2028 matches found
CVE-2025-21240
CVE-2025-21240 is a Windows Telephony Service remote code execution vulnerability. The CIRCL sighting data lists Windows Telephony Service with CVSS 8.80 (High) and impact: Execute random code, consistent with the CVSS vector in the Initial Description (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Conne...
CVE-2025-21367
CVE-2025-21367 targets the Windows Win32 Kernel subsystem with a local elevation-of-privilege flaw. The NVD entry lists a CVSS v3.1 base score of 7.8 (HIGH) with local access, low attack complexity, and privileges required, and the impact to confidentiality, integrity, and availability as HIGH. C...
CVE-2025-29963
CVE-2025-29963 describes a heap-based buffer overflow in Windows Media/Windows Media Foundation that could allow a remote attacker to execute code over the network. The connected documents indicate the issue affects Windows Media related components and has been addressed in May 2025 security upda...
CVE-2025-33075
CVE-2025-33075 affects Windows Installer and is tied to an improper link resolution before file access (a link following issue). The root cause enables a locally authenticated attacker to achieve privilege escalation (local, high impact). The NCSC advisory aggregates list CVE-2025-33075 under Win...
CVE-2025-54109
CVE-2025-54109 affects Windows Defender Firewall Service. The vulnerability is described as a type confusion that can enable local privilege escalation by an authorized attacker. Connected sources (NCSC advisory) list CVE-2025-54109 with a base score of 6.7 (Medium) and attribute the impact to lo...
CVE-2026-26182
CVE-2026-26182 is a Windows elevation-of-privilege vulnerability caused by a use-after-free in the Windows Ancillary Function Driver for WinSock. The impact is local privilege escalation for an authorized user, as described by multiple sources. Public notices confirm the issue affects Windows com...
CVE-2026-61367
The CVE-2026-61367 entry describes a local Privilege Escalation in Windows Remote Desktop Services caused by missing authentication for a critical function. An authorized attacker can elevate privileges locally (ATT&CK-style: Privilege Escalation) with a CVSSv3.1 base score of 7.8 (HIGH) and LOCA...
CVE-2026-62741
CVE-2026-62741 is a Windows HTTP.sys elevation-of-privilege vulnerability caused by an integer underflow/wrap in HTTP.sys. An authorized local attacker can elevate privileges. Affected: Windows HTTP.sys. Root cause: integer underflow; Impact: local privilege escalation with high confidentiality/i...
CVE-2026-62751
CVE-2026-62751 describes an integer overflow or wraparound in Windows Projected File System that enables a locally authenticated attacker to elevate privileges. The entry cites a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, LOW attack complexity, and privileges required as LOW; im...
CVE-2024-38147
CVE-2024-38147 is a local privilege escalation in the Windows DWM Core Library. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, LOW privileges required, and NONE user interaction, resulting in HIGH impact to confidentiality, integrity, and availability. The initial and connected d...
CVE-2024-38148
CVE-2024-38148 is documented in the provided connected documents as a Windows Schannel/ Transport Layer Security denial-of-service vulnerability (CVSS v3.1 base score 7.5, NETWORK attack vector, no user interaction). The associated impacts in the sources indicate a DoS condition affecting Windows...
CVE-2024-43516
Technical details about CVE-2024-43516 are not provided in the connected documents. Public details appear limited in the supplied sources. Monitor for updates.
CVE-2024-49073
CVE-2024-49073 affects the Windows Mobile Broadband Driver and is an elevation-of-privilege vulnerability. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates physical access is required, with low attack complexity and no privileges required, but with high impact to confidentialit...
CVE-2025-21278
CVE-2025-21278 is a Windows Remote Desktop Gateway (RD Gateway) Denial of Service vulnerability. The NVD entry lists a local attack vector with low attack complexity and a high availability impact (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H; base score 5.5; CNA score 6.2). Exploitation status...
CVE-2025-21300
CVE-2025-21300 affects Windows UPnP Device Host. Connected CNVD data ties the issue to the Windows upnphost.dll component and a Denial of Service impact. Microsoft has published January 2025 security updates to address this family of issues; applying KB5050021 (and related January 2025 updates) i...
CVE-2025-21305
CVE-2025-21305 is documented as a Windows Telephony Service Remote Code Execution vulnerability. The connected CIRCL source explicitly lists CVE-2025-21305 under Windows Telephony Service with an impact described as Execute random code, indicating a code-execution vector in the Telephony service....
CVE-2025-21321
CVE-2025-21321 refers to a Windows Kernel Memory Information Disclosure vulnerability. Documentation confirms it affects Windows kernel memory and was addressed by January 2025 security updates (e.g., KB5050009, KB5050021, KB5049984, KB5049981, KB5049993). The CVSS shows local access with low pri...
CVE-2025-21323
Technical details about CVE-2025-21323 are not publicly available in provided connected documents. Records confirm the CVE exists and is linked to Windows Kernel Memory Information Disclosure, but no affected products, versions, root cause, or fixes are described here. Monitor updates.
CVE-2025-21339
CVE-2025-21339 corresponds to a Windows Telephony Service remote code execution vulnerability. The NCSC listing confirms a high-severity impact (CVSS 3.1: AV Network, AC L, PR None, UI Required, S U, C/H/I/A H) with an overall score of 8.80 and notes that exploitation can lead to executing code i...
CVE-2025-26641
CVE-2025-26641 affects Windows Cryptographic Services, causing Denial of Service via uncontrolled resource consumption over the network. Base score 7.5 (Network, High availability impact). Exploitation status not detailed in the provided connected documents; remediation per Microsoft security upd...
CVE-2025-29842
Technical details (affected product, root cause, impact, fixes) for CVE-2025-29842 are not provided in the supplied connected documents. Monitor for updates from official advisories.
CVE-2025-33057
CVE-2025-33057 is a Windows Local Security Authority (LSA) vulnerability where a null pointer dereference could allow an authorized attacker to cause a network-based Denial-of-Service. Affected component is LSA; impact is DoS over the network. Documented in NVD and corroborated by NC SC/NCSC entr...
CVE-2026-20922
CVE-2026-20922 is a heap-based buffer overflow in Windows NTFS that enables a locally authenticated attacker to execute code. The description and connected sources confirm NTFS as the vulnerable component and local execution as the impact. Public details in the provided documents are consistent w...
CVE-2026-61928
An issue affecting Windows Hello : sensitive information is stored in cleartext, allowing an authorized local attacker to tamper with the system. The CVSSv3.1 vector indicates a local, low-complexity attack requiring low privileges with a high integrity impact (I:H). Base score 5.5 (Medium). No e...
CVE-2026-62877
CVE-2026-62877 is a Windows Win32K vulnerability described as a stack-based buffer overflow that enables local privilege escalation by an authorized user. The affected component is the Windows Win32K subsystem; the root cause is a stack-based buffer overflow within Win32K code paths. The CVSS vec...
CVE-2024-43523
CVE-2024-43523 refers to a Windows Mobile Broadband Driver remote code execution vulnerability. Microsoft and CVE records indicate fixes are delivered via October 2024 security updates (e.g., KB5044284 and related servicing stacks), with mitigations requiring installation of those updates. The CV...
CVE-2024-43571
Technical details about CVE-2024-43571 are not publicly provided in the supplied documents. Monitor official advisories (MSRC/update guides) for affected products, impact, and fixes.
CVE-2024-49087
CVE-2024-49087 affects the Windows Mobile Broadband Driver in Windows. It is an information-disclosure vulnerability in the Mobile Broadband component, with CVSS v3.1 base score 4.6 (AV: Physical, AC: Low, PR: None, UI: None, S: Unchanged; C: High, I: None, A: None). Exploitation requires physica...
CVE-2025-21207
Technical details about CVE-2025-21207 (Windows Cdpsvc DoS) are not publicly disclosed in the provided documents. Monitor updates from Microsoft and CVE pages for affected versions, impact details, and fixes.
CVE-2025-21258
Technical details about CVE-2025-21258 are not publicly provided in the supplied documents. No affected product/version/root cause/exploit or remediation details are present here; please consult Microsoft advisories for updates.
CVE-2025-49691
CVE-2025-49691 is a heap-based buffer overflow in Windows Media that could allow an adjacent-network attacker to execute code. CVSSv3.1 base score 8.0 (AV: Adjacent, AC: Low, PR: None, UI: Required, S: Unchanged, C/I/A: High). The connected documents indicate this affects Windows Media and has co...
CVE-2025-54918
CVE-2025-54918 describes an improper authentication flaw in Windows NTLM that enables a network-authenticated attacker to elevate privileges. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and privileges required. A PoC exploit exists on GitHub (CVE-2025-54918-...
CVE-2026-26179
Technical details about CVE-2026-26179 are not provided in the available documents; no product/version specifics or exploit information are disclosed. Monitor for updates.
CVE-2026-40405
Technical details about CVE-2026-40405 are not publicly provided in the connected documents. The materials reiterate a Windows TCP/IP null pointer dereference causing potential denial of service. Monitor for updates from official sources for impact, affected products, and fixes.
CVE-2026-50500
CVE-2026-50500 is a Windows Netlogon use-after-free vulnerability allowing an authenticated attacker to elevate privileges over the network. The affected component is Windows Netlogon; impact is elevation of privileges (CVE-2026-50500, CVSS 7.5). Connected sources reference Microsoft advisories a...
CVE-2026-59125
Use-after-free in the Virtual Hard Disk (VHD) Miniport Driver can allow an authorized local attacker to elevate privileges. The vulnerability is described as a local privilege escalation with high impact to confidentiality, integrity, and availability. The CVSS vector indicates LOCAL access, user...
CVE-2026-70330
CVE-2026-70330 is a heap-based buffer overflow in the Windows DNS service that allows an authorized attacker to elevate privileges locally . NVD assigns a CVSS 3.1 score of 7.8 (HIGH) with low privileges required, while Microsoft's CNA score is 6.7 (MEDIUM) requiring high privileges. CISA SSVC as...
CVE-2024-38235
CVE-2024-38235 is listed under Windows Hyper-V with a CVSS v3.1 score of 6.50 and impact described as a Denial-of-Service. The connected NCSC advisory confirms Windows vulnerabilities fixed in this cycle; it recommends applying the Microsoft updates per MSRC guidance. The provided documents do no...
CVE-2024-43515
CVE-2024-43515 is described in the provided documents as an Internet Small Computer Systems Interface (iSCSI) Denial of Service vulnerability with CVSS v3.1 base score 7.5. The NCSC advisory explicitly lists CVE-2024-43515 under Windows iSCSI as a 7.50 Denial-of-Service, indicating a DoS impact f...
CVE-2024-43537
CVE-2024-43537 is a denial-of-service vulnerability in the Windows Mobile Broadband Driver. Public sources confirm an availability impact (DoS) with the CVSS=3.1 vector: Adjacent attacker, Low attack complexity, No privileges required, No user interaction, Scope unchanged, Confidentiality/Integri...
CVE-2025-29959
Technical details about CVE-2025-29959 are not publicly available in the provided connected documents. The initial description notes a RRAS uninitialized resource issue, but no product/version/root-cause/fix specifics are present here; monitor official advisories for updates.
CVE-2025-32724
CVE-2025-32724 affects Windows Local Security Authority Subsystem Service (LSASS). The connected NC SC advisory and MS security-update artifacts identify this as a Denial-of-Service vulnerability with CVSS v3.1 base score 7.5 (NETWORK, LOW complexity, NONE privileges, NONE user interaction) and s...
CVE-2025-33062
CVE-2025-33062 affects the Windows Storage Management Provider and is characterized as an out-of-bounds read that can allow an attacker with local access to disclose information. The NVD entry notes a CVSS v3.1 base score of 5.5 (Local, Low exploit complexity, Privileges Required: Low, Confidenti...
CVE-2025-47973
Technical details about CVE-2025-47973 are not publicly disclosed in the provided documents. No affected products, root cause, or remediation are described here. Monitor for updates from the sources.
CVE-2026-42900
The CVE-2026-42900 entry concerns a race condition caused by improper synchronization in the Windows App Store. Reported impact is privilege elevation over a network, implying an unauthorized attacker could exploit a timing-related flaw to escalate access. Documents consistently describe a concur...
CVE-2026-62698
The CVE-2026-62698 entry concerns a numeric truncation error in Microsoft Digest Authentication. The vulnerability is described as enabling a locally authenticated attacker to achieve privilege elevation (base score 7.8, CVSS 3.1, LOCAL, LOW privileges required, NONE user interaction, HIGH impact...
CVE-2026-62894
CVE-2026-62894 describes a heap-based buffer overflow in the Windows DWM Core Library that allows an authenticated local attacker to elevate privileges. The vulnerability is documented across CVE/NVD listings with a CVSSv3.1 base score of 7.8 (HIGH), vector: LOCAL, LOW attack complexity, and NONE...
CVE-2024-38247
CVE-2024-38247 is a Windows Graphics Component local elevation of privilege vulnerability. The CVSSv3.1 vector shows Attack Vector: Local, Privileges Required: Low, User Interaction: None, with all of Confidentiality/Integrity/Availability impacts: High. Public documents confirm a Windows patch r...
CVE-2024-43557
CVE-2024-43557 is a Windows Mobile Broadband Driver vulnerability categorized as a Denial-of-Service. The initial entry assigns a CVSS 3.1 base score of 6.5 (AV:A, AC:L, PR:N, UI:N, S:U, C:N, I:N, A:H). Connected documents confirm Windows-wide advisories and fixes addressing this family of issues...