulnerabilities – clearly explained

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Windows Program Compatibility Assistant Service: Elevation of privilege via heap overflow

The Windows Program Compatibility Assistant (PCA) Service, a Windows component, is affected in several Windows 10, Windows 11 and Windows Server versions. A local attacker with an existing low-privileged session can exploit a heap-based buffer overflow (CWE-122) to elevate privileges. No internet exposure or user interaction is required, but the attacker must already have a foothold on the system.

Microsoft · Windows

Microsoft Windows 10 1809

Research and translation in progress – available shortly.

Windows NTFS: Elevation of privilege

A local flaw in the Windows NTFS file system driver allows an attacker with a valid local account to elevate privileges. The cause is improper access control (CWE-863). The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. The attack requires local logon and cannot be carried out remotely over the network.

Microsoft · Windows NTFS

Windows PCI Bus Driver: Heap-based buffer overflow allows privilege escalation

A heap-based buffer overflow in the Windows PCI Bus Driver allows a locally authorized attacker to elevate privileges. Successful exploitation would give the attacker kernel-level control of the affected system, with high impact on confidentiality, integrity and availability. The attacker needs an existing local foothold, such as a standard user session or code running as a user.

Microsoft · Windows

Microsoft Windows NTFS: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow (CWE-122) in the Windows NTFS file system allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account on the system and no user interaction is required. The CVSS 3.1 base score is 7.8 (High), and the vulnerability cannot be exploited remotely.

Microsoft · Windows

Microsoft Windows: Elevation of privilege in Windows Kernel-Mode Drivers

An integer overflow or wraparound in the Windows Kernel-Mode Drivers component allows a locally authorized attacker to elevate privileges. An attacker needs a low-privileged account on the affected system and no user interaction is required. The main risk for organisations is that an attacker who already has code running as a normal user can gain SYSTEM rights, especially on shared PCs, terminal servers and multi-user machines.

Microsoft · Windows

Windows: Integer overflow in VBS Enclave allows local privilege escalation

Microsoft Windows contains an integer overflow or wraparound in the Virtualization-Based Security (VBS) Enclave component, classified as CWE-190 and CWE-122. An authenticated local user with low privileges can exploit it to gain higher privileges, with a CVSS 3.1 base score of 8.8 (High). Exploitation requires that the attacker can already run code on the system. No exploitation is known and the vulnerability has not been publicly disclosed.

Microsoft · Windows

Microsoft Windows Kernel: Elevation of privilege via heap-based buffer overflow

A heap-based buffer overflow in the Windows kernel allows an authenticated local user with low privileges to gain SYSTEM rights. The attack requires a prior foothold on the system, for example after phishing or malware, and is not reachable from the internet. The CVSS base score differs between sources: the NVD record shows 7.8, while the Microsoft vector and several third parties show 8.8 with changed scope.

Microsoft · Windows Kernel

Microsoft Windows Client License Service: Elevation of privilege via use-after-free

A use-after-free weakness (CWE-416) in the Windows Client License Service allows an authorized local user with low privileges to elevate their privileges. The affected component is part of Windows 10, Windows 11 and Windows Server. Exploitation requires a local foothold, such as a compromised low-privileged account or malware already running on the system; remote exploitation is not indicated.

Microsoft · Windows Client License Service

Microsoft Windows Search Component: Local privilege escalation via link following

A local elevation of privilege vulnerability (CWE-59, link following) affects the Windows Search Component on several supported and some older Windows 10, Windows 11 and Windows Server versions. An authorized local user with low privileges can abuse improper link resolution before file access to gain higher privileges, with a CVSS 3.1 base score of 7.8. Remote attackers without a local account cannot use it directly. Microsoft rates it Important, and the risk mainly applies after an attacker has already gained a foothold on a system.

Microsoft · Windows Search Component

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows BitLocker: Remote code execution via heap buffer overflow

A heap-based buffer overflow in Windows BitLocker allows an unauthenticated attacker to execute code over the network. The CNA record lists affected builds of Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022 and 2025. Microsoft rates the CVSS base score as 9.8 (Critical) and lists the maximum severity as Important; the attack path and triggering service are not described in the sources.

Microsoft · Windows BitLocker

Microsoft Windows 11 24h2

Research and translation in progress – available shortly.

Windows 10 1607 NTFS: Out-of-bounds read allows local code execution

An out-of-bounds read in the Windows NTFS driver (ntfs.sys) affects Windows 10 Version 1607 and Windows Server 2016 according to the CNA record. An authorized local attacker with low privileges can execute code, which the CVSS vector rates as a full impact on confidentiality, integrity and availability. The attacker needs an existing foothold on the machine, so direct exposure is low, but the flaw is a risk after initial compromise. The CNA title says Remote Code Execution, which conflicts with the local attack vector, so the MSRC entry must be checked.

Microsoft · Windows 10 1607

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows Failover Cluster Virtual Driver: Remote code execution

A double free in the Microsoft Failover Cluster Virtual Driver of Windows 10 and Windows Server allows an unauthenticated remote attacker to execute code by sending a specially crafted packet to an affected service over the network. Failover clustering is normally used internally, so the risk is highest for cluster nodes and any cluster service reachable from the network. Microsoft rates the vulnerability with a CVSS base score of 9.8 (critical), while its own severity label is Important.

Microsoft · Windows

Microsoft Windows 11 23h2

Research and translation in progress – available shortly.

Windows Spaceport.sys: Out-of-bounds read leads to local privilege escalation

An out-of-bounds read in the Windows Spaceport.sys kernel-mode driver allows a local, authorized user to elevate privileges. An attacker needs a low-privileged account on the affected system, so the flaw is not directly reachable from the internet. A successful attack gives full control of the machine. Microsoft has published patches, and exploitation is not known.

Microsoft · Windows

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 1607

Research and translation in progress – available shortly.

Microsoft Windows 10 21h2

Research and translation in progress – available shortly.