Latest News

Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to execute code over a network.

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a network.

Cryptographic issues in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges over a network.

**How could an attacker exploit this vulnerability?** An attacker could exploit this vulnerability by tricking a user into sending a request to a malicious server via the Routing and Remote Access Service (RRAS) Snap-in. This could result in the server returning malicious data that might cause arbitrary code execution on the user's system.

**What privileges could be gained by an attacker who successfully exploited this vulnerability?** An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.

Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

**According to the CVSS metric, the attack vector is local (AV:L) while user interaction is required (UI:R). What does that mean for this vulnerability?** An attacker can trick a local user on a vulnerable system into mounting a specially crafted VHD that would then trigger the vulnerability.