CVE-2024-38247

CVE-2024-38247 is a Windows Graphics Component local elevation of privilege vulnerability. The CVSSv3.1 vector shows Attack Vector: Local, Privileges Required: Low, User Interaction: None, with all of Confidentiality/Integrity/Availability impacts: High. Public documents confirm a Windows patch r...

CVE-2025-21305

CVE-2025-21305 is documented as a Windows Telephony Service Remote Code Execution vulnerability. The connected CIRCL source explicitly lists CVE-2025-21305 under Windows Telephony Service with an impact described as Execute random code, indicating a code-execution vector in the Telephony service....

CVE-2025-33057

CVE-2025-33057 is a Windows Local Security Authority (LSA) vulnerability where a null pointer dereference could allow an authorized attacker to cause a network-based Denial-of-Service. Affected component is LSA; impact is DoS over the network. Documented in NVD and corroborated by NC SC/NCSC entr...

CVE-2026-34342

CVE-2026-34342 describes a race condition in Windows Print Spooler Components enabling local privilege escalation for an authenticated attacker. The vulnerability arises from improper synchronization on a shared resource, leading to concurrent execution issues. Impact is local elevation of privil...

CVE-2015-2381

CVE-2015-2381 affects Microsoft Windows' kernel-mode driver component win32k.sys in Windows 8, Windows 8.1, Windows Server 2012 Gold/R2, and Windows RT Gold/8.1. The vulnerability allows local users to read kernel memory via a crafted application, an information-disclosure issue. Impact is stated...

CVE-2015-2429

CVE-2015-2429 affects Windows sandboxed contexts (Windows Vista SP2, 7 SP1, 8/8.1, Server 2008/2012 and R2, RT) where a crafted application could bypass the sandbox and perform registry actions. Root cause: registry key symbolic links could be created from a sandboxed process, enabling privilege ...

CVE-2015-2525

CVE-2015-2525 affects Windows Task Scheduler across multiple OS versions (Vista SP2, Server 2008 SP2/R2, Windows 7/8/8.1, Server 2012/2012 R2, RT/10). The vulnerability allows local privilege escalation by bypassing filesystem restrictions during task deletion via Task Scheduler (schedsvc.dll) wi...

CVE-2015-2528

The CVE-2015-2528 issue affects Windows 8, Windows 8.1, Windows Server 2012 Gold/R2, Windows RT Gold/8.1, and Windows 10, where the local threat can gain privileges by abusing improper constraints on impersonation levels in Task Management. The root cause is not clearly constrained impersonation ...

CVE-2016-3226

CVE-2016-3226 describes a denial-of-service vulnerability in Microsoft Active Directory on Windows Server 2008 R2 SP1 and Windows Server 2012/2012 R2. An authenticated attacker with privileges to join machines to the domain can cause the AD service to become nonresponsive by creating a large numb...

CVE-2016-3230

CVE-2016-3230 is a local DoS vulnerability in the Windows Search component that affects Windows 7, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 (1511/Gold). The root cause is the Windows Search component failing to handle certain objects in memor...

CVE-2016-3343

CVE-2016-3343 affects the Common Log File System (CLFS) driver in multiple Windows versions (Vista SP2, Server 2008 SP2/R2, 7 SP1, 8.1, Server 2012, RT 8.1, 10 variants, Server 2016). It enables local users to gain privileges via a crafted application, i.e., a local privilege escalation vulnerabi...

CVE-2017-0159

CVE-2017-0159 affects Windows 10 (1607), Windows Server 2012 R2, and Windows Server 2016. Root cause: ADFS may treat Extranet requests as Intranet, bypassing account lockout protections and enabling easier brute-force access. Public exploit details are not provided in the connected documents. Rem...

CVE-2017-8680

CVE-2017-8680 is a Windows kernel/Win32k information-disclosure vulnerability. The available documents describe memory-object handling flaws in Win32k that could disclose kernel data to user mode. Exploitation details are not fully provided in the initial description, but related sources note pub...

CVE-2017-8686

CVE-2017-8686 affects the Windows Server DHCP service on Windows Server 2012 Gold/R2 and Windows Server 2016. The issue is a memory corruption vulnerability in the DHCP service that can allow an attacker to run arbitrary code on the DHCP failover server or cause the DHCP service to become nonresp...

CVE-2017-8688

CVE-2017-8688 is a Windows GDI+ information-disclosure issue that leaks kernel-memory addresses through GDI+ memory handling. Affected products include Windows 7 SP1, 8.1, Server 2008 SP2/R2 SP1, and Windows 10 variants up to 1703/Server 2016. Connected analysis documents reveal related kernel me...

CVE-2019-1432

CVE-2019-1432 is an information-disclosure vulnerability in DirectWrite, where memory contents may be improperly disclosed. The Red Hat CVE entries and the NVD record describe this as a memory disclosure issue unique from CVE-2019-1411. The available documents do not provide specifics on affected...

CVE-2020-0874

CVE-2020-0874 affects the Windows Graphics Device Interface (GDI); the issue is an information-disclosure vulnerability caused by improper handling of memory objects in GDI. Exploitation could allow an attacker to retrieve memory contents from the target system. The connected documents corroborat...

CVE-2023-35346

Technical details (affected product, root cause, impact, fix) are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2025-21249

Technical details for CVE-2025-21249 are not publicly available in the provided documents; no affected products, root cause, or remediation are stated here. Monitor for official updates from Microsoft and CVE databases.

CVE-2025-21300

CVE-2025-21300 affects Windows UPnP Device Host. Connected CNVD data ties the issue to the Windows upnphost.dll component and a Denial of Service impact. Microsoft has published January 2025 security updates to address this family of issues; applying KB5050021 (and related January 2025 updates) i...

CVE-2025-21350

CVE-2025-21350 is a Windows Kerberos Denial-of-Service vulnerability. Connected sources indicate the issue affects Windows Kerberos with a CVSSv3.1 base score of 5.9 (Network, High impact on availability; no confidentiality/integrity impact). The connected documents confirm Microsoft has released...

CVE-2025-21389

Technical details about CVE-2025-21389 are not publicly provided in the connected documents. Monitor for updates from Microsoft and CVE repositories for affected products, exploitability, and remediation.

CVE-2025-29833

Technical details for CVE-2025-29833 are not provided in the connected documents. The EUVD and MSKB entries cover other issues and updates, but none specify affected product/version, root cause, impact, or remediation for this CVE. Monitor for updates.

CVE-2025-54918

CVE-2025-54918 describes an improper authentication flaw in Windows NTLM that enables a network-authenticated attacker to elevate privileges. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and privileges required. A PoC exploit exists on GitHub (CVE-2025-54918-...

CVE-2026-20922

CVE-2026-20922 is a heap-based buffer overflow in Windows NTFS that enables a locally authenticated attacker to execute code. The description and connected sources confirm NTFS as the vulnerable component and local execution as the impact. Public details in the provided documents are consistent w...

CVE-2026-42976

This CVE concerns Windows RPC API: missing authentication for a critical function allows an authorized attacker to escalate privileges locally. Affected component: Windows RPC server/remote procedure call surface; root cause: lack of authentication on a sensitive function. Impact described as loc...

CVE-2013-3876

CVE-2013-3876 concerns DirectAccess in Windows platforms where the client/server DirectAccess component fails to properly verify server X.509 certificates. This enables a man-in-the-middle to impersonate a legitimate server and potentially read encrypted domain credentials when a crafted certific...

CVE-2015-1716

CVE-2015-1716 is an information-disclosure vulnerability in Schannel (Windows) caused by improper restriction of Diffie-Hellman Ephemeral key lengths. Connected advisories describe it as affecting TLS configurations that permit DHE_EXPORT/weak keys, enabling MITM-style decryption of TLS traffic (...

CVE-2015-2513

CVE-2015-2513 relates to Windows Journal remote code execution via a crafted .jnt file across Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold/R2, Windows RT Gold/8.1, and Windows 10. The root cause is processing of .jnt files enabling arbi...

CVE-2016-0098

CVE-2016-0098 is a remote-code-execution flaw in Microsoft Windows media handling (Windows Media parsing) affecting Windows 7 SP1, Windows 8.1, Windows Server 2008 R2 SP1, Windows Server 2012/2012 R2, Windows RT 8.1, and Windows 10. An attacker can trigger arbitrary code execution by convincing a...

CVE-2016-3201

CVE-2016-3201 affects Microsoft Windows 8.1, Windows Server 2012 (Gold/R2), Windows 10 (Gold/1511), and Microsoft Edge, enabling remote attackers to read sensitive data from a process’s memory via a crafted PDF document (Windows PDF Information Disclosure Vulnerability). Connected MSKB entries co...

CVE-2016-3333

Technical details for CVE-2016-3333 are not publicly provided in the supplied documents; monitor for updates.

CVE-2017-0191

CVE-2017-0191 affects multiple Windows platforms (Windows 7, 8.1, 10 and Windows Server 2008 R2/2012/2012 R2/2016) with a denial-of-service condition caused by how memory objects are handled. The vulnerability could allow an attacker to cause a target system to stop responding. The provided sourc...

CVE-2017-0293

CVE-2017-0293 : Microsoft Windows PDF Library improperly handles objects in memory, allowing remote code execution in multiple Windows versions. Root cause (as described) is memory handling that can lead to code execution in the context of the current user; attacker could gain user rights if expl...

CVE-2017-11784

CVE-2017-11784 affects the Windows kernel information-disclosure pathway in multiple Windows versions (Windows 7 SP1, 8.1, Server 2008 SP2/R2 SP1, 2012, Windows RT 8.1, Windows 10) where objects in memory are improperly handled. The root cause is an information-disclosure vulnerability in the Win...

CVE-2017-11832

CVE-2017-11832/11835 relate to the Microsoft Windows Embedded OpenType (EOT) font engine. Affected products include Windows 7 SP1, Windows Server 2008 SP2/R2 SP1, and Windows Server 2012, where the EOT font engine parses specially crafted embedded fonts leading to information disclosure. The vuln...

CVE-2017-8666

CVE-2017-8666 is described in the initial entry as an information disclosure in Win32k when handling objects in memory across multiple Windows versions (Windows 7/8.1/10, Server editions). Connected documents enumerate CVE-2017-8666 within Microsoft security update compilations (e.g., KB4034665/K...

CVE-2017-8683

CVE-2017-8683 is a Windows graphics remote-code-execution vulnerability tied to Win32k Graphics via specially crafted embedded fonts. Affected products include Windows client/server releases from Windows 7 SP1 to Windows 10 1703 and Windows Server 2008 SP2/R2 SP1/2012, plus Office Word Viewer+Off...

CVE-2020-0716

Technical details for CVE-2020-0716 are not publicly provided in the connected documents. Monitor for updates; current sources do not specify affected products, root cause, impact, or remediation in this corpus.

CVE-2023-36005

CVE-2023-36005 is documented in connected sources as a Windows Telephony Server Elevation of Privilege vulnerability with a base impact of obtaining increased privileges. The NC SC advisory lists the CVE with a base CVSS-like rating of 7.5 (HIGH) and notes a network-associated context, but the pr...

CVE-2024-43547

CVE-2024-43547 is listed in the Windows Kerberos category as a Windows Kerberos Information Disclosure vulnerability with impact described as Access to sensitive data. The connected documents identify the CVE and its general risk context but do not provide concrete details on affected product ver...

CVE-2025-29954

Technical details for CVE-2025-29954 are not publicly provided in the supplied documents. Monitor for official updates from Microsoft (MSRC) and vulnerability feeds as the connected sources are not detailed here.

CVE-2025-29962

Technical details about CVE-2025-29962 are not provided in the supplied documents; no affected products, root cause, or fixes are disclosed here. Monitor for updates.

CVE-2025-32718

CVE-2025-32718 : Integer overflow or wraparound in Windows SMB enables a locally authenticated attacker to elevate privileges. Connected sources confirm impact as local privilege escalation on Windows SMB, with CVSS v3.1 base score 7.8 (HIGH) and local attack vector. Public references in NVD/NCSC...

CVE-2025-32724

CVE-2025-32724 affects Windows Local Security Authority Subsystem Service (LSASS). The connected NC SC advisory and MS security-update artifacts identify this as a Denial-of-Service vulnerability with CVSS v3.1 base score 7.5 (NETWORK, LOW complexity, NONE privileges, NONE user interaction) and s...

CVE-2026-33104

CVE-2026-33104 is a Windows Win32K - GRFX race condition vulnerability rated CVSS v3.1 7.0 (High) with local privilege escalation impact. The connected sources label this as a Win32K-GRFX issue enabling “Obtain increased privileges” and reference Microsoft Windows updates guidance, but the provid...

CVE-2026-62741

CVE-2026-62741 is a Windows HTTP.sys elevation-of-privilege vulnerability caused by an integer underflow/wrap in HTTP.sys. An authorized local attacker can elevate privileges. Affected: Windows HTTP.sys. Root cause: integer underflow; Impact: local privilege escalation with high confidentiality/i...

CVE-2014-1814

CVE-2014-1814 is a local privilege-escalation vulnerability in the Windows Installer service. It affects Windows client/server platforms listed in the advisory (e.g., Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, 7, 8, 8.1, Server 2012/2012 R2, and Windows RT/8.1). The flaw arises from ...

CVE-2014-4074

CVE-2014-4074 concerns a privilege-escalation flaw in Windows Task Scheduler. The vulnerability exists in Task Scheduler across Windows 8/8.1, Windows Server 2012 (Gold/R2) and Windows RT/8.1, where a crafted task can be scheduled to abuse privileges. The issue is triggered locally by scheduling ...

CVE-2015-0006

The CVE-2015-0006 issue is a vulnerability in Microsoft Windows’ Network Location Awareness (NLA) service. The root cause is that NLA does not perform mutual authentication to verify domain connections, enabling a remote attacker to spoof DNS/LDAP responses on a local network and trigger an unint...