CVE-2025-33057

CVE-2025-33057 is a Windows Local Security Authority (LSA) vulnerability where a null pointer dereference could allow an authorized attacker to cause a network-based Denial-of-Service. Affected component is LSA; impact is DoS over the network. Documented in NVD and corroborated by NC SC/NCSC entr...

CVE-2025-33067

CVE-2025-33067 — Windows Kernel local privilege escalation due to improper privilege management. Affects the Windows Kernel; attacker can gain elevated rights locally with no user interaction. CVSSv3.1 base score 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Connected sources confirm the impact as l...

CVE-2025-49734

CVE-2025-49734 affects Windows PowerShell. The root cause is an improper restriction of the communication channel to intended endpoints, enabling an authorized local attacker to elevate privileges. The CVE maps to a local privilege escalation with high impact (C:H/I:H/A:H) and requires local acce...

CVE-2026-45592

CVE-2026-45592 describes an integer overflow/wraparound in Windows Internet (wininet.dll) that enables local privilege escalation for an authorized attacker. The CVSS 3.1 metrics indicate a HIGH impact across confidentiality, integrity, and availability, with a LOCAL attack vector, LOW privileges...

CVE-2026-59128

The CVE-2026-59128 entry documents an out-of-bounds read in Windows Encrypting File System (EFS) that can let an authorized local attacker disclose information. Affected component: Windows EFS. Root cause: out-of-bounds read leading to information disclosure. Impact: local disclosure of informati...

CVE-2026-61348

This CVE (CVE-2026-61348) is a local privilege escalation in the Windows Ancillary Function Driver for WinSock. The issue is a use-after-free in the driver component, enabling an authenticated attacker to elevate privileges on the affected system. The provided materials indicate a high-severity i...

CVE-2026-65795

CVE-2026-65795: Windows DNS contains a local elevation of privileges issue. An authorized attacker can elevate privileges locally. CVSS v3.1 reflects LOCAL attack vector, HIGH confidentiality/integrity/availability impact, with HIGH privileges required and no user interaction. Exploitation detail...

CVE-2019-1277

CVE-2019-1277 describes an elevation of privilege vulnerability in the Windows Audio Service triggered by processing a malformed parameter. The affected component is Windows Audio Service on Windows systems. Root cause: malformed parameter handling leading to unauthorized privilege escalation. CV...

CVE-2024-43620

CVE-2024-43620 corresponds to a Windows Telephony Service remote code execution vulnerability with a high impact (base CVSS 8.8; network access; user interaction required). In the connected documents, it is listed under Windows Telephony Service with an impact described as Execute arbitrary code ...

CVE-2024-43643

CVE-2024-43643 is a Windows USB Video Class System Driver elevation-of-privilege vulnerability. The vulnerability pertains to the Windows USB Video Driver component and is categorized with CVSSv3.1 vektor: physical attack, low complexity, no privileges required, no user interaction, and impacts t...

CVE-2025-21288

Technical details about CVE-2025-21288 are not publicly provided in the supplied connected documents; the record notes a Windows COM Server information disclosure vulnerability but lacks specifics on affected products/versions or mitigations. Monitor for official disclosures.

CVE-2025-27467

CVE-2025-27467 affects Windows Digital Media, with a use-after-free flaw that enables local privilege escalation for an authenticated user with low privileges and no user interaction. The CVSS 3.1 base metrics provided by Microsoft indicate AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.8 (HIG...

CVE-2025-33068

CVE-2025-33068 is a denial-of-service vulnerability in Windows Standards-Based Storage Management Service caused by uncontrolled resource consumption. The issue can be triggered over the network to degrade or disrupt service. Microsoft has released security updates addressing this family of issue...

CVE-2026-34342

CVE-2026-34342 describes a race condition in Windows Print Spooler Components enabling local privilege escalation for an authenticated attacker. The vulnerability arises from improper synchronization on a shared resource, leading to concurrent execution issues. Impact is local elevation of privil...

CVE-2026-50328

CVE-2026-50328 pertains to Windows Server Update Services (WSUS). An uncaught exception in WSUS could allow an unauthenticated attacker to tamper over the network, as reflected by a CVSS v3.1 base score of 7.5 (Network, high impact on availability, no confidentiality/integrity impact). Multiple c...

CVE-2026-62734

CVE-2026-62734 describes a race condition due to concurrent execution with an improper synchronization in the Windows Telephony Service, allowing an authorized attacker to locally elevate privileges. The issue is identified as a local privilege escalation with a high impact on confidentiality, in...

CVE-2026-69463

CVE-2026-69463 is a heap-based buffer overflow in the Windows NTFS filesystem component that allows an unauthorized attacker to achieve remote code execution over a network without requiring prior authentication or user interaction. The vulnerability is rated CVSS 3.1: 9.8 (Critical) by the CNA (...

CVE-2020-0685

CVE-2020-0685 is a Windows local elevation-of-privilege vulnerability due to improper handling of COM object creation in the Windows COM Server. The root cause is misuse in COM object creation, enabling an attacker who logs on locally to run a specially crafted application and gain elevated privi...

CVE-2024-30079

Technical details about CVE-2024-30079 are not provided in the connected documents. No affected product/version, root cause, or remediation details are disclosed here. Monitor for updates.

CVE-2024-38247

CVE-2024-38247 is a Windows Graphics Component local elevation of privilege vulnerability. The CVSSv3.1 vector shows Attack Vector: Local, Privileges Required: Low, User Interaction: None, with all of Confidentiality/Integrity/Availability impacts: High. Public documents confirm a Windows patch r...

CVE-2024-43622

CVE-2024-43622 is a Windows Telephony Service remote code execution vulnerability. According to NCSC guidance, it is associated with an 8.8/High severity score (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating network access without authentication is sufficient and user interaction is r...

CVE-2025-21201

CVE-2025-21201 is cited by NCSC as a Windows Telephony Server remote code execution vulnerability with CVSS-like severity of 8.8 (high) andImpact described as executing random code. The connected NCSC advisory confirms the vulnerability exists in Windows Telephony Server and provides an explicit ...

CVE-2025-21411

Technical details about CVE-2025-21411 are not provided in the connected documents. Public sources reference Windows Telephony Service Remote Code Execution, but this dataset contains no product/version/root-cause/fix specifics. Monitor for updates from MSRC and NVD.

CVE-2025-29842

Technical details (affected product, root cause, impact, fixes) for CVE-2025-29842 are not provided in the supplied connected documents. Monitor for updates from official advisories.

CVE-2026-50365

CVE-2026-50365 describes an Elevation of Privileges in the Windows RPC API (RPC server) due to improper authentication, enabling an adjacent-network attacker to gain high-priority access. Public data confirms an adjacent-network attack vector with high severity (CVSS ~8.0). The affected component...

CVE-2026-50366

CVE-2026-50366 describes a Denial of Service in Windows Active Directory Domain Services caused by a null pointer dereference. The vulnerability is exploitable over the network with no user interaction, requiring low privileges and network access from an authenticated attacker; the impact is deni...

CVE-2026-61926

CVE-2026-61926 : Heap-based buffer overflow in the Windows USB Driver allows an authorized local attacker to perform a local privilege escalation . Exploitation details are not provided beyond the CVSS metrics (LOCAL, LOW complexity, LOW privileges, NONE user interaction; high impact to confident...

CVE-2026-62733

CVE-2026-62733 is an out-of-bounds read in Windows Win32K that allows a locally authenticated attacker to elevate privileges. The vulnerability affects Win32K components and yields a Local Privilege Escalation (LPE) with HIGH impact to confidentiality, integrity, and availability (per CVSS 3.1: A...

CVE-2026-62785

CVE-2026-62785: Heap-based buffer overflow in Windows LDAP (Lightweight Directory Access Protocol) allows unauthenticated remote code execution over the network. Affected: Windows LDAP service. Root cause: improper heap handling leading to overflow. Impact: remote code execution with high severit...

CVE-2024-38119

CVE-2024-38119 affects Windows Network Address Translation (NAT). The vulnerability allows Remote Code Execution with high impact (cctx: code execution, data/privilege impact) when an attacker on an adjacent network exploits NAT processing. CVSS 3.1 vector: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Mi...

CVE-2024-43537

CVE-2024-43537 is a denial-of-service vulnerability in the Windows Mobile Broadband Driver. Public sources confirm an availability impact (DoS) with the CVSS=3.1 vector: Adjacent attacker, Low attack complexity, No privileges required, No user interaction, Scope unchanged, Confidentiality/Integri...

CVE-2024-49073

CVE-2024-49073 affects the Windows Mobile Broadband Driver and is an elevation-of-privilege vulnerability. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates physical access is required, with low attack complexity and no privileges required, but with high impact to confidentialit...

CVE-2025-21240

CVE-2025-21240 is a Windows Telephony Service remote code execution vulnerability. The CIRCL sighting data lists Windows Telephony Service with CVSS 8.80 (High) and impact: Execute random code, consistent with the CVSS vector in the Initial Description (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Conne...

CVE-2025-21258

Technical details about CVE-2025-21258 are not publicly provided in the supplied documents. No affected product/version/root cause/exploit or remediation details are present here; please consult Microsoft advisories for updates.

CVE-2025-21300

CVE-2025-21300 affects Windows UPnP Device Host. Connected CNVD data ties the issue to the Windows upnphost.dll component and a Denial of Service impact. Microsoft has published January 2025 security updates to address this family of issues; applying KB5050021 (and related January 2025 updates) i...

CVE-2025-21305

CVE-2025-21305 is documented as a Windows Telephony Service Remote Code Execution vulnerability. The connected CIRCL source explicitly lists CVE-2025-21305 under Windows Telephony Service with an impact described as Execute random code, indicating a code-execution vector in the Telephony service....

CVE-2025-21367

CVE-2025-21367 targets the Windows Win32 Kernel subsystem with a local elevation-of-privilege flaw. The NVD entry lists a CVSS v3.1 base score of 7.8 (HIGH) with local access, low attack complexity, and privileges required, and the impact to confidentiality, integrity, and availability as HIGH. C...

CVE-2025-24072

CVE-2025-24072 is a use-after-free vulnerability in Microsoft Local Security Authority Server (lsasrv) that can allow an authorized attacker to locally elevate privileges. The affected component is lsasrv; impact is elevated privileges (local). Connected sources (including NCSC/KB advisories) con...

CVE-2025-26641

CVE-2025-26641 affects Windows Cryptographic Services, causing Denial of Service via uncontrolled resource consumption over the network. Base score 7.5 (Network, High availability impact). Exploitation status not detailed in the provided connected documents; remediation per Microsoft security upd...

CVE-2025-32718

CVE-2025-32718 : Integer overflow or wraparound in Windows SMB enables a locally authenticated attacker to elevate privileges. Connected sources confirm impact as local privilege escalation on Windows SMB, with CVSS v3.1 base score 7.8 (HIGH) and local attack vector. Public references in NVD/NCSC...

CVE-2025-54918

CVE-2025-54918 describes an improper authentication flaw in Windows NTLM that enables a network-authenticated attacker to elevate privileges. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and privileges required. A PoC exploit exists on GitHub (CVE-2025-54918-...

CVE-2026-23669

CVE-2026-23669 is a Windows Print Spooler remote code execution vulnerability with CVSS 3.1 base score 8.8 (Network, Low attack complexity, Low privileges required, No user interaction). It impacts confidentiality, integrity, and availability (all HIGH). Exploit code maturity is UNPROVEN. The Mic...

CVE-2026-44812

CVE-2026-44812 affects Windows graphics component Win32K GRFX, where an integer overflow/wraparound in GRFX can allow an unauthorized attacker to execute code locally. The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H with a base score of 7.8 (HIGH). Exploitation details are not provide...

CVE-2026-61937

CVE-2026-61937 is a Windows HTTP.sys elevation-of-privilege vulnerability caused by an integer overflow/wraparound. An authenticated, local attacker could exploit this to gain elevated privileges on affected systems. The available documents identify the vulnerable component as Windows HTTP.sys an...

CVE-2026-62777

CVE-2026-62777 concerns Windows License Manager. The available documents state: a missing authentication for a critical function could allow an authorized attacker to elevate privileges locally. The CVSS 3.1 vector is Local, Low attack complexity, with Privileges Required: Low and User Interactio...

CVE-2026-62892

CVE-2026-62892 is a use-after-free vulnerability in the Capability Access Management Service (camsvc) that could allow an authorized attacker to elevate privileges locally. The publicly available data identifies a local attack vector with high impact (confidentiality, integrity, and availability)...

CVE-2024-38044

Technical details (affected product/version, root cause, impact, and fix) for CVE-2024-38044 are not disclosed in the provided Connected Documents; no public technical details are available here. Monitor for updates.

CVE-2024-43523

CVE-2024-43523 refers to a Windows Mobile Broadband Driver remote code execution vulnerability. Microsoft and CVE records indicate fixes are delivered via October 2024 security updates (e.g., KB5044284 and related servicing stacks), with mitigations requiring installation of those updates. The CV...

CVE-2024-43607

CVE-2024-43607 affects Windows Routing and Remote Access Service (RRAS). Vulnerability allows remote code execution over the network with no privileges and requires user interaction; CVSS v3.1 base score 8.8 (HIGH). Connected documents indicate RRAS-related fixes from Microsoft security updates (...

CVE-2024-49074

CVE-2024-49074 is a Windows Kernel-Mode Driver elevation-of-privilege vulnerability. The connected docs indicate a local exploit requiring low privileges with no user interaction, potentially enabling privileged execution on affected Windows kernel code. Public exploits exist. Microsoft released ...