CVE-2026-42981

The provided documents identify CVE-2026-42981 as a Windows Performance Monitor remote code execution vulnerability caused by an integer underflow (wrap/wraparound). The issue is exploitable over the network without user interaction and with no privileges required (AV:N/PR:N/UI:N), as indicated b...

CVE-2026-44802

CVE-2026-44802 is a use-after-free in Windows DWM Core Library that enables a local privilege escalation by an authorized user. CVSS 3.1 base score 7.8 (High) with local attack vector, low attack complexity, and require low privileges with no user interaction; impact to confidentiality, integrity...

CVE-2026-49176

Summary: CVE-2026-49176 is a Windows WalletService elevation of privilege vulnerability described as improper privilege management that could allow an authorized local attacker to escalate privileges. The available sources (NVD/CVE records) confirm the issue but do not provide concrete details on...

CVE-2026-65787

The CVE-2026-65787 entry describes a heap-based buffer overflow in Desktop Window Manager that allows an authorized attacker to elevate privileges locally. Documented impact is local privilege escalation with a high severity (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affec...

CVE-2026-70347

CVE-2026-70347 describes a heap-based buffer overflow in Windows Installer that can enable an authenticated, local attacker to elevate privileges. Affected component is Windows Installer; the vulnerability is a local, privilege-escalation flaw with high impact (C:H/I:H/A:H) and CVSSv3.1 score 7.8...

CVE-2024-43630

CVE-2024-43630 is a Windows Kernel Elevation of Privilege vulnerability. Connected sources confirm it affects Windows kernel components and is characterized by local, low-privilege attack with no user interaction, enabling highest/total impact on confidentiality, integrity, and availability. The ...

CVE-2025-21210

CVE-2025-21210 concerns Windows BitLocker information disclosure. Reports indicate that in certain scenarios the hibernation image created when a laptop with an open Windows session is closed may not be fully encrypted, potentially allowing recovery of RAM contents in plain text. This vulnerabili...

CVE-2025-24058

CVE-2025-24058 describes an elevation-of-privilege in the Windows DWM Core Library caused by improper input validation. The vulnerability enables a locally authenticated attacker to escalate privileges (local vector, no user interaction required per CVSS: High, with base score 7.8). Connected sou...

CVE-2025-24063

Technical details such as affected product/version, root cause, specific exploit scenario, and remediation for CVE-2025-24063 are not provided in the connected documents. Monitor for official updates (vendor advisories or CVE disclosures) for concrete technical information and fixes.

CVE-2025-24992

CVE-2025-24992 is a local, information-disclosure vulnerability in Windows NTFS caused by a buffer over-read. The CVE is tied to Windows NTFS and is described as allowing an unauthorized local disclosure of information. CVSS 3.1 base metrics indicate a Local attack vector, Low attack complexity, ...

CVE-2025-21414

CVE-2025-21414 is associated with Windows Core Messaging and is listed in a vulnerability roundup as an Elevation of Privilege risk, with the AVLEONOV source explicitly grouping it under EoP for Windows Core Messaging. The connected materials confirm the affected component (Windows Core Messaging...

CVE-2025-24061

The Windows Mark of the Web (MOTW) security feature contains a protection mechanism failure that allows an unauthorized attacker to bypass local security restrictions. Exploitation of this vulnerability can lead to the circumvention of security measures and unauthorized access to encrypted data ....

CVE-2025-26671

CVE-2025-26671 is a Windows Remote Desktop Services remote code execution vulnerability. The connected documents indicate a use-after-free in the RDS component that allows a network-exposed attacker to execute arbitrary code on the affected host without user interaction. Exploitation is described...

CVE-2025-26678

CVE-2025-26678 is a local security bypass in Windows Defender Application Control (WDAC) due to improper access control. The issue affects WDAC’s security feature and can be exploited locally to bypass protections. Public sources confirm the vulnerability and that updates released in April 2025 f...

CVE-2025-26679

CVE-2025-26679 is described as a use-after-free in the RPC Endpoint Mapper Service that allows a locally authenticated attacker to escalate privileges. Connected sources corroborate its existence and categorize the impact as a privilege-escalation flaw within Windows’ RPC Endpoint Mapper componen...

CVE-2025-27732

CVE-2025-27732 is a Windows Graphics Component Elevation of Privilege vulnerability in the Win32K GRFX subsystem. The flaw stems from Sensitive data stored in improperly locked memory in the GRFX path, enabling an authorized, local attacker to elevate privileges. The vulnerability affects Windows...

CVE-2026-62749

CVE-2026-62749 is a Windows Kernel use-after-free vulnerability that enables a locally authenticated attacker to achieve privilege escalation. The NVD entry notes a local attack vector with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.0, HIGH, LOCAL, LOW privileges req...

CVE-2024-49077

CVE-2024-49077 concerns the Windows Mobile Broadband Driver and is categorized as an elevation-of-privilege vulnerability. The available documents identify the affected component as the Windows Mobile Broadband driver and classify the impact as escalation of privileges with a base CVSSv3.1 score ...

CVE-2024-49129

CVE-2024-49129 is listed in RD Gateway/RD Services as a Denial of Service vulnerability with CVSS v3.1 base 7.5 (Network attack, high complexity, low privileges). Connected sources (e.g., NCSC advisory) explicitly associate CVE-2024-49129 with a Denial of Service impact in Windows Remote Desktop ...

CVE-2025-21286

CVE-2025-21286 is a Windows Telephony Service Remote Code Execution vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a high impact with network attack vector and user interaction required. Connected sources confirm Microsoft fixes are available: KB5050009 (OS Build ...

CVE-2025-21307

CVE-2025-21307 concerns the Windows Reliable Multicast Transport Driver (RMCAST) and is described as a remote code execution vulnerability. The CVSS vector indicates network access, no user interaction, and a high impact across confidentiality, integrity, and availability (base score 9.8, CRITICA...

CVE-2025-24048

CVE-2025-24048 is a heap-based buffer overflow in the Windows Hyper-V role that enables a locally authenticated attacker to elevate privileges. Public records confirm this is associated with Windows Hyper-V and is rated high severity with local exploitability and total impact to confidentiality, ...

CVE-2025-24074

CVE-2025-24074 affects Microsoft Windows DWM Core Library. It is an Elevation of Privilege due to improper input validation, enabling local privilege escalation with a CVSSv3.1 base score of 7.8 (LOCAL, LOW attack complexity, NO user interaction). Impacted components include the DWM Core Library;...

CVE-2025-24988

The CVE-2025-24988 entry affects the Windows USB Video Driver, with an out-of-bounds read vulnerability that enables an authorized attacker with physical access to elevate privileges. Connected sources confirm this CVE name and context and indicate Microsoft has released updates to fix Windows US...

CVE-2025-26637

CVE-2025-26637 affects Windows BitLocker, described as a protection mechanism failure that allows bypass of security with a physical attack. The CVSSv3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a physical-attack feasible exploit with high confidentiality, integrity, and availabilit...

CVE-2025-26686

CVE-2025-26686 is a Windows TCP/IP remote code execution vulnerability caused by sensitive data stored in improperly locked memory. It is network-based with high impact (total compromise potential) and requires user interaction according to the CVSS: network exposure, high complexity, no privileg...

CVE-2025-27481

CVE-2025-27481 describes a stack-based buffer overflow in Windows Telephony Service that could allow a remote attacker to execute code over the network. The vulnerability affects the Windows Telephony Service component and is caused by a stack overflow in handling network input, with publicly pro...

CVE-2026-62743

CVE-2026-62743 describes an out-of-bounds read in Windows Win32K that can lead to local information disclosure by an authorized attacker. The vulnerability affects the Win32K component and is exploitable with low privileges and no user interaction, with a local attack vector. The CVSS3.1 base sco...

CVE-2024-43637

CVE-2024-43637 is a Windows USB Video Class System Driver elevation-of-privilege vulnerability. The connected documents confirm a Windows USB Video Driver entry and indicate that Microsoft patched this family of flaws in November 2024 updates (e.g., KB5046616/OS Build 20348.2849 and related KBs)....

CVE-2025-21292

CVE-2025-21292 affects Windows Search Service (Windows Search Component) and is categorized as an elevation-of-privilege vulnerability with a CVSS v3.1 base score of 8.8 (HIGH). The connected sources identify the impact as obtaining increased privileges and confirm the vulnerability within Window...

CVE-2025-27490

The CVE-2025-27490 entry describes a heap-based buffer overflow in Windows Bluetooth Service that allows an authorized attacker to elevate privileges locally. Microsoft’s advisories confirm a local-privilege-escalation impact due to a vulnerability in the Bluetooth subsystem, with public fixes re...

CVE-2026-33842

The CVE-2026-33842 entry describes a local information disclosure in Windows File Explorer. The vulnerability allows an authorized (low privileges) attacker to disclose sensitive information locally through the File Explorer component. Per the NVD entry, the impact is confined to confidentiality ...

CVE-2026-59130

AMD Zen CPUs are affected by CVE-2026-59130, described as an information disclosure vulnerability that allows an authorized user to disclose information locally. The NVD/CVE description notes no CWE mapping and that the attack vector is LOCAL with LOW privileges required and HIGH confidentiality ...

CVE-2024-49126

CVE-2024-49126 affects Windows Local Security Authority Subsystem Service (LSASS) and enables remote code execution. The CVSS v3.1 base context shows Network attack vector, high impact on confidentiality, integrity, and availability, with no privileges required and no user interaction. Connected ...

CVE-2024-49127

CVE-2024-49127 is a Windows LDAP Remote Code Execution vulnerability in the LDAP component of Domain Controllers. The CVSS shows high impact (C/H, I/H, A/H) with network access required and no user interaction. The exploitation path involves an attacker obtaining network access to the DC and issu...

CVE-2025-21219

CVE-2025-21219 corresponds to a MapUrlToZone Security Feature Bypass in Windows. The Connected data lists this CVE with a CVSS v3.1 base score of 4.3 (Network, Low) and a

CVE-2025-21232

CVE-2025-21232 is a Windows Digital Media Elevation of Privilege vulnerability. The linked data show a CVSS v3.1 base score of 6.6 (Medium) with a physical attack vector, requiring low privileges and no user interaction, and yielding high impact to confidentiality, integrity, and availability. Th...

CVE-2025-24055

CVE-2025-24055 is a Windows USB Video Driver vulnerability described as an out-of-bounds read that could allow an authorized attacker to disclose information with a physical attack. The CVSSv3.1 base score is 4.3 (Medium), with privileges required as Low, attack vector Physical, and impact restri...

CVE-2025-27737

CVE-2025-27737 refers to an issue in Windows Security Zone Mapping caused by improper input validation that enables an unauthorized, locally present attacker to bypass a security feature. The vulnerability is categorized with local attack vector and high impact ( Confidentiality, Integrity, Avail...

CVE-2026-61938

Technical details about CVE-2026-61938 are not publicly available in the provided documents. Monitor for updates from authoritative sources.

CVE-2024-43629

CVE-2024-43629 affects the Windows DWM Core Library and is an Elevation of Privilege vulnerability. The connected KB/MSRC data confirms the affected component (DWM Core Library) and labels the CVE with a high severity (base score 7.8, local attack, low complexity, privileges required: low) and im...

CVE-2025-21241

CVE-2025-21241 is a Windows Telephony Service Remote Code Execution vulnerability. The CVSS 3.1 score is 8.8 (Netwrk attack vector, Low attack complexity, No privileges required, User interaction required; Impact: Confidentiality, Integrity, Availability High). Public entries indicate a Windows c...

CVE-2025-21318

Technical details for CVE-2025-21318 are not publicly available in the provided documents. Monitor official advisories and vendor bulletins for updates.

CVE-2025-27730

CVE-2025-27730 is a local privilege escalation in Windows Digital Media caused by a use-after-free. Authorized attackers can elevate privileges on affected Windows builds. Public vulnerability records confirm the issue and Microsoft has released security updates to fix it (e.g., KB5055527/KB50555...

CVE-2026-72983

CVE-2026-72983 is a use-after-free vulnerability in Windows Internet Connection Sharing (ICS) that allows an unauthorized remote attacker to achieve remote code execution over the network. The CVSS 3.1 score is 9.8 (Critical) with no privileges or user interaction required. CISA's SSVC assessment...

CVE-2024-49094

CVE-2024-49094 is a Windows Wireless Wide Area Network Service (WwanSvc) elevation-of-privilege vulnerability. The connected documents indicate that exploitation can lead to elevated privileges on affected Windows endpoints (local context). Microsoft has published updates fixing the issue (e.g., ...

CVE-2025-21216

CVE-2025-21216 is a Windows Internet Connection Sharing (ICS) Denial of Service vulnerability. The available data show a CVSS v3.1 base score of 6.5 (Medium) with an impact on availability, requiring adjacent network access, low attack complexity, no privileges required, and no user interaction. ...

CVE-2025-21226

Technical details about CVE-2025-21226 are not provided in the supplied documents. No concrete affected components or fixes are stated; monitor for updates.

CVE-2025-21276

CVE-2025-21276 is a Windows MapUrlToZone Denial of Service vulnerability. The CVE entry lists a NETWORK‑level attack with low complexity and no privileges required, resulting in a HIGH impact on availability (CVSS 3.1 base 7.5). Multiple connected sources corroborate a DoS condition in the MapUrl...

CVE-2025-21368

CVE-2025-21368 is a Microsoft Digest Authentication Remote Code Execution vulnerability. The provided metrics indicate CVSS 3.1 base score 8.8 (HIGH) with Network attack vector, Low attack complexity, Privileges Required: Low, No user interaction, and the impact is full confidentiality, integrity...