CVE-2025-27491

CVE-2025-27491 is a Windows Hyper-V remote code execution vulnerability described in the initial document as a use-after-free that could allow an authenticated attacker to execute code over the network. Connected sources corroborate Hyper-V as the affected component and reference patch delivery i...

CVE-2025-33070

CVE-2025-33070 is reported in EU/NCSC context as affecting Windows Netlogon, caused by use of an uninitialized resource, enabling an unauthenticated attacker to obtain elevated privileges. The CVSS vector indicates network access is required with high impact on confidentiality, integrity, and ava...

CVE-2025-59509

CVE-2025-59509 affects Windows Speech, with the issue described as insertion of sensitive information into data sent by Windows Speech. The impact is local disclosure of information to an authorized attacker. The Connected documents confirm Windows-related fixes and hotpatch updates, but do not p...

CVE-2024-38045

Technical details about CVE-2024-38045 are not publicly provided in the supplied documents. References acknowledge a Windows TCP/IP remote code execution vulnerability but do not specify affected products, root cause, versions, or fixes; monitor for updates.

CVE-2024-43546

CVE-2024-43546 is a Windows Cryptographic Information Disclosure Vulnerability affecting Windows Cryptographic Services. The connected documents confirm Microsoft released October 2024 security updates (e.g., KB5044284, KB5044285, KB5044273, KB5044288, etc.) to fix this issue across Windows 11/10...

CVE-2024-43636

CVE-2024-43636 is a Win32k local elevation-of-privilege vulnerability with a CVSSv3.1 base score 7.8 (LOCAL, LOW PRIVILEGES, NO USER INTERACTION; impacts HIGH across confidentiality, integrity, and availability). CONNECTED documents confirm Windows OS components (Win32k) are affected and that Mic...

CVE-2024-49099

CVE-2024-49099 is a Windows WWAN Service (WwanSvc) information-disclosure vulnerability. The CVSS 3.1 base score is 4.3 (Medium) with attacker access via physical vector, low exploit complexity, requiring low privileges and no user interaction; confidentiality impact is High. Connected sources al...

CVE-2025-21261

Technical details about CVE-2025-21261 (affected product, vulnerability vector, impact, or patch) are not publicly provided in the connected documents; no concrete specifics are available here. Monitor official advisories and Microsoft/MSRC guidance for remediation.

CVE-2025-21409

CVE-2025-21409 is a Windows Telephony Service Remote Code Execution vulnerability exploitable over the network (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Connected sources confirm this CVE entry and link it to Windows Telephony Service across Microsoft advisories; updates KB5050009, KB5050...

CVE-2025-24067

CVE-2025-24067 is described in the connected documents as a heap-based buffer overflow in the Microsoft Streaming Service Driver that allows an authenticated, local attacker to elevate privileges. The vulnerability concerns the Windows kernel streaming service component and is listed with a high ...

CVE-2025-24995

CVE-2025-24995 is a heap-based buffer overflow in the Kernel Streaming WOW Thunk Service Driver that allows a locally authorized attacker to elevate privileges. The NVD entry confirms the vulnerable component and impact (local privilege elevation; high severity). Public references point to Micros...

CVE-2026-58640

CVE-2026-58640 is a heap-based buffer overflow in Windows NTFS that enables an authorized local attacker to execute code. The vulnerability is tied to Windows NTFS logic and has a CVSS v3.1 score of 7.3 (HIGH) with local access required and user interaction. Affected component: Windows NTFS; root...

CVE-2024-38141

CVE-2024-38141 is a Windows vulnerability in the Ancillary Function Driver for WinSock that enables local privilege escalation to SYSTEM. Connected sources indicate the issue is tied to the WinSock AF Dvr and that exploitation would require local access with low privileges and no user interaction...

CVE-2024-43642

CVE-2024-43642 is a Windows SMB Denial of Service vulnerability. The CVE entry is linked to Windows SMBv3 client/server components with a CVSS v3.1 base score of 7.5 (NETWORK attack vector, no privileges required, no user interaction, availability impact HIGH). Connected sources corroborate a Win...

CVE-2024-49123

CVE-2024-49123 is a Windows Remote Desktop Services remote code execution vulnerability. Public records in ENISA list CVE-2024-49123 under Windows Remote Desktop Services with a CVSS v3.1 base score of 8.1 (NETWORK, NONE/CONFLICTING constraints: high impact to confidentiality, integrity, and avai...

CVE-2025-21221

CVE-2025-21221: Heap-based buffer overflow in Windows Telephony Service enables remote code execution over the network. Exploitation requires network access, no privileges, and user interaction is needed; impact is high on confidentiality, integrity, and availability. Affected component: Windows ...

CVE-2025-21222

CVE-2025-21222 is a remote-code-execution vulnerability in Windows Telephony Service characterized by a heap-based buffer overflow that an unauthenticated attacker can trigger over the network. Connected sources corroborate its association with Windows Telephony Service and document it as a netwo...

CVE-2025-21358

Technical details about CVE-2025-21358 are not provided in the supplied documents. No affected products, vectors, or fixes are specified here; monitor for updates from official advisories.

CVE-2025-26670

CVE-2025-26670 is a Windows LDAP use-after-free vulnerability that enables remote code execution over the network. The available connected sources confirm the issue affects Windows LDAP and describe the underlying cause as a use-after-free condition, with the impact explicitly stated as remote co...

CVE-2026-21525

CVE-2026-21525 is a Windows Remote Access Connection Manager (RasMan) Denial of Service vulnerability caused by a NULL pointer dereference. An unauthenticated, locally-initiated attacker can trigger a crash of RasMan, impacting availability. Connected sources confirm this as a local DoS issue, wi...

CVE-2026-61918

CVE-2026-61918 is a Windows Remote Desktop Client vulnerability described as an out-of-bounds read that could allow an unauthenticated, remote attacker to disclose information over the network. The issue is confirmed in public CVE listings and is associated with the Remote Desktop Client componen...

CVE-2026-62713

CVE-2026-62713 : Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. Available documents identify the affected component as the Windows Cloud Files Mini Filter Driver, with a local attack vector and low privileges r...

CVE-2024-38114

Technical details for CVE-2024-38114 are not provided in the connected documents. The initial description notes a Windows IP Routing Management Snapin Remote Code Execution vulnerability with CVSS 3.1/8.8, but no affected versions, root cause, or mitigations are included here.

CVE-2025-21215

Technical details about CVE-2025-21215 are not provided in the connected documents. Public information here is limited to the vulnerability title and references; monitor for updates from Microsoft/NVD.

CVE-2025-21317

CVE-2025-21317 is a Windows Kernel Memory Information Disclosure vulnerability with CVSS 3.1/5.5 (LOCAL, LOW complexity, LOW privileges) and has the potential to expose confidential data from kernel memory. Connected documents confirm a Windows Kernel Memory Information Disclosure issue and indic...

CVE-2025-21349

CVE-2025-21349 is described by the connected NCSC advisory as a Windows vulnerability in Remote Desktop Services: a tampering flaw in the Windows Remote Desktop Configuration Service. The entry lists a CVSS v3.1 base score of 6.8 (Medium), with network access required (AV:N, UI:R, S:U) and high c...

CVE-2026-42977

CVE-2026-42977 describes a race condition in Windows Push Notifications caused by improper synchronization of a shared resource. This vulnerability enables an authorized, local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (HIGH) with Local attack vector, high complexity, and req...

CVE-2026-50472

The CVE-2026-50472 entry refers to a heap-based buffer overflow in Windows LUA File Virtualization Filter Driver (LUAFV) that allows an authorized, local attacker to achieve privilege escalation. Affected software is Windows LUAFV; the underlying issue is a heap-based overflow, leading to local p...

CVE-2026-54999

The CVE-2026-54999 entry concerns a race condition in Windows TCP/IP where concurrent access to a shared resource allows an unauthorized attacker on an adjacent network to execute code. Documented impact is remote code execution with high severity (CVSSv3.1: AV=A, AC=L, PR=N, UI=N, S=U, C=H, I=H,...

CVE-2024-38143

CVE-2024-38143 is a Windows WLAN AutoConfig Service elevation of privilege vulnerability. The CVSS 3.1 vector indicates an attacker must have physical access (AV:P) and exploit with high complexity, no user interaction, and local access (PR:N, UI:N). The vulnerability could yield elevated privile...

CVE-2025-21200

CVE-2025-21200 is listed by ENISA/NCSC as a vulnerability affecting the Windows Telephony Service with high impact and the ability to execute arbitrary code. The linked material specifies a CVSSv3.1 base score of 8.8 (Network attack, No user privileges, User interaction required; High confidentia...

CVE-2025-21217

CVE-2025-21217 is a Windows NTLM spoofing vulnerability with a CVSS v3.1 base score of 6.5 (Network, low attack complexity, no privileges required, user interaction required; Confidentiality impact: High). Exploitation details, affected products/versions, and a fixed patch are not provided in the...

CVE-2025-21224

CVE-2025-21224 refers to a Windows Line Printer Daemon (LPD) Service remote code execution vulnerability. The primary connected sources indicate an attacker could exploit a network remote vector to achieve code execution with no user interaction, with a CVSSv3.1 base score of 8.1 (AV:N/AC:H/PR:N/...

CVE-2025-21228

CVE-2025-21228 is a Windows Digital Media Elevation of Privilege vulnerability. The initial and related documents identify the issue as a Windows Digital Media component risk that could allow an attacker to obtain elevated privileges (Impact: high; Privileges Required: low; Attack Vector: physica...

CVE-2025-21269

CVE-2025-21269 is described as a Windows HTML Platforms Security Feature Bypass vulnerability. Connected CNVD/NCSC/KB entries reference a Windows HTML Platforms security feature bypass without detailed exploit steps; the Initial metrics show CVSS 3.1 (4.3, Network, UI: Required). Exploitation spe...

CVE-2025-21280

CVE-2025-21280 is a Windows Virtual Trusted Platform Module Denial of Service vulnerability. Connected documents identify the affected component as the Windows Virtual TPM and note an impact on availability. The NCSC advisory lists a CVSS v3.1 base score of 5.5 (LOCAL attack, LOW privileges requi...

CVE-2025-21373

Technical details for CVE-2025-21373 are not provided in the supplied documents. Monitor for updates from Microsoft and the KB/MSRC references for affected product, impact and fixes.

CVE-2025-27473

CVE-2025-27473 affects Windows HTTP.sys. Description in the connected sources confirms an uncontrolled resource consumption condition that enables a network-based Denial of Service, exploitable by an unauthorized attacker. The vulnerability impact is denial of service over the network; no exploit...

CVE-2026-70347

CVE-2026-70347 describes a heap-based buffer overflow in Windows Installer that can enable an authenticated, local attacker to elevate privileges. Affected component is Windows Installer; the vulnerability is a local, privilege-escalation flaw with high impact (C:H/I:H/A:H) and CVSSv3.1 score 7.8...

CVE-2024-38242

CVE-2024-38242: Kernel Streaming Service Driver Elevation of Privilege. A local attacker with low privileges can exploit this to gain SYSTEM-level access without user interaction (per CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; base 7.8). Microsoft has released updates to fix the issue (e.g., ...

CVE-2024-43628

According to the NCSC advisory, CVE-2024-43628 is a Windows Telephony Service Remote Code Execution vulnerability with a CVSS v3.1 base score of 8.8 (HIGH) and an impact described as Execute random code. The vulnerability is listed under Windows Telephony Service with a remediation path through M...

CVE-2024-43638

CVE-2024-43638 is a Windows USB Video Class System Driver Elevation of Privilege vulnerability. The connected sources corroborate a Windows USB Video Driver component as the affected area and indicate that mitigations are released via Microsoft security updates (e.g., November 2024 updates/KBs). ...

CVE-2024-49079

Technical details for CVE-2024-49079 are not provided in the supplied documents. Monitor for updates from Microsoft, NVD, CVE List, and other official sources as disclosures evolve.

CVE-2024-49088

CVE-2024-49088 affects the Windows Common Log File System Driver and is described as a local elevation of privilege vulnerability. The CVSS 3.1 vector (LOCAL, LOW complexity, LOW privileges required) with a base score of 7.8 indicates a high-risk, local-attack scenario resulting in high impact to...

CVE-2024-49104

The connected NCSC advisory (EUVD/NCSC) lists CVE-2024-49104 under Windows Routing and Remote Access Service (RRAS) with a high impact: Execution of arbitrary code (CVSS 8.80). The RRAS entry is described as vulnerable to arbitrary code execution, but the document does not provide root cause spec...

CVE-2025-21233

CVE-2025-21233 is a Windows Telephony Service Remote Code Execution vulnerability. External exploit is mapped to a network attack with user interaction required, high impact (CVSS v3.1: 8.8; Privileges Required: None; User Interaction: Required; Confidentiality/Integrity/Availability: High). Conn...

CVE-2025-21254

CVE-2025-21254 is associated with Internet Connection Sharing (ICS) in Windows and is described as a Denial-of-Service vulnerability. The primary documented impact is availability disruption (A) with low attack complexity and adjacent-attack vector, no authentication or user interaction required,...

CVE-2025-21281

CVE-2025-21281 is a Microsoft Windows COM elevation-of-privilege vulnerability. The CVE entry maps to Windows COM with a high CVSS v3.1 score (7.8, LOW_PRIVILEGES, LOCAL vector; no user interaction; confidentiality/integrity/availability impact: HIGH). The connected documents identify the affecte...

CVE-2025-21330

CVE-2025-21330 is a Windows Remote Desktop Services Denial-of-Service vulnerability. The connected sources confirm the vulnerability name and its impact class (DoS) with a CVSS v3.1 base score of 7.5 (Network attack vector, no privileges required, no user interaction). The provided documents do n...

CVE-2025-24987

CVE-2025-24987 is a Windows USB Video Driver vulnerability described as an out-of-bounds read that can allow an authorized attacker to elevate privileges with physical access. The issue affects the Windows USB Video Driver component and is associated with high impact on confidentiality, integrity...