Privilege Escalation
The latest Privilege Escalation coverage — news, analysis, and updates from the WindowsNews.AI desk.
Patch Now: Windows Graphics Kernel Race Condition (CVE-2025-55226) Puts Multi-User Systems at Kernel Compromise Risk
Microsoft has pushed out a security update to patch CVE-2025-55226, a high-severity race condition vulnerability in the Windows Graphics Kernel that enables an authenticated local attacker to execute...
Urgent: Windows Win32K GRFX Race Condition Exploitable for Kernel Code Execution – Patch Now
Microsoft has disclosed a dangerous race condition vulnerability in the Windows graphics subsystem’s Win32K component, tracked as CVE-2025-55228, that allows an authenticated local attacker to gain...
The CVE That Isn't There: DirectX Kernel Race Condition Panic and the Patches You Actually Need
Microsoft's August 2025 security updates landed with a thud for Windows administrators, but not all of them came with a neat advisory. In forums across the web, sysadmins are chasing a ghost:...
Windows NTLM Vulnerability Lets Attackers Escalate Privileges Over the Network — Patch Immediately
Microsoft is urging Windows administrators to patch a critical improper authentication vulnerability in NT LAN Manager (NTLM) that allows an authenticated attacker to elevate privileges over a...
Windows NEGOEX Integer Overflow Lets Attackers Escalate to SYSTEM—Patch Now
Microsoft has released a security update to plug a critical elevation-of-privilege hole in the Windows NEGOEX authentication mechanism. Tracked as CVE-2025-54895, the flaw stems from an integer...
Microsoft Patches Use-After-Free in Windows XAML DatePickerFlyout That Could Elevate Local Privileges
Microsoft has assigned CVE-2025-54111 to a use‑after‑free vulnerability in the Windows UI XAML Phone DatePickerFlyout control, warning that an authenticated local attacker could exploit the flaw...
Microsoft Urges Immediate Patching for Windows Kernel Privilege-Escalation Flaw CVE-2025-54110
Microsoft has released a security update to patch a high-severity vulnerability in the Windows kernel, tracked as CVE-2025-54110, that allows a local attacker to escalate privileges to SYSTEM level....
Windows CDPSvc Elevation Flaw (CVE-2025-54102) Patched; Attackers Could Seize SYSTEM Control
A high-severity vulnerability in the Windows Connected Devices Platform Service (CDPSvc), cataloged as CVE-2025-54102, can be exploited by a low-privileged local attacker to gain NT AUTHORITY\SYSTEM...
CVE-2025-54099: Windows Winsock Driver Stack Overflow Threatens SYSTEM Access
A stack-based buffer overflow in the Windows Ancillary Function Driver for WinSock (afd.sys) can be exploited by local attackers to seize SYSTEM privileges, Microsoft disclosed in a security...
Hyper-V PowerShell Direct Flaw Lets Attackers Impersonate Admins, Microsoft Urges Patching
Microsoft has disclosed a new elevation-of-privilege vulnerability (CVE-2025-49734) in Windows Hyper-V’s PowerShell Direct feature that lets a locally authenticated attacker with low privileges...
GhostRedirector Sneaks Native Backdoors Into IIS to Hijack SEO Rankings
A stealthy campaign that has compromised at least 65 Internet-facing Windows IIS servers worldwide is using a pair of previously unseen native implants to convert legitimate websites into invisible...
The Day Silent MSI Repairs Died: Inside KB5063878’s UAC Uprising Across Windows Fleets
Microsoft’s August 12, 2025 cumulative update—packaged as KB5063878 for Windows 11 24H2 (OS Build 26100.4946)—shattered a core enterprise assumption that silent per-user MSI repairs would run...