Windows Server 2016
by Microsoft
CVEs (3,555)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-26648 | 0.00 | — | 0.00 | Apr 8, 2025 | Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally. | |||
| CVE-2025-26637 | 0.00 | — | 0.01 | Apr 8, 2025 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | |||
| CVE-2025-21222 | 0.00 | — | 0.01 | Apr 8, 2025 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. | |||
| CVE-2025-21221 | 0.00 | — | 0.01 | Apr 8, 2025 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. | |||
| CVE-2025-21204 | 0.00 | — | 0.06 | Apr 8, 2025 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | |||
| CVE-2025-21203 | 0.00 | — | 0.01 | Apr 8, 2025 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | |||
| CVE-2025-21205 | 0.00 | — | 0.01 | Apr 8, 2025 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. | |||
| CVE-2025-21191 | 0.00 | — | 0.00 | Apr 8, 2025 | Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. | |||
| CVE-2025-21197 | 0.00 | — | 0.03 | Apr 8, 2025 | Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content. | |||
| CVE-2025-24073 | 0.00 | — | 0.01 | Apr 8, 2025 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |||
| CVE-2025-27742 | 0.00 | — | 0.01 | Apr 8, 2025 | Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally. | |||
| CVE-2025-27741 | 0.00 | — | 0.01 | Apr 8, 2025 | Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. | |||
| CVE-2025-27740 | 0.00 | — | 0.03 | Apr 8, 2025 | Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network. | |||
| CVE-2025-27478 | 0.00 | — | 0.00 | Apr 8, 2025 | Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. | |||
| CVE-2025-27477 | 0.00 | — | 0.01 | Apr 8, 2025 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. | |||
| CVE-2025-27474 | 0.00 | — | 0.02 | Apr 8, 2025 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | |||
| CVE-2025-27471 | 0.00 | — | 0.01 | Apr 8, 2025 | Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network. | |||
| CVE-2025-26688 | 0.00 | — | 0.01 | Apr 8, 2025 | Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. | |||
| CVE-2025-26686 | 0.00 | — | 0.01 | Apr 8, 2025 | Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | |||
| CVE-2025-26668 | 0.00 | — | 0.01 | Apr 8, 2025 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
- CVE-2025-26648Apr 8, 2025risk 0.00cvss —epss 0.00
Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2025-26637Apr 8, 2025risk 0.00cvss —epss 0.01
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- CVE-2025-21222Apr 8, 2025risk 0.00cvss —epss 0.01
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-21221Apr 8, 2025risk 0.00cvss —epss 0.01
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-21204Apr 8, 2025risk 0.00cvss —epss 0.06
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- CVE-2025-21203Apr 8, 2025risk 0.00cvss —epss 0.01
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- CVE-2025-21205Apr 8, 2025risk 0.00cvss —epss 0.01
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-21191Apr 8, 2025risk 0.00cvss —epss 0.00
Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
- CVE-2025-21197Apr 8, 2025risk 0.00cvss —epss 0.03
Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
- CVE-2025-24073Apr 8, 2025risk 0.00cvss —epss 0.01
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- CVE-2025-27742Apr 8, 2025risk 0.00cvss —epss 0.01
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
- CVE-2025-27741Apr 8, 2025risk 0.00cvss —epss 0.01
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
- CVE-2025-27740Apr 8, 2025risk 0.00cvss —epss 0.03
Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
- CVE-2025-27478Apr 8, 2025risk 0.00cvss —epss 0.00
Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
- CVE-2025-27477Apr 8, 2025risk 0.00cvss —epss 0.01
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-27474Apr 8, 2025risk 0.00cvss —epss 0.02
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- CVE-2025-27471Apr 8, 2025risk 0.00cvss —epss 0.01
Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network.
- CVE-2025-26688Apr 8, 2025risk 0.00cvss —epss 0.01
Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
- CVE-2025-26686Apr 8, 2025risk 0.00cvss —epss 0.01
Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
- CVE-2025-26668Apr 8, 2025risk 0.00cvss —epss 0.01
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Page 152 of 178