#vulnerability

Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally.

Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.

Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network.

**Is the Preview Pane an attack vector for this vulnerability?** Yes, the Preview Pane is an attack vector.

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally.

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.

**What type of information could be disclosed by this vulnerability?** System internal configuration could be disclosed by this vulnerability.

**According to the CVSS metric, attack vector is (AV:N) and user interaction is none (UI:N). What does that mean for this vulnerability?** This can happen without user intervention. An attacker can use an uninitialized function pointer being called when decoding a JPEG image. This can be embedded in Office and 3rd party documents/files