4267 matches found
CVE-2024-43518
CVE-2024-43518 is associated with Windows Telephony Server, categorized (in the ENISA/NCSC context) as a high-severity remote code execution vulnerability with an 8.80 CVSS score and impact of executing arbitrary code. The connected advisory set indicates Microsoft has issued updates to fix Windo...
CVE-2024-43549
CVE-2024-43549 is documented as a Windows RRAS (Routing and Remote Access Service) Remote Code Execution vulnerability. Connected sources label the impact as running arbitrary code on the affected RRAS component when exposed over the network, with a base CVSS v3.1 score of 8.8 (HIGH) and network ...
CVE-2025-26665
CVE-2025-26665 affects Windows UPnP Device Host (upnphost.dll). The issue is described as sensitive data stored in memory that is not properly locked, enabling a local attacker with authorized access to obtain increased entitlements (privilege escalation). Connected sources corroborate the impact...
CVE-2026-40378
CVE-2026-40378 affects Windows Local Security Authority Subsystem Service (LSASS). A memory allocation with an excessive size value can allow an unauthenticated attacker to cause a network-based denial of service. The CVSSv3.1 base score is 7.5 (HIGH). No exploitation details are provided in the ...
CVE-2026-62728
The vulnerability CVE-2026-62728 affects Windows systems via the Common Log File System (CLFS) Driver. It is a time-of-check time-of-use (TOCTOU) race condition that allows an authorized, local attacker to elevate privileges. The CVSSv3.1 metrics indicate a Local attack, High impact on confidenti...
CVE-2015-2455
CVE-2015-2455 (TrueType Font Parsing Vulnerability) is a Windows font-processing defect discovered via Project Zero fuzzing of the Windows kernel font stack (win32k.sys and ATMFD.DLL) affecting TrueType fonts and related SFNT tables. The Google Project Zero report outlines that incorrect handling...
CVE-2015-2478
CVE-2015-2478 is the Windows Winsock Elevation of Privilege vulnerability. A crafted application can trigger a Winsock call referencing an invalid address, enabling local privilege escalation on multiple Windows platforms: Windows Vista SP2, Server 2008 SP2/R2, Windows 7 SP1, Windows 8/8.1, Windo...
CVE-2016-7259
CVE-2016-7259 affects the Windows Graphics Component in kernel-mode drivers (Win32k) across multiple Windows platforms, allowing local privilege escalation via a crafted application. The root cause is improper handling of memory objects by the Graphics component, enabling privilege elevation (loc...
CVE-2017-0074
CVE-2017-0074 is a Hyper-V denial-of-service vulnerability affecting Windows Hyper-V across multiple Windows client and server editions. Connected sources (CNVD entries) describe a Hyper-V DoS where a crafted application can crash the host, affecting Hyper-V guests; specific affected versions ali...
CVE-2018-0810
CVE-2018-0810 affects the Windows kernel in Windows 7 SP1, Windows Server 2008 SP2/R2, and Windows Server 2012. The vulnerability is an information-disclosure flaw caused by the way memory is initialized, enabling a local attacker to obtain information through memory handling defects. The CVSS da...
CVE-2018-0894
Technical details about CVE-2018-0894 are not provided in the connected documents. The initial entry describes an information disclosure vulnerability in Windows kernels across multiple versions, but no affected product specifics, fixes, or exploit data are included here. Monitor for updates.
CVE-2018-0975
CVE-2018-0975 is an information-disclosure vulnerability in the Windows kernel that could enable an attacker to obtain information leading to a Kernel ASLR bypass. The Initial document lists affected Windows platforms (Windows 7, Windows Server 2008/2012/2016, Windows 8.1, Windows 10 and correspo...
CVE-2019-1424
CVE-2019-1424 is a Windows Netlogon security feature bypass vulnerability. Public data describe a vulnerability in how the Netlogon secure channel is handled, with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and a NETWORK attack vector, no user interaction required. No exp...
CVE-2020-0664
Technical details about CVE-2020-0664 are not publicly provided in the supplied documents. This entry's information disclosure is described, and remediation is patching ADIDNS handling in memory, but no affected versions or exploit specifics are included here. Monitor for updates.
CVE-2020-0675
CVE-2020-0675 affects the Windows Cryptography Next Generation (CNG) service. The vulnerability arises from the service’s failure to properly handle objects in memory, enabling an information disclosure when a logged-on attacker runs a specially crafted application. The issue is addressed by a se...
CVE-2020-0772
CVE-2020-0772 is a Windows Error Reporting memory-handling bug causing local privilege escalation. The vulnerability requires local execution and has a CVSSv3.1 base score of 7.8 (HIGH) with local attack, low attack complexity, and no user interaction. The description does not provide a patch or ...
CVE-2020-0922
Technical details about CVE-2020-0922 are not provided in the connected documents. The Initial Description only notes a remote code execution in Microsoft COM for Windows with a fix in a security update; no product/version/root-cause/exploit details are included here. Monitor for official disclos...
CVE-2020-1007
CVE-2020-1007 is a Windows kernel information disclosure vulnerability. The issue arises from how the Windows kernel handles objects in memory, enabling information disclosure when exploited locally. The description, CVSS data, and references indicate a kernel-level memory handling flaw with part...
CVE-2020-1010
Technical details about CVE-2020-1010 (affected product wbengine, root cause, exploit specifics, mitigations) are not publicly available in the provided Connected documents; monitor for updates from Microsoft MSRC and NVD.
CVE-2020-1051
CVE-2020-1051 concerns the Windows Jet Database Engine and is described as a remote code execution vulnerability caused by improper handling of objects in memory. The connected KB4556799 entry references Windows security updates and notes that the Jet Database Engine is among updated components, ...
CVE-2020-1074
CVE-2020-1074 describes a remote code execution in the Windows Jet Database Engine caused by improper in-memory handling of objects. An attacker could trigger code execution by convincing a user to open a specially crafted file, leading to arbitrary code on the victim’s system. The vulnerability ...
CVE-2020-1263
CVE-2020-1263 describes an information disclosure vulnerability in Windows Error Reporting (WER). The issue arises from how memory objects are handled by WER, allowing an attacker to potentially access information they should not have. The affected component is Windows Error Reporting, and the ro...
CVE-2020-1287
CVE-2020-1287 is a Windows WalletService elevation of privilege vulnerability. The WalletService stores/handles objects in memory in a way that can be exploited to elevate privileges; both CNVD entries (CNVD-2021-27713, CNVD-2021-29542) describe this WalletService memory-object handling flaw with...
CVE-2020-1589
Technical details of CVE-2020-1589 are not publicly provided in the supplied documents. No affected products, versions, impact, or fixes are disclosed here. Monitor for updates from official sources.
CVE-2020-17026
CVE-2020-17026 is documented as a Windows Remote Access Elevation of Privilege vulnerability. The available sources (NVD entry) label it with local attack vector and partial confidentiality, integrity, and availability impacts (CVSS v2 base score 4.6; CVSS v3.1 base score 7.8). Connected document...
CVE-2020-17033
Technical details for CVE-2020-17033 are not publicly provided in the supplied documents; monitor for updates.
CVE-2021-1679
Technical details for CVE-2021-1679 are not publicly provided in the supplied documents. Please monitor for updates; no product, impact, or remediation specifics are included here.
CVE-2021-27093
Technical details about CVE-2021-27093 are not publicly available in the provided connected documents; monitor for updates.
CVE-2023-35322
Technical details about CVE-2023-35322 are not publicly provided in the supplied documents; no affected products, root cause, or remediation details are listed. Monitor for updates in forthcoming connected sources.
CVE-2023-35641
CVE-2023-35641 is an Internet Connection Sharing (ICS) remote code execution in Windows. Connected sources confirm affected component (Windows ICS) and classify the impact as remote code execution with the attacker needing adjacent network access, no user interaction, and no privileges required (...
CVE-2024-37974
Technical details about CVE-2024-37974 are not provided in the given documents. The connected items mention related issues (e.g., BitLocker / Secure Boot references) but do not reveal affected products, root cause, or remediation for this CVE. Monitor for updates.
CVE-2024-38051
Technical details about CVE-2024-38051 (Windows Graphics Component RCE) are not provided in the connected documents. Monitor for updates from official advisories to obtain affected products, root cause, and remediation information.
CVE-2024-43449
CVE-2024-43449 is a Windows USB Video Class System Driver elevation-of-privilege vulnerability. The CVE entry lists a CVSSv3.1 base score of 6.8 (Medium) with attack vector as Physical, no user interaction required, and an impact profile of High on confidentiality, integrity, and availability. Mi...
CVE-2025-21294
CVE-2025-21294 refers to a Microsoft Digest Authentication Remote Code Execution vulnerability. Public documents indicate it affects Windows components and has high impact (RCE). Connected sources confirm updates exist to fix the vulnerabilities and recommend installing January 2025 security upda...
CVE-2025-21347
CVE-2025-21347 is linked to the Windows Update Stack and is described in the connected NCSC advisory as a Denial-of-Service vulnerability. The CVE entry in that document assigns a base CVSS-like severity of 6.0 and notes that Microsoft has updates available to fix the issue. The mode of the vulne...
CVE-2025-26667
CVE-2025-26667 is a Windows RRAS information-disclosure vulnerability. The RRAS service can expose sensitive data to an unauthorized network actor, with the CVSSv3.1 base score listed as 6.5 (Network, Low attack complexity, Privileges None, No user interaction; Confidentiality impact High). The c...
CVE-2025-26680
CVE-2025-26680 affects the Windows Standards-Based Storage Management Service and describes an adversary-enabled condition of uncontrolled resource consumption leading to a network-based denial of service. The vulnerability is categorized with a high base score (CVSS 3.1: 7.5, NETWORK, no user in...
CVE-2025-26688
CVE-2025-26688 is a stack-based buffer overflow in Microsoft Virtual Hard Disk that enables a locally authenticated attacker to elevate privileges. The vulnerability is labeled as “Obtaining Increased Entitlements” (CVSS v3.1 base score 7.8). Connected sources corroborate the affected product (Mi...
CVE-2026-32073
CVE-2026-32073 refers to a Local Privilege Escalation in the Windows Ancillary Function Driver for WinSock. The advisory notes a local attack vector with high impact (C:H/I:H/A:H) and a low-privilege, no-user-interaction requirement, under CVSS 3.1: base score 7.0, attack vector Local, attack com...
CVE-2013-3129
CVE-2013-3129 concerns a TrueType Font (TTF) parsing vulnerability that allows remote code execution. Affected products include Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5; Silverlight 5 prior to 5.1.20513.0; and GDI+, DirectWrite, Journal in various Windows versions (XP through Windows ...
CVE-2015-6132
CVE-2015-6132 is the Windows library loading remote code execution vulnerability affecting multiple Windows versions. Root cause: mishandled library loading enabling local privilege escalation via a crafted application. The MS15-132 security update fixes this, with public exploits and a Metasploi...
CVE-2016-0195
Summary: CVE-2016-0195 is a remote code execution vulnerability in the Windows Imaging Component (WIC) affecting multiple Windows versions (Vista to Windows 10). The issue arises from improper handling of memory/objects in the Imaging Component, enabling remote attackers to run arbitrary code via...
CVE-2016-3272
CVE-2016-3272 is a Windows kernel information disclosure vulnerability caused by improper handling of page-fault system calls in the Windows kernel. A local attacker could disclose information from one process to another. Affected products include Windows 8.1, Windows Server 2012/2012 R2, Windows...
CVE-2016-3335
CVE-2016-3335 concerns the Microsoft Windows Common Log File System (CLFS) driver elevation of privilege. The advisory notes local users can gain higher privileges via a crafted application on affected OSes: Windows Vista SP2; Windows Server 2008 SP2/R2; Windows 7 SP1; Windows 8.1; Windows Server...
CVE-2016-3348
CVE-2016-3348 is a local elevation-of-privilege vulnerability in the Windows kernel-mode driver Win32k.sys. The root cause is how the kernel-mode driver handles objects in memory, which an attacker can exploit by running a crafted application after logging in to gain kernel-level privileges. Affe...
CVE-2017-8488
CVE-2017-8488 is a Windows kernel information disclosure vulnerability affecting multiple Windows versions (Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, 8.1, Server 2012 Gold/R2, Windows RT 8.1, Windows 10 variants, Server 2016). The issue allows an authenticated attacker to obtain information ...
CVE-2018-1009
CVE-2018-1009 is a local privilege-escalation vulnerability in the Windows DirectX Graphics Kernel Subsystem. It arises when Windows improperly handles objects in memory and incorrectly maps kernel memory, allowing an attacker with local access to elevate privileges on affected systems. Affected ...
CVE-2018-8563
CVE-2018-8563 is a DirectX information-disclosure vulnerability arising from how objects are handled in memory. The NVD and CNVD entries document that it affects multiple Windows platforms (Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2008 R2...
CVE-2019-1293
Technical details for CVE-2019-1293 are not publicly provided in the connected documents. No affected products, root cause, impact, or remediation are disclosed here. Monitor for updates in the CVE records and advisories.