Microsoft Patch Tuesday

Microsoft Office Outlook: Remote code execution via use after free

A use-after-free weakness (CWE-416) in Microsoft Office Outlook allows an unauthorized attacker to execute code over the network. According to secondary reports, the attacker would need to send a specially crafted message file and trick the recipient into opening it, so user interaction is required. Exploitation is not indicated for this CVE, and the impact is rated total (CVSS 3.1 base score 8.8).

Microsoft Office · MSRC

Microsoft Office Word: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute code over the network. Exploitation requires a user to interact, typically by opening a crafted document received by email or download. The CVSS 3.1 score is 8.8 (High), and NVD analysis was still pending at publication.

Microsoft Office · MSRC

Microsoft Office: Remote code execution through use-after-free

A use-after-free vulnerability (CWE-416) in Microsoft Office allows an unauthenticated remote attacker to execute code. Exploitation requires a user to interact, typically by opening a malicious document delivered by email or download. The CVSS base score is 8.8 (HIGH), with high impact on confidentiality, integrity and availability.

Microsoft Office · MSRC

Microsoft Office Outlook: Remote code execution due to invalid pointer reference

Microsoft Office Outlook contains a remote code execution vulnerability caused by the release of an invalid pointer or reference (CWE-763). According to the CVE record, an unauthenticated attacker can execute code over a network, provided a user interacts with a crafted message; the CVSS 3.1 base score is 8.8. Microsoft fixed the flaw in the November 2026 Patch Tuesday updates. At the time of research it was not marked as exploited in the wild and no public proof of concept was found.

Microsoft Office · MSRC

Microsoft Windows Raw Image Extension: Heap-based buffer overflow leading to code execution

A heap-based buffer overflow in the Windows Raw Image Extension allows an attacker to execute code over a network. According to the CVSS vector, exploitation requires user interaction, for example opening, previewing or downloading a malicious image file. The CVSS base score is 8.8 (High) with high impact on confidentiality, integrity and availability.

Windows · MSRC

Windows Active Directory Domain Services: Remote code execution

Incorrect authorization (CWE-863) in Active Directory Domain Services (AD DS) allows an authenticated attacker to execute code over the network. AD DS runs on Windows Server domain controllers and governs identity and access for domain-joined systems. The CVSS v3.1 base score is 8.8 (High), with high impact on confidentiality, integrity and availability. Exploitation requires network access and any valid low-privilege domain account.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Exchange Server: Remote Code Execution via improper input validation

Improper input validation in Microsoft Exchange Server allows an authenticated attacker to execute code over the network. The CVSS vector requires low privileges and no user interaction, so any valid account on the server may be enough. Microsoft lists only Exchange Server Subscription Edition RTM as affected, and the CVE is not yet analysed by NVD.

Server software (Exchange, SharePoint …) · KB5133453 · MSRC

Microsoft Office Excel: Stack-based buffer overflow allows remote code execution

A stack-based buffer overflow in Microsoft Excel, part of Microsoft Office, can be exploited by an unauthorized attacker over a network. Exploitation requires a user to open a crafted file, which makes email and file sharing the most likely attack paths. A successful attack could lead to code execution with high impact on confidentiality, integrity and availability. Microsoft rates the flaw as Critical in some release notes, while the CVSS base score is 8.8 (High).

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Remote code execution via double free

A double free memory corruption flaw in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Exploitation requires a user to interact with the attack, most likely by opening a crafted Office file. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability on the affected system.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Heap-based buffer overflow allows code execution

A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted file, for example one received by email or downloaded from the internet. The CVE is rated CVSS 8.8, was published on 2026-11-10, and NVD analysis is still pending.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Excel, part of the Office suite, allows an unauthenticated remote attacker to execute code. Per the CVSS vector, the attack needs no privileges but requires a user to interact, for example by opening a crafted file received by email or via file sharing. The affected builds differ per Office edition, including Microsoft 365 Apps, LTSC releases and Mac versions, and Office Online Server may also be affected.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Double free allows remote code execution

A double free vulnerability (CWE-415) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires a user to open a malicious workbook, for example one received by email or downloaded from the internet. The vendor-assigned CVSS v3.1 base score is 8.8 (High). No exploitation in the wild and no public proof of concept were found at the time of publication.

Microsoft Office · MSRC

Microsoft Office Excel: Stack-based buffer overflow allows code execution

A stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network (CVSS 8.8). The attack requires a user to open a crafted file, such as an Excel attachment or download, and no privileges are needed. Successful exploitation would give the attacker full control over the affected user's system. No exploitation is known at publication.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Use after free leads to remote code execution

Microsoft Office Excel contains a use-after-free memory corruption flaw (CWE-416). If a user opens a specially crafted Excel file, for example from an email or a download, an unauthorized attacker may be able to execute code in the context of the signed-in user. No authentication is required, but user interaction is. Microsoft released security updates on 10 November 2026.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Remote code execution via use-after-free

A use-after-free memory flaw in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attacker needs the victim to open a crafted file, for example an email attachment or a file from a shared drive or web link. Successful exploitation runs code with the rights of the user, so accounts with local admin rights carry higher risk.

Microsoft Office · KB5002946 · MSRC

Microsoft Windows: Remote code execution in Graphic Fonts

A heap-based buffer overflow in the Windows Graphic Fonts component allows an unauthorized attacker to execute code over a network. The attack requires a user to take an action, such as opening a manipulated document or visiting a manipulated page. The CVSS base score is 8.8 (High), and the CISA SSVC assessment reports technical impact as total.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Office: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office allows an unauthorized remote attacker to execute code on the affected machine. The attack requires that a user opens or processes crafted content, for example a document received by email or downloaded from the internet. The CVSS base score is 8.8 (High), with full impact on confidentiality, integrity and availability of the local system. Microsoft reports no exploitation in the wild and no public proof-of-concept code at the time of writing.

Microsoft Office · MSRC

Microsoft PowerPoint: Heap-based buffer overflow enabling code execution

Microsoft PowerPoint in Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 contains a heap-based buffer overflow (CWE-122). A remote attacker without authentication can execute code over the network, which in practice could give full control over the affected user's session and workstation. The attack requires the user to take an action, such as opening a crafted presentation, but no privileges are needed. The CVSS base score is 8.8 (High).

Microsoft Office · MSRC

Microsoft Office Excel: Remote Code Execution via heap-based buffer overflow

A heap-based buffer overflow (CWE-122) in Microsoft Excel, part of Microsoft 365 Apps, Office LTSC and Office for Mac, allows an unauthorized attacker to execute code over the network. The attacker needs a victim to open a crafted workbook, for example one received by email or downloaded from the internet. Successful exploitation would run code in the user's context with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8).

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Heap-based buffer overflow leads to remote code execution

A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires that a user opens a manipulated file, for example a spreadsheet received by email or download. No privileges and no internet-facing service are needed, and a successful attack could compromise the user's session and data.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Excel: Remote code execution via heap-based buffer overflow

Microsoft Office Excel contains a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a specially crafted workbook, typically received by email or as a downloaded file, and interacts with affected features. The code runs in the context of the signed-in user. Microsoft has published security updates.

Microsoft Office · KB5002946 · MSRC

Microsoft Defender: Remote code execution via null pointer dereference

A null pointer dereference in the Microsoft Malware Protection Engine, which powers Microsoft Defender, allows an unauthenticated attacker to execute code over a network. According to the CVE record, user interaction is required, for example when the scanning engine processes attacker-supplied content. The engine is present on most Windows endpoints, so SMEs with unmanaged or offline systems are most at risk. Microsoft's own severity rating is not yet confirmed; the CVE record gives CVSS 8.8.

System Center and Defender · MSRC

Windows Network Connected Devices Auto-Setup: Remote code execution

A heap-based buffer overflow in the Windows Network Connected Devices Auto-Setup Service allows an unauthenticated attacker on the same adjacent network to execute code. No user interaction is required, and the CVSS score is 8.8 (High). The service is not internet-facing, and on Windows 10 it only runs when a user, an application or another service requests it, so exposure depends on whether it is active.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131087 · MSRC

Windows Hyper-V: Elevation of privilege via untrusted pointer dereference

Microsoft Windows Hyper-V contains an untrusted pointer dereference that allows a local attacker to elevate privileges. The attacker needs local access and already has high privileges, typically administrator rights. The CVSS 3.1 base score is 8.2 (High) and the vector includes a scope change, meaning the impact crosses a security boundary.

Windows · KB5132059 · MSRC

Windows Message Queuing: Heap-based buffer overflow enables remote code execution

The Queue Manager component of Windows Message Queuing (MSMQ) in supported Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow (CWE-122). An unauthenticated attacker on the network can execute code with high impact on confidentiality, integrity and availability, but attack complexity is high. Only systems with MSMQ installed are affected.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Network Address Translation (NAT): Use-after-free enables remote code execution

A use-after-free flaw (CWE-416) in the Windows Network Address Translation (NAT) component allows an unauthenticated attacker to execute code over the network. The CVSS base score is 8.1, but attack complexity is rated high and no user interaction or credentials are needed. The main risk is for Windows hosts with the NAT function enabled and reachable from untrusted networks, such as servers acting as routers or internet gateways.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Message Queuing: Heap-based buffer overflow allows remote code execution

A heap-based buffer overflow in Windows Message Queuing (MSMQ) allows an unauthenticated attacker on the network to execute code. The CNA record rates the attack complexity as high, so the attack requires specific conditions. MSMQ is an optional Windows feature, so systems without it installed are not affected.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows RPC Runtime: Remote code execution via improper signature check

A flaw in the Windows Remote Procedure Call (RPC) Runtime, a library used by RPC servers and Windows services, fails to verify a cryptographic signature correctly (CWE-347). An unauthenticated attacker on the network can exploit it to execute code, with a CVSS 3.1 base score of 8.1. Exploitation requires high attack complexity, and no user interaction is needed. The vendor has published patches as part of the November 2026 Patch Tuesday.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Deployment Services: Use-after-free leads to remote code execution

Windows Deployment Services (WDS), a Windows Server role, contains a use-after-free flaw (CWE-416). An unauthorized attacker on the network could execute code on an affected server. The CVSS vector rates attack complexity as high and assumes no privileges and no user interaction, but a vendor patch review suggests a low-privileged account may be needed; this is not yet confirmed by Microsoft.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131090 KB5131080 · MSRC

Windows Schannel: Remote code execution via timing discrepancy

Microsoft's Windows Schannel TLS component contains an observable timing discrepancy (CWE-208). According to the description, an unauthenticated attacker on the network could execute code on affected Windows systems. The attack complexity is high (AC:H), and the CVSS 3.1 base score is 8.1. NVD analysis was still pending at publication.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Internet Information Services: Remote code execution due to race condition

A race condition (CWE-362, CWE-416) in Windows Internet Information Services (IIS) allows an attacker to execute code remotely over the network. The CVE record rates the CVSS score as 8.1 with high impact on confidentiality, integrity and availability. The CVE record lists no privileges required, but the attack complexity is high and the NVD analysis is still pending.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows CredSSP: Remote code execution due to double free

A double free vulnerability (CWE-415) in the Windows CredSSP component allows a remote attacker to execute code on affected Windows systems. CredSSP handles authentication for remote sessions, such as Remote Desktop with Network Level Authentication and remote management. The CVE description states that no privileges or user interaction are required, but the attack complexity is rated high.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Message Queuing: Remote code execution due to double free

A double free vulnerability (CWE-415) in Windows Message Queuing (MSMQ) allows an unauthenticated attacker to execute code over the network. Exploitation is rated high complexity, and the CVSS base score is 8.1 according to the CNA. The flaw only matters on systems where MSMQ is installed and reachable from untrusted networks.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Message Queuing: Remote code execution via double free

A double free vulnerability in Windows Message Queuing (MSMQ) allows an unauthorized attacker to execute code remotely over the network. The CVSS vector rates the attack complexity as high and requires no user interaction. Systems without MSMQ installed are not affected, and the MSMQ feature is not enabled by default. Conflicting information exists on whether a low-privileged account is required, so the worse case should be assumed until Microsoft confirms it.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Message Queuing: Use-after-free allows remote code execution

A use-after-free vulnerability (CWE-416) in the Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over the network. No privileges or user interaction are required, but the attack complexity is high. Message Queuing is an optional Windows component, so exposure depends on whether it is installed and reachable.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Hyper-V: Local privilege escalation via heap buffer overflow

A heap-based buffer overflow in the Windows Hyper-V virtualization component allows an authorized local attacker to elevate privileges. Successful exploitation can affect confidentiality, integrity and availability, and the scope changes beyond the vulnerable component. The attacker needs local access and valid low-privileged credentials, and attack complexity is high. Systems without the Hyper-V role are not affected.

Windows, Windows ESU (Extended Security Updates) · KB5131090 KB5131096 KB5131080 KB5131077 · MSRC

Windows Hyper-V: Elevation of privilege via TOCTOU race condition

A time-of-check time-of-use race condition in Windows Hyper-V allows an authorized local attacker to elevate privileges. The attacker must already have a foothold in a guest VM or on the local system and must win a race condition. Hyper-V is not reachable from the internet, but the risk is relevant for hosts with shared or untrusted guest VMs and for endpoints with VBS, Windows Sandbox or WSL2 enabled.

Windows, Windows ESU (Extended Security Updates) · KB5131096 KB5131090 KB5131087 KB5132061 · MSRC

Windows TPM: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow in the Windows Trusted Platform Module (TPM) component allows an authorized local attacker to elevate privileges. The attacker needs local code execution or a logon with a low-privileged account first, so the flaw is not directly reachable from the internet. Successful exploitation could lead to full loss of confidentiality, integrity and availability on the affected host.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Remote Desktop Services: Elevation of privilege via double free

A double free vulnerability in Windows Remote Desktop Services allows an authorized local attacker to elevate privileges. The attacker needs a local, low-privileged account and must win a race condition. The flaw is not reachable from the internet, but multi-user RDS session hosts and terminal servers are at greatest risk.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131090 KB5131080 · MSRC

Microsoft Windows Graphics Kernel: Elevation of privilege via heap-based buffer overflow

A heap-based buffer overflow in the Windows Graphics Kernel allows an authorized local user with low privileges to elevate privileges on the affected system. Microsoft rates exploitation as high complexity and requires that the affected virtual machine has multiple assigned graphics adapters with differing configurations. An attacker therefore needs prior code execution or a logon on the machine. CVSS base score is 7.8; Microsoft reports no public exploitation at release.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131090 KB5131087 · MSRC

Microsoft Windows Codecs Library: Remote code execution vulnerability

A heap-based buffer overflow in the Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. Exploitation has high attack complexity and requires user interaction, such as opening or previewing a crafted media file. The CVSS 3.1 score is 7.5 (High), while the MSRC page lists the maximum severity as Critical, so the update should be treated as high priority.

Windows, Windows ESU (Extended Security Updates), Microsoft Office · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Print Spooler: Remote code execution via use after free

A use-after-free flaw in the Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network. The CVE record and Microsoft rate it with CVSS 7.5 (AV:A/AC:H/PR:N/UI:N), so no authentication is needed, but the attacker must be on the local network and win a race condition. The Print Spooler runs with SYSTEM privileges and is enabled on most Windows systems, including those without a printer.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows srvnet.sys (SMB Server): Remote code execution via race condition

A race condition (CWE-362) in the SMB server network transport driver srvnet.sys of Windows allows an authorized attacker to execute code over the network. Exploitation requires winning a race, which Microsoft's CVSS rating reflects as high attack complexity. Successful exploitation could give the attacker full control over the affected system, including domain controllers and file servers that expose SMB on TCP/445.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131090 KB5131087 · MSRC

Windows TCP/IP: Use-after-free allows code execution from adjacent network

A use-after-free flaw in the Windows TCP/IP stack allows an unauthenticated attacker on an adjacent network to execute code. Microsoft rates the CVSS base score at 7.5 (High) and its maximum severity as Critical. The attack requires high complexity and conditions beyond the attacker's control, so it is not directly reachable from the internet.

Windows · KB5132061 KB5132043 KB5131080 KB5131077 · MSRC

Microsoft Windows Hyper-V: Use-after-free allows local privilege escalation

A use-after-free vulnerability (CWE-416) in Windows Hyper-V allows an authorized local attacker to elevate privileges. Exploitation requires local access and high privileges, and the attack complexity is high, so this is not an internet-facing flaw. Because the CVSS scope is changed, a successful attack can affect resources beyond Hyper-V, with high impact on confidentiality, integrity and availability.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Function Discovery SSDP Provider: Use-after-free remote code execution

A use-after-free vulnerability in the Windows Function Discovery SSDP Provider allows an unauthenticated attacker to execute code. The attacker needs to be on the same or an adjacent network segment, and the attack is rated as having high complexity. No privileges or user interaction are required. Successful exploitation could compromise confidentiality, integrity and availability of the affected system.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131090 KB5131096 KB5131080 · MSRC

Windows Active Directory Domain Services: Elevation of privilege

Microsoft Active Directory Domain Services (AD DS) on Windows domain controllers contains an incorrect authorization flaw (CWE-863) that allows an authenticated attacker to elevate privileges over the network. According to secondary analysis, exploitation requires winning a race condition. A successful attack could lead to SYSTEM on a domain controller and thus full control of the Windows domain. The attacker needs network access to a domain controller and any valid domain account; the flaw is not exposed to the internet.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Hyper-V: Use-after-free leading to local privilege escalation

A use-after-free vulnerability in Windows Hyper-V allows an authorized local attacker to elevate privileges. Exploitation requires local access, high attack complexity and existing high privileges, and the CVSS score is 7.5 with a scope change. The flaw is not reachable from the internet by itself, but it matters on Hyper-V hosts and multi-user Windows systems, where an attacker with prior access could gain higher rights. Microsoft released fixes with the November 2026 Patch Tuesday.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131090 KB5131096 KB5131080 · MSRC

Windows Hyper-V: Local privilege escalation via uninitialized resource

Windows Hyper-V, the hypervisor component of Windows, contains a use of uninitialized resource flaw that allows an authorized local attacker to elevate privileges. The attack requires high privileges and high attack complexity, but a successful attacker could affect the confidentiality, integrity and availability of the system, including beyond the Hyper-V component (scope changed). Microsoft has released fixes; exploitation status is conflicting between sources and no public proof of concept was found.

Windows · KB5132061 KB5132043 KB5131080 KB5131077 · MSRC

Windows: Privilege escalation in Graphics Kernel via integer overflow

A local integer overflow in the Windows Graphics Kernel allows an authorized attacker to elevate privileges on affected Windows 11 and Windows Server 2025 systems. The attacker needs an existing local foothold, such as a valid low-privileged account or code running on the machine, and the attack complexity is high. The main risk is turning a compromised user session into SYSTEM level control, especially on multi-user systems.

Windows · KB5131087 KB5132061 KB5132043 KB5131080 · MSRC

Microsoft Office Excel: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Excel, part of Microsoft 365 Apps, LTSC Office releases and Office for Mac, allows an unauthorized attacker to execute code on a vulnerable system over a network. Exploitation requires a user to open a malicious Excel file, which is typically delivered by email or file sharing. Microsoft has not reported exploitation in the wild for this CVE, and the CVSS base score is 7.5 with high attack complexity.

Microsoft Office · KB5002946 · MSRC

Microsoft Office Word: Remote code execution via crafted file

A use of uninitialized resource in Microsoft Office Word allows an attacker to execute code on the affected system over the network. The attacker must send the user a malicious Office file and convince the user to open it, so email attachments and downloaded documents are the main risk. Code runs with the rights of the user, and successful exploitation depends on the environment, system configuration and other security measures. Microsoft rates the vulnerability as Critical, while the CVSS 3.1 base score is 7.5 (High).

Microsoft Office · MSRC

Windows Function Discovery Resource Publication: Remote code execution via use-after-free

A use-after-free flaw in the Function Discovery Resource Publication (FDResPub) service of Windows allows remote code execution. An unauthenticated attacker on the same adjacent network can send specially crafted SOAP requests to an affected host, and successful exploitation could give full control over that host. Exploitation is rated as high complexity, and Microsoft has released fixes.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Hyper-V: Use-after-free allows local privilege escalation

A use-after-free flaw in Windows Hyper-V allows an authorized local attacker to elevate privileges. Exploitation requires a local foothold, such as a compromised user account or malware on the system, and high attack complexity. Hyper-V hosts are most at risk, because a host compromise affects all virtual machines on it.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131090 KB5131087 · MSRC

Microsoft Windows Hyper-V: Use-after-free privilege escalation

A use-after-free flaw in Windows Hyper-V allows a local attacker with high privileges to elevate privileges on the affected system. Microsoft rates it 6.4 (CVSS 3.1, Medium) and classifies it as CWE-416. Exploitation requires local access and an already privileged account, so the risk is mainly escalation after an admin account or host has already been compromised.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Azure Managed Grafana: Server-side request forgery leading to privilege escalation

Azure Managed Grafana, Microsoft's managed observability service, contains a Server-side Request Forgery (SSRF) vulnerability (CWE-918). According to the CVE record, an unauthenticated attacker can exploit it over the network to elevate privileges, with a CVSS 3.1 base score of 9.8 (Critical). No user interaction is required. Only organisations that use Azure Managed Grafana are affected.

Azure · MSRC

Windows AppX Deployment Service: Privilege escalation through incorrect authorization

Incorrect authorization in the Windows AppX Deployment Service allows a local user with low privileges to gain higher privileges on the affected system. Microsoft rates the flaw Important, with CVSS 7.8 (AV:L/AC:L/PR:L). An attacker needs a valid local account and cannot exploit it remotely, so it is mainly a risk after an initial compromise, for example through phishing or malware.

Windows, Windows ESU (Extended Security Updates) · KB5131096 KB5131090 KB5131087 · MSRC

Windows Installer Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Text Services Framework: Elevation of privilege via incorrect authorization

Incorrect authorization in the Windows Text Services Framework allows an authorized local user to elevate privileges. An attacker needs a low-privileged account and local access, for example after phishing or a stolen password. Successful exploitation could give full control over the affected system (CVSS 3.1 7.8, as recorded in aggregator data; NVD analysis is still pending).

Windows, Windows ESU (Extended Security Updates) · KB5132061 KB5132043 KB5131085 KB5131090 · MSRC

Windows Remote Access API: Local privilege escalation via untrusted search path

The Windows Remote Access API, the interface behind Windows remote access features such as VPN and RAS/RRAS, contains an untrusted search path weakness (CWE-426). An authorized local attacker with a low-privilege account can use it to elevate privileges on the affected host. No user interaction is required, and the CVSS base score is 7.8 (High). The vulnerability is not directly exploitable from the internet.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Telephony Service: Local privilege escalation

A local privilege escalation vulnerability in the Windows Telephony Service allows an authorized, low-privileged user to gain higher rights on the affected system. It is classified as missing authentication for a critical function (CWE-306). An attacker needs an existing local account or code execution on the machine, for example after phishing or opening a malicious file, to escalate to SYSTEM-level control. Microsoft fixed the issue in the November 2026 security update.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Installer: Elevation of privilege via incorrect authorization

Incorrect authorization in Windows Installer allows an authenticated local attacker with low privileges to elevate privileges on the affected system. The CVSS vector indicates high impact on confidentiality, integrity and availability if exploited. Exploitation requires local access and a foothold such as a standard user account, a compromised service account or a malicious insider.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Installer: Elevation of privilege via improper access control

A local authorized user can exploit improper access control in Windows Installer to gain higher privileges on affected Windows 10, Windows 11 and Windows Server systems. The attack needs an existing local account and no user interaction, but the impact on confidentiality, integrity and availability is high. The NVD entry is still awaiting analysis, and the CVE record uses CWE-22 while the vendor text describes access control, so the root cause is not fully confirmed.

Windows, Windows ESU (Extended Security Updates) · KB5131096 KB5131090 KB5131087 KB5132061 · MSRC

Microsoft Windows: Winlogon elevation of privilege via heap-based buffer overflow

A heap-based buffer overflow in the Windows Winlogon component allows a locally authenticated attacker with low privileges to elevate privileges. Successful exploitation can lead to full control of the system, including SYSTEM rights. The attacker needs an existing local user account, and the flaw cannot be exploited remotely.

Windows · KB5131080 KB5131077 KB5132061 KB5132043 · MSRC

Windows LUAFV: Heap-based buffer overflow enables local privilege escalation

Microsoft has fixed a heap-based buffer overflow in the Windows LUA File Virtualization Filter Driver (LUAFV), tracked as CVE-2026-88230. An attacker who already holds a local account or runs code as a standard user can exploit it to gain higher privileges on the system. Remote exploitation is not possible and no user interaction is required. The risk is highest on multi-user systems such as terminal servers, file servers and shared workstations.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Servicing Stack Update: Local privilege escalation via confused deputy

A confused deputy flaw (CWE-441) in Microsoft's Servicing Stack Updates (SSU) allows an authorized local user to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The attacker needs a valid low-privileged account on the machine and cannot exploit the flaw directly over the network. Microsoft rates the impact as high for confidentiality, integrity and availability (CVSS 3.1 7.8).

Windows, Windows ESU (Extended Security Updates) · KB5131083 KB5131085 KB5131096 KB5131090 · MSRC

Windows Camera Frame Server Monitor: Heap overflow allows local privilege escalation

A heap-based buffer overflow (CWE-122) in the Windows Camera Frame Server Monitor component allows an authorized local user to elevate privileges. An attacker needs valid low-privileged access to the system and must run code on the machine, for example through a phishing payload or malware. No user interaction is required. Microsoft rates the flaw as Important, with a CVSS 3.1 base score of 7.8.

Windows · KB5131087 KB5132061 KB5132043 KB5131080 · MSRC

Microsoft Windows: Heap-based buffer overflow in Xbox Gaming Services

The Xbox Gaming Services component in supported Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow. A local user with low privileges can exploit it to gain higher privileges, potentially up to SYSTEM. The attack requires local access and an existing user account, so the flaw is not directly reachable from the internet.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131080 KB5131077 · MSRC

Windows Graphics Kernel: Privilege escalation through integer overflow

A integer overflow or wraparound in the Windows Graphics Kernel allows a local attacker with a low-privileged account to elevate privileges. Microsoft rates the flaw as Elevation of Privilege with CVSS 3.1 7.8 (High). No user interaction is required, and the flaw cannot be exploited remotely. An attacker who already has a foothold, for example through phishing or malware, could gain SYSTEM rights.

Windows, Windows ESU (Extended Security Updates) · KB5131096 KB5131090 KB5131087 KB5132061 · MSRC

Microsoft Windows: Elevation of privilege in Data Sharing Service Client

A local elevation of privilege flaw (CWE-59, link following) exists in the Data Sharing Service Client of Windows 10, Windows 11 and Windows Server. An authorized local user with low privileges can exploit it before a file is accessed to gain higher privileges on the system. Microsoft rates it CVSS 7.8 (High); an attacker needs local access and an existing user account, for example after phishing or malware.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Graphics Kernel: Elevation of privilege via untrusted pointer dereference

A flaw in the Windows Graphics Kernel allows an attacker with a local, low-privilege account to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The issue is an untrusted pointer dereference (CWE-822), and successful exploitation could lead to full control of the system. Microsoft classifies the vulnerability as Important with a CVSS 3.1 base score of 7.8; the attacker needs local code execution first.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131090 KB5131087 · MSRC

Windows Kernel: Incorrect authorization allows local privilege escalation

Incorrect authorization in the Windows Kernel allows a local user with low privileges to elevate their privileges on affected Windows 11 systems. An attacker needs a logon or code execution on the machine first, so the flaw is typically a second stage after phishing or a compromised account. Successful exploitation can lead to full control of the system (CVSS 7.8, High).

Windows · KB5132061 KB5132043 KB5132059 · MSRC

Microsoft Windows Graphics Kernel: Heap-based buffer overflow allows local privilege escalation

A heap-based buffer overflow in the Windows Graphics Kernel allows an authorized local attacker to elevate privileges to a higher level on the affected system. The attacker needs code execution or a user session on the machine first, and any standard user account is sufficient. The flaw is rated 7.8 (High) by CVSS 3.1, and Microsoft has released patches.

Windows, Windows ESU (Extended Security Updates), Microsoft Office · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Shell: Elevation of privilege through type confusion

A type confusion flaw (CWE-843) in Windows Shell allows an authorized local user to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The attacker needs a low-privileged local account and code execution as that user, so the flaw cannot be used remotely. The CVSS score is 7.8 (high), with high impact on confidentiality, integrity and availability.

Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131090 KB5131096 KB5131080 · MSRC

Windows TCP/IP: Denial of Service through null pointer dereference

A null pointer dereference in the Windows TCP/IP networking stack allows an unauthenticated remote attacker to cause a denial of service. Successful exploitation can crash or hang affected Windows systems that are reachable over the network. The impact is limited to availability; no confidentiality or integrity impact is stated.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows Task Scheduler: Heap-based buffer overflow enables local privilege escalation

A heap-based buffer overflow in the Windows Task Scheduler component allows an authorized, low-privileged local user to elevate privileges. The CNA scores it as CVSS 3.1 7.0 (High) with high attack complexity, and VulDB lists 8.8. The attacker needs valid local access first, for example through phishing, stolen credentials or another vulnerability.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows Print Spooler: Local privilege escalation via TOCTOU race condition

A time-of-check time-of-use (TOCTOU) race condition in Windows Print Spooler Components allows an authorized local user to elevate privileges. An attacker needs a foothold on the affected system first, for example through a compromised user account, and the attack complexity is high. Successful exploitation could give an attacker higher privileges on the system, which matters most on servers and domain controllers where the Print Spooler runs.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Microsoft Windows NetBIOS: Elevation of privilege via use after free

A use-after-free flaw in the Windows NetBIOS component allows an authorized local attacker with low privileges to elevate their privileges to a higher level, potentially to full system control. The attack complexity is high and local logon access is required, so this is not a remote, unauthenticated vulnerability. Microsoft rates the impact as Important; the exploitation status is not clear from the sources reviewed.

Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC

Windows SMB Client: Use after free allows local privilege escalation

A use-after-free vulnerability (CWE-416) in the Windows SMB client allows a local attacker to elevate privileges. The attacker needs a low-privilege account on the affected machine and the attack is highly complex, so it is not remotely exploitable. The impact on the local system is total (confidentiality, integrity and availability), so it is most relevant as a second stage after phishing or a stolen credential.

Windows · KB5132059 · MSRC

Windows Desktop Window Manager: Use-after-free leads to local privilege escalation

A use-after-free flaw (CWE-416) in the Windows Desktop Window Manager, the component that composites and renders window graphics, allows an authorized local attacker to elevate privileges. Exploitation requires low-privileged local access and high attack complexity. The flaw is not directly exposed to the internet, but it can serve as a second stage after a phishing or malware foothold and poses a higher risk on shared multi-user systems such as Remote Desktop servers.

Windows · KB5132061 KB5132043 KB5131080 KB5131077 · MSRC