Windows 11 25h2
by Microsoft
CVEs (1,162)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-62709 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. | ||
| CVE-2026-62703 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | ||
| CVE-2026-61936 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2026-61933 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | ||
| CVE-2026-61928 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-61360 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally. | ||
| CVE-2026-61347 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59137 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59136 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59135 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59131 | Med | 0.36 | 5.6 | 0.00 | Aug 11, 2026 | No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59130 | Med | 0.36 | 5.6 | 0.00 | Aug 11, 2026 | No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. | ||
| CVE-2026-59128 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. | ||
| CVE-2026-49177 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2026 | Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally. | ||
| CVE-2026-48566 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-45634 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Out-of-bounds read in Windows DHCP Server allows an authorized attacker to disclose information locally. | ||
| CVE-2026-45606 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny service locally. | ||
| CVE-2026-45604 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-45594 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally. | ||
| CVE-2026-42973 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. |
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.6epss 0.00
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.6epss 0.00
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows DHCP Server allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny service locally.
- risk 0.36cvss 5.5epss 0.00
Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.
Page 35 of 59