Microsoft Windows 10 21H2 vulnerabilities

CVE-2023-24931 [HIGH] CWE-125 CVE-2023-24931: Windows Secure Channel Denial of Service Vulnerability Windows Secure Channel Denial of Service Vulnerability

CVE-2023-28241 [HIGH] CVE-2023-28241: Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability

CVE-2023-35338 [HIGH] CWE-476 CVE-2023-35338: Windows Peer Name Resolution Protocol Denial of Service Vulnerability Windows Peer Name Resolution Protocol Denial of Service Vulnerability

CVE-2023-28217 [HIGH] CWE-400 CVE-2023-28217: Windows Network Address Translation (NAT) Denial of Service Vulnerability Windows Network Address Translation (NAT) Denial of Service Vulnerability

CVE-2023-24859 [HIGH] CWE-476 CVE-2023-24859: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

CVE-2023-21813 [HIGH] CWE-126 CVE-2023-21813: Windows Secure Channel Denial of Service Vulnerability Windows Secure Channel Denial of Service Vulnerability

CVE-2023-32044 [HIGH] CWE-125 CVE-2023-32044: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

CVE-2023-32045 [HIGH] CWE-125 CVE-2023-32045: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

CVE-2026-85939 [MEDIUM] CWE-1390 CVE-2026-85939: Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature ove Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.

CVE-2023-36805 [HIGH] CWE-77 CVE-2023-36805: Windows MSHTML Platform Security Feature Bypass Vulnerability Windows MSHTML Platform Security Feature Bypass Vulnerability

CVE-2026-49165 [HIGH] CWE-908 CVE-2026-49165: Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclo Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.

CVE-2025-33057 [MEDIUM] CWE-476 CVE-2025-33057: Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network.

CVE-2025-26640 [HIGH] CWE-415 CVE-2025-26640: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

CVE-2025-55680 [HIGH] CWE-367 CVE-2025-55680: Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows a Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-54093 [HIGH] CWE-367 CVE-2025-54093: Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

CVE-2025-53802 [HIGH] CWE-416 CVE-2025-53802: Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges loca Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

CVE-2025-47975 [HIGH] CWE-415 CVE-2025-47975: Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

CVE-2025-27732 [HIGH] CWE-591 CVE-2025-27732: Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized att Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVE-2025-26665 [HIGH] CWE-591 CVE-2025-26665: Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized atta Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.

CVE-2025-49734 [HIGH] CWE-923 CVE-2025-49734: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.