CVE-2025-21228

CVE-2025-21228 is a Windows Digital Media Elevation of Privilege vulnerability. The initial and related documents identify the issue as a Windows Digital Media component risk that could allow an attacker to obtain elevated privileges (Impact: high; Privileges Required: low; Attack Vector: physica...

CVE-2025-21237

CVE-2025-21237 is a Windows Telephony Service Remote Code Execution vulnerability. Exploitation could allow remote code execution via the Telephony Service; CVSS v3.1 base score 8.8 (HIGH) with network access, user interaction required. Affected products are Windows components where Telephony Ser...

CVE-2025-24987

CVE-2025-24987 is a Windows USB Video Driver vulnerability described as an out-of-bounds read that can allow an authorized attacker to elevate privileges with physical access. The issue affects the Windows USB Video Driver component and is associated with high impact on confidentiality, integrity...

CVE-2025-32707

CVE-2025-32707 is a localprivilege-escalation vulnerability in the Windows NTFS subsystem caused by an out-of-bounds read. The NCSC vulnerability listing confirms Windows NTFS involvement and classifies the impact as elevated privileges, with a CVSS v3.1 base score of 7.8 (HIGH) and a local attac...

CVE-2026-25187

CVE-2026-25187 is a Winlogon elevation-of-privilege vulnerability described as improper link resolution before file access (link following). It is a local vulnerability in Windows Winlogon that could allow an authorized attacker to elevate privileges to SYSTEM with no user interaction required. T...

CVE-2026-62889

CVE-2026-62889 is a Windows SSTP remote code execution vulnerability caused by a double free in the SSTP implementation. The available descriptions from NVD and CVE records state that an unauthenticated attacker could exploit this over a network to execute arbitrary code. The CVSS 3.1 base score ...

CVE-2022-35759

Technical details for CVE-2022-35759 (affected product, root cause, impact, and fix) are not provided in the connected documents. Monitor for updates.

CVE-2023-32035

Technical details for CVE-2023-32035 (affected product/component/version/root cause/mitigation) are not provided in the connected documents. The initial description only notes a Remote Procedure Call Runtime Denial of Service vulnerability without concrete details. Monitor updates from official s...

CVE-2024-30069

Technical details for CVE-2024-30069 are not provided in the connected documents. Public information about affected products, root cause, exploitation, and remediation is not present here. Monitor official sources for updates.

CVE-2024-37974

Technical details about CVE-2024-37974 are not provided in the given documents. The connected items mention related issues (e.g., BitLocker / Secure Boot references) but do not reveal affected products, root cause, or remediation for this CVE. Monitor for updates.

CVE-2024-37989

Technical details and affected products for CVE-2024-37989 are not publicly provided in the supplied documents. Monitor for vendor advisories and CVE repositories for updates.

CVE-2024-38013

Technical details about CVE-2024-38013 are not disclosed in the provided connected documents. The CVE entry exists (Windows Server Backup elevation of privilege), but no affected product versions, root cause, exploitation, or remediation are described here. Monitor for updates.

CVE-2024-38034

Public technical details for CVE-2024-38034 are not provided in the connected documents. The sources reference related updates and other CVEs but do not specify affected products, versions, root cause, or remediation for this CVE. Monitor for updates.

CVE-2024-38057

Technical details about CVE-2024-38057 (affected product/version, root cause, exploitability, and fix) are not provided in the connected documents. Monitor for updates from vendor/security advisories.

CVE-2024-38242

CVE-2024-38242: Kernel Streaming Service Driver Elevation of Privilege. A local attacker with low privileges can exploit this to gain SYSTEM-level access without user interaction (per CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; base 7.8). Microsoft has released updates to fix the issue (e.g., ...

CVE-2024-43509

CVE-2024-43509 is listed in connected advisories as affecting the Windows Graphics Component with an elevation of privilege impact. The ENISA/NCSC entries corroborate this CVE under Windows Graphics Component and assign an impact/score (7.80) and local, privilege‑required conditions. Concrete det...

CVE-2024-49075

Technical details for CVE-2024-49075 are not publicly provided in the connected documents. The sources reference Windows Remote Desktop Services DoS but do not specify affected versions, root cause, exploit information, or fixes within this corpus. Monitor for updates.

CVE-2025-21406

CVE-2025-21406 is listed by NCSC as a Windows Telephony Service vulnerability with CVSS 8.80, enabling execution of arbitrary code. No affected product/version details or patch specifics are provided in the connected documents; Microsoft updates are referenced generally as fixing vulnerabilities....

CVE-2025-24051

Technical details about CVE-2025-24051 are not publicly provided in the connected documents. The initial entry notes a heap overflow in RRAS enabling remote code execution, but no affected versions, exploit specifics, or mitigations are present here. Monitor for updates.

CVE-2025-24056

CVE-2025-24056 is a heap-based buffer overflow in the Windows Telephony Server that allows a network-based attacker to execute arbitrary code on affected systems. The issue is described as remote code execution with network access (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a base score of 8.8 (HIG...

CVE-2025-24060

CVE-2025-24060 affects Windows DWM Core Library and is caused by improper input validation, enabling local elevation of privileges for an authorized attacker. Microsoft lists mitigations via OS updates (April 2025 security updates) and related advisories; apply the provided patches to remediate. ...

CVE-2026-21530

CVE-2026-21530 : A double-free vulnerability in Windows Rich Text Edit is described as enabling an authorized attacker to perform local privilege escalation. The connected documents confirm the affected component and the local-privilege-elevation impact but do not provide exploit details, specifi...

CVE-2023-32034

Technical details for CVE-2023-32034 are not publicly available in the provided documents. No specifics on affected products, versions, root cause, impact, or mitigations are included here. Monitor for updates.

CVE-2023-35305

Technical details about CVE-2023-35305 are not publicly provided in the supplied documents. Monitor for updates from Microsoft and security bulletins for affected product/version, impact, and remediation.

CVE-2023-35326

CVE-2023-35326 (Windows CDP User Components Information Disclosure) affects Windows CDP User Components and is rated CVSS v3.1 base 5.5 (LOCAL, Privileges Low, Confidentiality High). Evidence from NVD shows Information Disclosure vulnerability with Local access and high confidentiality impact; Mi...

CVE-2023-35340

Microsoft Windows CVE-2023-35340 affects the CNG Key Isolation Service and is a local elevation-of-privilege vulnerability. It has a CVSS v3.1 base score of 7.8 (AV:L, AC:H, PR:L, UI:N, S:C, C:H, I:H, A:H). The provided documents identify the affected component and impact but do not include explo...

CVE-2024-37973

Technical details about CVE-2024-37973 are not provided in the connected documents. The supplied materials reference related items (e.g., CVE-2024-38058) but do not disclose affected products, root cause, impact, or fixes for CVE-2024-37973. Monitor for updates.

CVE-2024-38010

Technical details (affected product, root cause, impact, fixes) for CVE-2024-38010 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2024-38025

Technical details about CVE-2024-38025 are not provided in the supplied connected documents; no vendor/product/version/root-cause/impact/fix details are visible. Monitor for updates in case additional information becomes available.

CVE-2024-38146

CVE-2024-38146 affects the Windows Layer-2 Bridge Network Driver. The CVSS 3.1 base score is 7.5 (HIGH) with Network attack, low complexity, no privileges, no user interaction, and high availability impact. Descriptions in connected OpenVAS items corroborate a DoS impact on Windows Layer-2 Bridge...

CVE-2025-21217

CVE-2025-21217 is a Windows NTLM spoofing vulnerability with a CVSS v3.1 base score of 6.5 (Network, low attack complexity, no privileges required, user interaction required; Confidentiality impact: High). Exploitation details, affected products/versions, and a fixed patch are not provided in the...

CVE-2025-21236

CVE-2025-21236 is a Windows Telephony Service remote code execution vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-based access with low complexity, requiring user interaction, and with high impact across confidentiality, integrity, and availability. Th...

CVE-2025-21244

Technical details for CVE-2025-21244 are not provided in the connected documents. They reference a Windows Telephony Service RCE but do not disclose affected versions, root cause, exploit methods, or fixes. Monitor official advisories for updates.

CVE-2025-21250

CVE-2025-21250 is a Windows Telephony Service Remote Code Execution vulnerability with CVSS 3.1 base score 8.8 (Network, Low attack complexity, No privileges, User interaction required). Connected sources reference the Windows Telephony Service as the affected component and indicate in CIRCL that...

CVE-2025-27476

CVE-2025-27476 is a Windows Digital Media use-after-free vulnerability that enables local privilege escalation on an affected system. Governance: the initial description confirms local elevation of privileges; connected Microsoft advisories and NVD entries indicate Windows Digital Media is the af...

CVE-2026-59132

CVE-2026-59132 describes a null pointer dereference in Windows TCP/IP that enables a network-based denial of service by an unauthenticated attacker. Affected component is Windows TCP/IP; root cause is a null pointer dereference leading to denial of service. CVSSv3.1 base score is 7.5 (HIGH) with ...

CVE-2026-62784

Microsoft Local Security Authority Server (lsasrv) is affected by CVE-2026-62784 due to a heap-based buffer overflow that allows an authorized attacker to execute code over the network. CVSS v3.1 score: 8.8 (High) with Network access, Low complexity, Privileges Required: Low, User Interaction: No...

CVE-2022-35747

Technical details for CVE-2022-35747 are not provided in the connected documents. No affected products, root cause, impacts, or fixes are specified beyond the generic description. Monitor for updates for public disclosure and remediation guidance.

CVE-2023-32045

Technical details about CVE-2023-32045 are not provided in the supplied documents. For updates and potential remediation, monitor official advisories (MSRC) and NVD entries.

CVE-2023-35361

CVE-2023-35361 is a Windows Kernel Elevation of Privilege vulnerability. The provided documents identify the flaw as a local-privilege escalation with high impact (confidentiality, integrity, and availability) but do not supply concrete technical details, affected versions, root cause specifics, ...

CVE-2023-35364

Technical details about CVE-2023-35364 (affected product, root cause, impact, mitigations) are not publicly provided in the supplied documents. Monitor for updates from official advisories; current sources here do not disclose concrete specifics.

CVE-2023-35641

CVE-2023-35641 is an Internet Connection Sharing (ICS) remote code execution in Windows. Connected sources confirm affected component (Windows ICS) and classify the impact as remote code execution with the attacker needing adjacent network access, no user interaction, and no privileges required (...

CVE-2023-36696

CVE-2023-36696 affects the Windows Cloud Files Mini Filter Driver and is described as an Elevation of Privilege vulnerability. The issue is exploitable locally (AV:L, PR:L) with no user interaction required and could lead to high impact (C:H/I:H/A:H) as per CVSS3.1. Connected sources (ENISA EUVD,...

CVE-2024-38065

Technical details about CVE-2024-38065 (affected product/component/impact) are not provided in the supplied documents. No concrete exploit or remediation information is available here. Monitor for official disclosures and updated advisories.

CVE-2024-43621

CVE-2024-43621 affects Windows Telephony Service (a Windows OS component). The vulnerability is a Remote Code Execution flaw in the Windows Telephony Service, with CVSS 3.1 base metrics indicating Network attack vector, no privileges required, and user interaction needed; impact is High/High/High...

CVE-2025-21202

CVE-2025-21202 is a Windows Recovery Environment Agent elevation-of-privilege vulnerability. The consolidated sources show an impact of obtaining elevated privileges (CVE mapped under Windows Recovery Environment Agent) with a CVSS-like score around 6.1 (Medium) and physical access as a considera...

CVE-2025-21231

CVE-2025-21231 documents describe a Denial-of-Service vulnerability in the Windows IP Helper component. The CVE entry lists a network-based attack vector with low attack complexity and no privileges required, resulting in availability impact. Connected records corroborate IP Helper as the affecte...

CVE-2025-21407

According to the provided documents, CVE-2025-21407 is associated with Windows Telephony Service and is listed with a high impact (CVSS 8.80) involving the execution of arbitrary code. The NCSC advisory explicitly catalogs CVE-2025-21407 under Windows Telephony Service with an impact of executing...

CVE-2025-26687

CVE-2025-26687 is a use-after-free in Windows Win32K - GRFX that enables a network-based privilege escalation. The affected component is the Win32K GRFX graphics subsystem; the underlying issue is a use-after-free in that path, leading to total impact (CVE-2025-26687 shows a base score of 7.5/10 ...

CVE-2026-20856

CVE-2026-20856 is a Windows Server Update Services (WSUS) remote code execution vulnerability caused by improper input validation. Exploitation is possible over a network with no user interaction; CVSSv3.1 base score 8.1 (High). Public references note this is addressed by January 2026 security up...