CVE-2024-43621

CVE-2024-43621 affects Windows Telephony Service (a Windows OS component). The vulnerability is a Remote Code Execution flaw in the Windows Telephony Service, with CVSS 3.1 base metrics indicating Network attack vector, no privileges required, and user interaction needed; impact is High/High/High...

CVE-2024-49090

CVE-2024-49090 affects the Windows Common Log File System Driver. The connected sources indicate an Elevation of Privilege vulnerability in the CLFS driver that could allow a local attacker with low privileges and no user interaction to obtain increased rights (high impact across confidentiality,...

CVE-2025-27474

CVE-2025-27474 is a Windows RRAS vulnerability described as the use of an uninitialized resource that enables an unauthorized attacker to disclose information over a network. The connected sources corroborate that this CVE affects Windows Routing and Remote Access Service (RRAS) and result in inf...

CVE-2025-27738

CVE-2025-27738 affects Windows Resilient File System (ReFS). Description in NCSC advisory attributes an improper access control issue that could allow an authenticated attacker to disclose information over the network, with impact categorized as access to sensitive data. The NT/OS update guidance...

CVE-2025-27741

CVE-2025-27741 describes an out-of-bounds read in Windows NTFS that allows a local attacker to elevate privileges. The issue is tied to NTFS handling and is mitigated by Microsoft security updates; affected users should apply the latest Windows security updates per MSRC guidance. The connected so...

CVE-2025-47955

CVE-2025-47955 involves improper privilege management in Windows Remote Access Connection Manager, enabling local privilege escalation for an authorized attacker. CVSS 3.1 base 7.8 (HIGH): Local, low complexity, no user interaction, with high impact on confidentiality, integrity, and availability...

CVE-2026-50667

CVE-2026-50667 is a Windows NTFS/Windows Common Log File System Driver elevation-of-privilege vulnerability caused by a race condition in a shared resource. The CVE affects Windows NTFS and is identified by Microsoft as a privilege-escalation issue; updates have been released (July 2026 monthly r...

CVE-2026-54113

The CVE-2026-54113 entry pertains to resource allocation without limits or throttling in the Windows Kernel accessible over a network, enabling a remote attacker to cause a denial of service. Documents indicate the affected component is the Windows Kernel involved in network-resource handling; ro...

CVE-2026-59138

CVE-2026-59138 is a null pointer dereference in Microsoft Remote Registry Service that allows an authorized attacker to cause a denial of service over a network. The vulnerability has a CVSS v3.1 base score of 6.5 (MEDIUM) with Network attack vector, Low attack complexity, Privileges Required: Lo...

CVE-2026-61353

CVE-2026-61353 describes a heap-based buffer overflow in the Windows Telephony Service that enables a locally authenticated attacker to achieve privilege escalation . The vulnerability arises from a heap overflow in the Telephony Service component, leading to potential unauthorized system access....

CVE-2026-69595

CVE-2026-69595 is a use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver that allows an unauthorized, unauthenticated attacker to achieve remote code execution over the network. Microsoft rated it CRITICAL (CVSS 3.1: 9.8) with low attack complexity and no user interactio...

CVE-2016-7221

CVE-2016-7221 is a Windows IME DLL-loading privilege-escalation issue. The IME loads DLLs via a registry-controlled mechanism and can be exploited by a locally authenticated user to gain higher privileges when an application initiates the IME. Public writeups (e.g., JVN/JVND) describe the exploit...

CVE-2017-0074

CVE-2017-0074 is a Hyper-V denial-of-service vulnerability affecting Windows Hyper-V across multiple Windows client and server editions. Connected sources (CNVD entries) describe a Hyper-V DoS where a crafted application can crash the host, affecting Hyper-V guests; specific affected versions ali...

CVE-2017-0118

CVE-2017-0118 is an information-disclosure vulnerability in Microsoft Windows Uniscribe (usp10.dll) that can be triggered by a crafted web site, allowing an attacker to read sensitive data from a target process’s memory. The issue affects a range of Windows versions listed in the description and ...

CVE-2017-0192

The CVE-2017-0192 entry describes an information disclosure in the Microsoft Windows ATMFD.dll (Adobe Type Manager Font Driver). Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold/R2, Windows RT 8.1, and Windows 10 bui...

CVE-2017-11815

CVE-2017-11815 is an information-disclosure vulnerability in the Windows SMB Server, caused by how SMB requests are handled. An authenticated attacker could craft a packet to trigger disclosure from the SMB server. Affected platforms include Windows SMB Server implementations referenced in the CV...

CVE-2017-8677

CVE-2017-8677 is a Win32k/GDI+-related information-disclosure vulnerability in Windows that exposes kernel memory addresses when handling GDI+ objects. Affected products include Windows kernel/UI components on Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, Windows 10 (various builds)...

CVE-2018-0926

Technical details are not publicly available in the provided connected documents; monitor for updates.

CVE-2019-0983

CVE-2019-0983 is a Windows Storage Service elevation-of-privilege vulnerability caused by improper handling of file operations. The vulnerability allows a local attacker who already has code execution on the victim to gain elevated privileges by running a specially crafted application. The issue ...

CVE-2019-1171

CVE-2019-1171 is an information-disclosure vulnerability in SymCrypt during OAEP decryption. The underlying issue is in OAEP decoding operations, allowing an attacker who can log on to an affected system to obtain information that could aid further compromise. The CVE does not enable code executi...

CVE-2019-1317

CVE-2019-1317 is a Windows DoS vulnerability caused by improper handling of hard links, as described in the initial entry and corroborated by Red Hat and NVD records. The connected documents confirm the issue and its Windows context but do not provide concrete details on affected versions, root-c...

CVE-2020-0705

CVE-2020-0705 is an information-disclosure vulnerability in Windows’ Network Driver Interface Specification (NDIS) where memory handling is improper. The issue can disclose information from memory and requires prior execution on the target (local access with low attack complexity per CVSS v3.1: A...

CVE-2020-0730

CVE-2020-0730 concerns Windows User Profile Service (ProfSvc) elevation of privilege due to improper handling of symbolic links. The CNVD-2020-14305 entry describes that an attacker could delete files and folders in an elevated context by exploiting this symlink handling issue. The provided conne...

CVE-2020-0777

CVE-2020-0777 is described in CNVD-2020-23447 as a privilege escalation vulnerability in Microsoft Windows Work Folder Service, arising from improper handling of file operations. The CNVD entry states that an attacker could exploit this with a specially crafted application to run processes with e...

CVE-2020-0790

Technical details about CVE-2020-0790 are not publicly provided in the connected documents. Monitor official advisories for updates; these sources mention a splwow64 Elevation of Privilege but do not provide concrete technical specifics in the supplied materials.

CVE-2020-0799

CVE-2020-0799 is a Windows kernel elevation of privilege vulnerability. The flaw arises because the Windows kernel fails to properly handle parsing of certain symbolic links in its file-system/kernel parsing path, enabling local privilege escalation. The description and linked sources (NVD/NVD-de...

CVE-2020-0843

CVE-2020-0843 is a local elevation-of-privilege vulnerability in Windows Installer. The issue arises from how Windows Installer handles certain filesystem operations, allowing an unprivileged attacker on the victim system to compromise the host. CVSSv3.1 base score is 7.8 (HIGH) with local exploi...

CVE-2020-0907

CVE-2020-0907 is described as a remote code execution vulnerability in how Microsoft Graphics Components handles objects in memory. The connected MS KB and vendor feeds confirm this CVE is among a set of Windows updates (KB4549951 family) addressing multiple issues, but the provided documents do ...

CVE-2020-1001

CVE-2020-1001 affects the Windows Push Notification Service on Windows client/server platforms. The vulnerability is described as an Elevation of Privilege due to how objects are handled in memory by WNS, enabling a local attacker to gain higher privileges. CVSSv3.1 base score is 7.8 (High), with...

CVE-2020-1136

CVE-2020-1136 is described as a memory corruption vulnerability in Windows Media Foundation caused by improper handling of objects in memory. The connected CVE entries (CVE-2020-1150 family) likewise reference Windows Media Foundation memory corruption and imply broad impact within Windows. The i...

CVE-2020-1238

CVE-2020-1238 is a memory corruption vulnerability in Windows Media Foundation caused by improper handling of objects in memory. It affects Windows Media Foundation components; exploitation could allow memory corruption within the affected process, with CVSS indicating high impact (exploitability...

CVE-2020-1261

CVE-2020-1261 is an information-disclosure vulnerability in Windows Error Reporting (WER). The issue arises from how WER handles memory objects, allowing potential exposure of memory contents. The CVE is stated as distinct from CVE-2020-1263. Public sources in the provided documents describe the ...

CVE-2020-1344

CVE-2020-1344 is a Windows WalletService elevation-of-privilege vulnerability rooted in how WalletService handles objects in memory, potentially allowing a crafted app to execute code with elevated privileges. Related entries (CVE-2020-1362/1369) describe the same WalletService memory-handling th...

CVE-2020-16900

CVE-2020-16900 is a local privilege-escalation vulnerability in Windows where the Event System improperly handles objects in memory. An attacker must first gain code execution on the victim, then run a crafted application to elevate privileges. The fix is a security update that corrects how the W...

CVE-2021-1693

Technical details about CVE-2021-1693 are not provided in the connected documents. The initial description remains high‑level; monitor official advisories for updates to obtain affected products, impact, and fixes.

CVE-2021-24076

CVE-2021-24076 is listed in multiple open-source vulnerability feeds as a Microsoft Windows VMSwitch Information Disclosure Vulnerability. Connected sources confirm the affected component is Windows VMSwitch and classify the impact as information disclosure with a CVSS v3.1 base score of 5.5 (LOC...

CVE-2021-27090

CVE-2021-27090 is an Elevation of Privilege in Windows Secure Kernel Mode. Affected software area: Windows Secure Kernel Mode components. Root cause (as documented): elevation of privileges in the kernel, enabling an attacker to obtain increased privileges locally. Impact (per sources): privilege...

CVE-2021-28441

Technical details about CVE-2021-28441 are not provided in the connected documents. Monitor for updates from official advisories for affected products, scope, and fixes.

CVE-2022-35746

Technical details about CVE-2022-35746 are not provided in the supplied documents. No product/version/root-cause/impact are specified here; monitor for official updates from Microsoft/NVD to obtain concrete information and remediation.

CVE-2022-37993

Technical details for CVE-2022-37993 are not publicly provided in the supplied documents. No concrete affected products, root cause, or remediation are present here. Monitor for updates from official sources.

CVE-2022-38003

The CVE-2022-38003 issue is described in connected CNVD as a Windows Resilient File System (ReFS) Elevation of Privilege vulnerability stemming from improper privilege assignment in an application. This means local attackers could escalate privileges on affected Windows systems. The vulnerability...

CVE-2023-35299

CVE-2023-35299 affects the Windows Common Log File System Driver and is an Elevation of Privilege vulnerability. CVSSv3.1 base score 7.8 (Local, Privilege Required: Low, User Interaction: None, Scope: Unchanged; Impact: Confidentiality/Integrity/Availability High). The connected sources (includin...

CVE-2023-36011

CVE-2023-36011 is a Windows Win32k elevation-of-privilege vulnerability. Affected: Windows Win32K component (kernel-related). Nature: local exploit with low attack complexity and no user interaction; enables total impact on confidentiality, integrity, and availability. CVSSv3.1 base score 7.8 (HI...

CVE-2024-38099

Technical details about CVE-2024-38099 (Windows Remote Desktop Licensing Service DoS) are not provided in the supplied documents. Monitor for official advisories for affected products, impact, and fixes.

CVE-2024-38142

CVE-2024-38142 is a Windows Secure Kernel Mode elevation-of-privilege vulnerability (local, low-privilege prerequisite; high impact). The connected sources provide CVSS and impact only (Obtaining Increased Entitlements) and do not specify root cause details beyond the Windows kernel context. Publ...

CVE-2024-38191

Technical details for CVE-2024-38191 are not publicly provided in the supplied documents. Monitor for updates from Microsoft MSRC/NVD, NVD, or CVE listings as new information becomes available.

CVE-2024-38237

CVE-2024-38237 is a local privilege-escalation in Windows Kernel Streaming WOW Thunk Service Driver. Affected component is a Windows kernel-mode driver used by streaming services; vulnerability exploited locally with low privileges and no user interaction, leading to elevated privileges and poten...

CVE-2025-21212

CVE-2025-21212 corresponds to an Internet Connection Sharing (ICS) Denial of Service vulnerability in Windows. Reported impact is DoS, with an adjacent attack vector, low attack complexity, no user interaction required, and no confidentiality/integrity impact, but availability is affected (CVSS 3...

CVE-2025-21238

CVE-2025-21238 affects the Windows Telephony Service and is a remote code execution vulnerability. The initial data lists CVSS 3.1 with NETWORK attack vector, LOW attack complexity, no privileges required, and user interaction required; impact is high on confidentiality, integrity, and availabili...

CVE-2025-21284

Technical details about CVE-2025-21284 are not provided in the connected documents. Public references exist (NVD, CVE listings) but there are no specifics in these sources about affected products, root cause, impact details, or fixes; monitor for updates.