#vulnerability

**Is the Preview Pane an attack vector for this vulnerability?** No, the Preview Pane is not an attack vector.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Use of hard-coded credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.

**What type of information could be disclosed by this vulnerability?** The type of information that could be disclosed if an attacker successfully exploited this vulnerability is user tokens and other potentially sensitive information.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

**According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?** This attack requires an admin user on the client to connect to a malicious server and then take specific actions which could result in information disclosure.