CVE Vulnerability Advisory Database

[Affected Scope] Systems running Microsoft Windows with App Installer (AppX/MSIX) and the ms-appinstaller URI scheme enabled

[Impact] Successful exploitation allows threat actors to deliver malware families such as Emotet, Trickbot, and Bazaloader via phishing, leading to complete system compromise.

[Mitigation] Apply the latest official Windows App Installer updates and disable the ms-appinstaller protocol handler via Group Policy.

[Affected Scope] All Windows systems utilizing the Common Log File System (CLFS.sys) driver, including Windows 10, 11, and Windows Server editions.

[Impact] A local attacker can execute arbitrary code in kernel mode via a specially crafted application, leading to complete SYSTEM privilege escalation.

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor for unauthorized local process executions and anomalous CLFS log creations.

[Affected Scope] Microsoft Windows operating systems, including Windows 7, 8.1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022

[Impact] A local authenticated attacker can exploit improper link resolution in the Windows Installer service to delete or manipulate arbitrary files with SYSTEM privileges, potentially leading to full local privilege escalation

[Mitigation] Apply the official cumulative security updates provided by Microsoft immediately, or restrict Windows Installer execution for non-administrative users as a temporary workaround

[Affected Scope] Microsoft Windows operating systems utilizing the Win32k kernel driver, including Windows 10, Windows 11, and Windows Server 2016/2019/2022

[Impact] A local attacker with low privileges can execute arbitrary code in kernel mode, leading to complete system takeover (SYSTEM privileges)

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and restrict local interactive access on unpatched assets

[Affected Scope] Microsoft Windows operating systems utilizing the Win32k kernel driver, including Windows 10, Windows 11, and Windows Server 2016/2019/2022.

[Impact] A local authenticated attacker can execute arbitrary code in kernel mode and elevate privileges to SYSTEM by running a specially crafted application.

[Mitigation] Immediately apply the official cumulative security updates provided by Microsoft and restrict local execution privileges on unpatched systems.

[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server 2016/2019/2022 utilizing the Win32k kernel driver

[Impact] Local attackers can execute arbitrary code in kernel mode, escalating privileges from a standard user to SYSTEM, with active exploitation observed in the wild by APT groups

[Mitigation] Immediately apply the official Microsoft Latest Cumulative Update (LCU) and restrict local execution privileges on unpatched systems

[Affected Scope] Systems running Microsoft Windows OS utilizing the MSHTML (Internet Explorer) rendering engine and Microsoft Office suites

[Impact] Successful exploitation allows remote attackers to execute arbitrary code (RCE) with the privileges of the active user by tricking them into opening a specially crafted Office document

[Mitigation] Apply the official Microsoft security updates immediately, or implement registry workarounds to disable ActiveX controls as a temporary mitigation

[Affected Scope] Microsoft Windows operating systems including Windows 7, 8.1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022

[Impact] A local authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to full host compromise

[Mitigation] Immediately apply the official cumulative security updates provided by Microsoft and monitor unpatched assets

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] A local attacker with low privileges can execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately, or temporarily disable the affected service in air-gapped environments

[Affected Scope] Windows and Windows Server operating systems, particularly Active Directory Domain Controllers

[Impact] Unauthenticated remote attackers can exploit the LSARPC interface to force a Domain Controller to authenticate against an arbitrary server via NTLM, leading to full domain takeover

[Mitigation] Apply the official Microsoft security updates immediately, and configure Extended Protection for Authentication (EPA) alongside SMB signing to block NTLM relay vectors

[Affected Scope] Event Tracing for Windows (ETW) subsystem in Windows 10, Windows 11, and Windows Server families

[Impact] Local attackers can exploit a Use-After-Free (UAF) vulnerability to execute arbitrary code with SYSTEM privileges, leading to full system compromise

[Mitigation] Immediately apply the official Microsoft Cumulative Update (LCU) and restrict local access on unpatched systems

[Affected Scope] Windows 10, 11, and Windows Server systems running the User Profile Service (ProfSvc)

[Impact] A locally authenticated attacker can exploit a logical flaw to execute arbitrary code with SYSTEM privileges, leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict multi-user and RDP access if patching is delayed

[Affected Scope] Windows 10 version 1809 and later, and Windows Server 2019 and later

[Impact] Local users can read sensitive registry hives (SAM, SYSTEM, SECURITY) via Volume Shadow Copies, leading to full SYSTEM privilege escalation and credential theft

[Mitigation] Apply the official security update, then manually delete all existing Volume Shadow Copies (VSS) and create new ones to fully mitigate the risk

[Affected Scope] Windows client and server environments utilizing Internet Explorer 11 and its legacy scripting engines (Chakra, JScript)

[Impact] Remote Code Execution (RCE) under the context of the current user if a victim visits a specially crafted malicious website or opens a compromised document

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict execution permissions for legacy scripting engines

[Affected Scope] Supported Windows operating systems including Windows 10, Windows 11, and Windows Server 2016/2019/2022

[Impact] A local authenticated attacker can exploit a kernel memory corruption vulnerability to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft Latest Cumulative Update (LCU) and restrict local access privileges

[Affected Scope] Supported Windows operating system kernels, including Windows 10, Windows 11, and Windows Server 2016/2019/2022

[Impact] A local attacker with low privileges can trigger memory corruption (CWE-119) in the kernel to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and monitor for local privilege escalation indicators

[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with the Windows Print Spooler service enabled

[Impact] An authenticated remote attacker can execute arbitrary code with SYSTEM privileges, potentially leading to full domain compromise

[Mitigation] Apply official cumulative security updates immediately, disable the Print Spooler service where not required, and harden Point and Print registry configurations

[Affected Scope] Windows Operating Systems and applications utilizing the MSHTML (Trident) rendering engine

[Impact] Remote Code Execution (RCE) and complete system compromise if a user views a specially crafted web page or document

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or restrict ActiveX/MSHTML rendering for untrusted files

[Affected Scope] Microsoft Windows operating systems utilizing the Desktop Window Manager (DWM), including Windows 10 and Windows Server 2016/2019/2022

[Impact] A local attacker can execute a specially crafted application to elevate privileges to SYSTEM, gaining full control over the compromised host

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and restrict local execution privileges on unpatched systems

[Affected Scope] NTFS file system driver in Windows 10, Windows 11, and Windows Server families

[Impact] Local attackers can trigger kernel memory corruption to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft Latest Cumulative Update (LCU) and restrict local access