CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-24997

Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally...

CVE-2025-24994

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally...

CVE-2025-24995

Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

CVE-2025-24991

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally...

CVE-2025-24987

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack...

CVE-2025-24983

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

CVE-2025-24076

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally...

CVE-2025-24067

Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally...

CVE-2025-24066

Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2025-24067

Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally...

CVE-2025-24059

Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

CVE-2025-24050

Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally...

CVE-2025-24050

Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally...

CVE-2025-24055

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack...

CVE-2025-24044

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

CVE-2025-21199

Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally...

CVE-2024-9157

UNSUPPORTED WHEN ASSIGNED A privilege escalation vulnerability in CxUIUSvc64.exe and CxUIUSvc32.exe of Synaptics audio drivers allows a local authorized attacker to load a DLL in a privileged process. Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and...

CVE-2025-26627

CVE-2025-26627 affects Microsoft Azure Arc Installer. The issue is an improper neutralization of special elements in a command (command injection) that allows an authorized local attacker to elevate privileges. The root cause is described across sources as a command injection vulnerability in Azu...

CVE-2025-24072

CVE-2025-24072 is a use-after-free vulnerability in Microsoft Local Security Authority Server (lsasrv) that can allow an authorized attacker to locally elevate privileges. The affected component is lsasrv; impact is elevated privileges (local). Connected sources (including NCSC/KB advisories) con...