CVE-2025-21180

CVE-2025-21180 is a Windows exFAT File System vulnerability described as a heap-based buffer overflow that could allow local code execution. The connected documents identify the affected component as the Windows exFAT file system driver and confirm the root cause as a heap-based overflow, enablin...

CVE-2025-24058

CVE-2025-24058 describes an elevation-of-privilege in the Windows DWM Core Library caused by improper input validation. The vulnerability enables a locally authenticated attacker to escalate privileges (local vector, no user interaction required per CVSS: High, with base score 7.8). Connected sou...

CVE-2025-24992

CVE-2025-24992 is a local, information-disclosure vulnerability in Windows NTFS caused by a buffer over-read. The CVE is tied to Windows NTFS and is described as allowing an unauthorized local disclosure of information. CVSS 3.1 base metrics indicate a Local attack vector, Low attack complexity, ...

CVE-2025-26686

CVE-2025-26686 is a Windows TCP/IP remote code execution vulnerability caused by sensitive data stored in improperly locked memory. It is network-based with high impact (total compromise potential) and requires user interaction according to the CVSS: network exposure, high complexity, no privileg...

CVE-2026-42980

The CVE-2026-42980 entry describes an integer underflow (wrap or wraparound) in the Windows NT OS Kernel that allows an authorized, local attacker to elevate privileges. Affected component: Windows NT OS Kernel; root cause: numeric underflow leading to improper bounds/flow control, enabling privi...

CVE-2024-43635

Technical details for CVE-2024-43635 are not publicly provided in the connected documents. The materials only reference a Windows Telephony Service RCE vulnerability. Monitor Microsoft advisories and vulnerability feeds for affected versions, impact, and remediation when they are disclosed.

CVE-2025-21190

CVE-2025-21190 is listed by an EU NCSC advisory under Windows Telephony Service with a CVSS of 8.80 and impact described as executing random code. The Connected Documents do not provide vendor/product version details or a concrete patch/fix within the supplied materials; Microsoft MSRC guidance i...

CVE-2025-21222

CVE-2025-21222 is a remote-code-execution vulnerability in Windows Telephony Service characterized by a heap-based buffer overflow that an unauthenticated attacker can trigger over the network. Connected sources corroborate its association with Windows Telephony Service and document it as a netwo...

CVE-2025-21241

CVE-2025-21241 is a Windows Telephony Service Remote Code Execution vulnerability. The CVSS 3.1 score is 8.8 (Netwrk attack vector, Low attack complexity, No privileges required, User interaction required; Impact: Confidentiality, Integrity, Availability High). Public entries indicate a Windows c...

CVE-2025-25008

CVE-2025-25008 describes an elevation-of-privilege in Windows due to improper link resolution before file access (link following). An authorized, local attacker could exploit this to gain higher privileges. CVSSv3.1 base score is 7.1 (High); attack vector LOCAL; privileges required LOW; user inte...

CVE-2025-27478

CVE-2025-27478 is a heap-based buffer overflow in Windows Local Security Authority (LSA) that enables a locally authenticated attacker to elevate privileges. The CVE is rated CVSS v3.1 7.0 (HIGH) with Local access, high confidentiality/integrity/availability impact. Connected sources confirm the ...

CVE-2025-32720

CVE-2025-32720 is a Windows Storage Management Provider vulnerability described as an information disclosure via an out-of-bounds read. The connected NCSC advisory lists it under Windows Storage Management Provider with CVSS 5.50 (Impact: Access to sensitive data) and indicates a local attack vec...

CVE-2026-33841

CVE-2026-33841 is a heap-based buffer overflow in the Windows kernel that allows an authorized, local attacker to elevate privileges. Public docs consistently describe the vulnerability as a local privilege escalation in Windows Kernel. The CVE has accompanying CVSSv3.1 metrics indicating local a...

CVE-2026-45604

CVE-2026-45604 is an out-of-bounds read vulnerability in the Windows AppID (Windows Application Identity) Subsystem that can allow an authorized local attacker to disclose information. The affected component is described as the AppID Subsystem; the root cause is an out-of-bounds read leading to i...

CVE-2024-49123

CVE-2024-49123 is a Windows Remote Desktop Services remote code execution vulnerability. Public records in ENISA list CVE-2024-49123 under Windows Remote Desktop Services with a CVSS v3.1 base score of 8.1 (NETWORK, NONE/CONFLICTING constraints: high impact to confidentiality, integrity, and avai...

CVE-2025-21232

CVE-2025-21232 is a Windows Digital Media Elevation of Privilege vulnerability. The linked data show a CVSS v3.1 base score of 6.6 (Medium) with a physical attack vector, requiring low privileges and no user interaction, and yielding high impact to confidentiality, integrity, and availability. Th...

CVE-2025-21242

CVE-2025-21242 is a Windows Kerberos information-disclosure vulnerability. Public sources (CNNVD/MSRC/NVD) identify it as a Kerberos-related information disclosure affecting multiple Windows builds (e.g., Windows 10/11 and Windows Server variants). The exact technical root cause and vulnerable su...

CVE-2025-21254

CVE-2025-21254 is associated with Internet Connection Sharing (ICS) in Windows and is described as a Denial-of-Service vulnerability. The primary documented impact is availability disruption (A) with low attack complexity and adjacent-attack vector, no authentication or user interaction required,...

CVE-2025-21255

Technical details about CVE-2025-21255 are not provided in the supplied documents. Public information is limited to a basic description and references. Monitor Microsoft KBs/NVD for affected products, root cause, and remediation as updates are published.

CVE-2025-21308

CVE-2025-21308 Windows Themes Spoofing affects the Windows Theme system. The vulnerability lets a malicious party impersonate the user and potentially execute code in the victim’s context, requiring the victim to open/edit a rogue file. The impact is described as impersonation with potential code...

CVE-2025-24988

The CVE-2025-24988 entry affects the Windows USB Video Driver, with an out-of-bounds read vulnerability that enables an authorized attacker with physical access to elevate privileges. Connected sources confirm this CVE name and context and indicate Microsoft has released updates to fix Windows US...

CVE-2025-26678

CVE-2025-26678 is a local security bypass in Windows Defender Application Control (WDAC) due to improper access control. The issue affects WDAC’s security feature and can be exploited locally to bypass protections. Public sources confirm the vulnerability and that updates released in April 2025 f...

CVE-2024-49076

Technical details about CVE-2024-49076 are not provided in the supplied documents. No affected products, versions, or root-cause are specified here. Monitor for updates from Microsoft and official vulnerability databases for concrete information and remediation steps.

CVE-2025-21372

Technical details about CVE-2025-21372 are not publicly provided in the connected documents. The materials reference Microsoft Brokering File System Elevation of Privilege vulnerability but do not specify affected products, root cause, versions, or fixes. Monitor for updates.

CVE-2025-21409

CVE-2025-21409 is a Windows Telephony Service Remote Code Execution vulnerability exploitable over the network (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Connected sources confirm this CVE entry and link it to Windows Telephony Service across Microsoft advisories; updates KB5050009, KB5050...

CVE-2025-27481

CVE-2025-27481 describes a stack-based buffer overflow in Windows Telephony Service that could allow a remote attacker to execute code over the network. The vulnerability affects the Windows Telephony Service component and is caused by a stack overflow in handling network input, with publicly pro...

CVE-2025-27486

CVE-2025-27486 affects Windows Standards-Based Storage Management Service, causing Denial-of-Service through uncontrolled resource consumption over the network. The primary public description confirms the vulnerability class, and Microsoft has released updates to address it (e.g., KBs in the Apri...

CVE-2025-29966

Technical details about CVE-2025-29966 (affected software/components, root cause, impact, or fixes) are not provided in the connected documents. Monitor for updates and sources in the feed for any concrete information.

CVE-2025-21292

CVE-2025-21292 affects Windows Search Service (Windows Search Component) and is categorized as an elevation-of-privilege vulnerability with a CVSS v3.1 base score of 8.8 (HIGH). The connected sources identify the impact as obtaining increased privileges and confirm the vulnerability within Window...

CVE-2025-21324

Technical details about CVE-2025-21324 are not publicly provided in the supplied connected documents. Public advisories mention Windows updates addressing kernel-related issues but do not provide CVE-specific exploit vectors, impacted products, or fixes in these sources. Monitor for updates.

CVE-2025-21373

Technical details for CVE-2025-21373 are not provided in the supplied documents. Monitor for updates from Microsoft and the KB/MSRC references for affected product, impact and fixes.

CVE-2025-24074

CVE-2025-24074 affects Microsoft Windows DWM Core Library. It is an Elevation of Privilege due to improper input validation, enabling local privilege escalation with a CVSSv3.1 base score of 7.8 (LOCAL, LOW attack complexity, NO user interaction). Impacted components include the DWM Core Library;...

CVE-2025-26675

CVE-2025-26675 is a Windows Subsystem for Linux elevation-of-privilege vulnerability caused by an out-of-bounds read. The issue allows an authorized, local attacker to elevate privileges on affected Windows systems. Public sources in the connected documents confirm the vulnerability and its impac...

CVE-2024-49079

Technical details for CVE-2024-49079 are not provided in the supplied documents. Monitor for updates from Microsoft, NVD, CVE List, and other official sources as disclosures evolve.

CVE-2025-21205

CVE-2025-21205 is a Windows Telephony Service vulnerability: a heap-based buffer overflow that allows a network-based attacker to achieve remote code execution. The CVSS details show a HIGH base score with NETWORK access, LOW attack complexity, and PR:N, UI:R. Successful exploitation would impact...

CVE-2025-21210

CVE-2025-21210 concerns Windows BitLocker information disclosure. Reports indicate that in certain scenarios the hibernation image created when a laptop with an open Windows session is closed may not be fully encrypted, potentially allowing recovery of RAM contents in plain text. This vulnerabili...

CVE-2025-21215

Technical details about CVE-2025-21215 are not provided in the connected documents. Public information here is limited to the vulnerability title and references; monitor for updates from Microsoft/NVD.

CVE-2025-21221

CVE-2025-21221: Heap-based buffer overflow in Windows Telephony Service enables remote code execution over the network. Exploitation requires network access, no privileges, and user interaction is needed; impact is high on confidentiality, integrity, and availability. Affected component: Windows ...

CVE-2025-21229

CVE-2025-21229 is listed as a Windows Digital Media Elevation of Privilege vulnerability. Connected documents indicate Microsoft updates exist to fix vulnerabilities in Windows, with MSRC guidance and KB articles available, but do not provide explicit technical details (vulnerable component versi...

CVE-2025-21261

Technical details about CVE-2025-21261 (affected product, vulnerability vector, impact, or patch) are not publicly provided in the connected documents; no concrete specifics are available here. Monitor official advisories and Microsoft/MSRC guidance for remediation.

CVE-2025-27730

CVE-2025-27730 is a local privilege escalation in Windows Digital Media caused by a use-after-free. Authorized attackers can elevate privileges on affected Windows builds. Public vulnerability records confirm the issue and Microsoft has released security updates to fix it (e.g., KB5055527/KB50555...

CVE-2025-60724

Technical details about CVE-2025-60724 are not provided in the supplied documents. Connected KBs discuss OS updates and security fixes but do not specify vulnerable product versions, root cause, exploitation, or patch specifics for this CVE. Monitor for updates.

CVE-2026-42985

CVE-2026-42985 is described in connected sources as a heap-based buffer overflow in the Remote Desktop Client that allows an unauthenticated attacker to execute code over the network. The initial and connected docs provide the vulnerability description and a high CVSS score (8.8, HIGH) with netwo...

CVE-2024-43450

CVE-2024-43450 is a Windows DNS spoofing vulnerability affecting Windows DNS/NTLM; the CVSS v3.1 base score is 7.5 (Network, High impact, User interaction required). Connected sources place this CVE in Microsoft Windows DNS with impact described as “Pretend to be another user.” Microsoft has rele...

CVE-2024-43628

According to the NCSC advisory, CVE-2024-43628 is a Windows Telephony Service Remote Code Execution vulnerability with a CVSS v3.1 base score of 8.8 (HIGH) and an impact described as Execute random code. The vulnerability is listed under Windows Telephony Service with a remediation path through M...

CVE-2024-43644

Technical details about CVE-2024-43644 (affected product, root cause, impact, or fix) are not provided in the connected documents. Monitor for updates from official advisories.

CVE-2024-49086

Technical details (affected product, vulnerable component, exploit specifics, remediation) are not provided in the supplied documents. Monitor for updates from Microsoft and security advisories.

CVE-2024-49127

CVE-2024-49127 is a Windows LDAP Remote Code Execution vulnerability in the LDAP component of Domain Controllers. The CVSS shows high impact (C/H, I/H, A/H) with network access required and no user interaction. The exploitation path involves an attacker obtaining network access to the DC and issu...

CVE-2025-21200

CVE-2025-21200 is listed by ENISA/NCSC as a vulnerability affecting the Windows Telephony Service with high impact and the ability to execute arbitrary code. The linked material specifies a CVSSv3.1 base score of 8.8 (Network attack, No user privileges, User interaction required; High confidentia...

CVE-2025-21285

Technical details (affected products, root cause, impact or fixes for CVE-2025-21285 MSMQ DoS) are not included in the provided documents. Monitor updates from Microsoft and CVE/CIRCL references for remedies and exposure.