Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability

SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions. ConnectSecure on Windows is affected.

Windows Installer Elevation of Privilege Vulnerability

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Windows Win32k Elevation of Privilege Vulnerability

Windows HTTP.sys Elevation of Privilege Vulnerability

Windows User Account Profile Picture Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows USB Print Driver Elevation of Privilege Vulnerability

Windows Update Stack Elevation of Privilege Vulnerability

Windows Telephony Server Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

DirectX Elevation of Privilege Vulnerability

Azure IoT CLI extension Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.

Windows kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability".

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Application Model Core API Elevation of Privilege Vulnerability

Windows Storage Elevation of Privilege Vulnerability

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Azure IoT SDK Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Win32k Elevation of Privilege Vulnerability

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

DirectX Elevation of Privilege Vulnerability

Windows Win32k Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

Windows Kernel Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

Azure Arc-Enabled Servers Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges. The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges.