Microsoft Patches Multiple Windows Elevation-of-Privilege Flaws Across Core Services

Microsoft published security updates for a series of Windows elevation-of-privilege vulnerabilities affecting components including Core Messaging, CSC Service, Cryptographic Services, Win32k, and the COM+ Event System Service. The referenced flaws include CVE-2025-21378, CVE-2025-21184, CVE-2025-21414, CVE-2025-26634, CVE-2025-49727, CVE-2025-58725, and CVE-2025-62458, indicating a broad set of local privilege-escalation issues across core Windows subsystems.

Among them, Microsoft provided additional detail for CVE-2026-40377, an Important vulnerability in Microsoft Cryptographic Services caused by a heap-based buffer overflow. Microsoft said a locally authorized attacker with low privileges could exploit the flaw to gain SYSTEM privileges without user interaction; the issue received a CVSS 3.1 score of 7.8, was assessed as less likely to be exploited, and was not publicly disclosed or exploited at the time of publication. Microsoft said a fix was available and credited Bruce Dang of Calif.io for reporting the bug.