Windows Host Guardian Service Elevation of Privilege Vulnerability

Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

Windows Audio Service Elevation of Privilege Vulnerability

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Windows Device Association Broker Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.

IP Helper Remote Code Execution Vulnerability

Use after free in IP Helper allows an unauthorized attacker to execute code over a network.

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

Windows SMB Client Remote Code Execution Vulnerability

Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network.

Windows Notification Elevation of Privilege Vulnerability

Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.

Windows Message Queuing Elevation of Privilege Vulnerability

Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

Windows Deployment Services Remote Code Execution Vulnerability

Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.

Windows Deployment Services Remote Code Execution Vulnerability

Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.

Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DESCRIPTOR(CONFIGURATION) read, a mismatch between the short and full descriptor reads, and a rejected descriptor in parse_configuration_descriptor() — the buffer was released with k_heap_free() but the pointer was left dangling. The cleanup in usbh_device_free() is guarded only by if (udev->cfg_desc != NULL), so it frees the same block a second time. The path is driven entirely by the attached peripheral: usbh_device_connect() calls usbh_device_init(), which ends in usbh_device_set_configuration(), and on failure usbh_device_connect() calls usbh_device_free(). On v4.4.x this happens during the same enumeration, with no unplug required; on v4.1.0–v4.3.x the second free instead arrives via dev_removed_handler()/dev_connected_handler() in subsys/usb/host/usbh_core.c, so it requires a removal or duplicate-connect event after the failed enumeration — a sequence the attached device fully controls. A malicious or malformed USB device only has to answer the first 9-byte configuration-descriptor request with a well-formed header and then fail any of the three checks, for example by returning a full descriptor whose interface count disagrees with bNumInterfaces, or by answering the second read with different bytes. The result is a double free on usb_device_heap. On builds where lib/heap hardening is active (the current default CONFIG_SYS_HEAP_HARDENING_BASIC), sys_heap_free() detects the already-free chunk and calls k_panic(), giving a deterministic, peripheral-triggered denial of service of the USB host. On builds without that detection — earlier releases, or CONFIG_SYS_HEAP_HARDENING_NONE — the second free manipulates a chunk already on the free list, corrupting the heap's free list so that later allocations can return overlapping or invalid blocks. Exploitation beyond denial of service is bounded by the fact that usb_device_heap is a small dedicated heap (CONFIG_USBH_USB_DEVICE_HEAP, default 1024 bytes) whose only client is this descriptor buffer, and by CONFIG_USB_HOST_STACK being marked experimental and disabled by default. The fix sets udev->cfg_desc = NULL after every k_heap_free(), making the cleanup guard sound.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

Windows Storage Spaces Controller Elevation of Privilege Vulnerability

Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

Windows Message Queuing Remote Code Execution Vulnerability

Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.

Windows HTTP.sys Elevation of Privilege Vulnerability

Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.

In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Use‑After‑Free Race Condition Permitting Local Privilege Escalation on Android

In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.