Microsoft Windows 10 21H2 vulnerabilities

CVE-2025-55226 [MEDIUM] CWE-362 CVE-2025-55226: Concurrent execution using shared resource with improper synchronization ('race condition') in Graph Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally.

CVE-2026-69373 [MEDIUM] CWE-125 CVE-2026-69373: Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate pr Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

CVE-2026-72935 [MEDIUM] CWE-125 CVE-2026-72935: Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-65795 [MEDIUM] CWE-197 CVE-2026-65795: Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-21265 [MEDIUM] CWE-1329 CVE-2026-21265: Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificate Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The ope

CVE-2026-0390 [MEDIUM] CWE-807 CVE-2026-0390: Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized atta Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

CVE-2024-26209 [MEDIUM] CWE-908 CVE-2024-26209: Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability

CVE-2026-96300 [MEDIUM] CWE-770 CVE-2026-96300: Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network.

CVE-2026-69723 [MEDIUM] CWE-497 CVE-2026-69723: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network.

CVE-2026-69349 [MEDIUM] CWE-908 CVE-2026-69349: Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network.

CVE-2026-102198 [MEDIUM] CWE-125 CVE-2026-102198: Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose info Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.

CVE-2023-20588 [MEDIUM] CWE-369 CVE-2023-20588: A division-by-zero error on some AMD processors can potentially return speculative data resulting i A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.

CVE-2024-20659 [HIGH] CWE-20 CVE-2024-20659: Windows Hyper-V Security Feature Bypass Vulnerability Windows Hyper-V Security Feature Bypass Vulnerability

CVE-2025-21419 [HIGH] CWE-59 CVE-2025-21419: Windows Setup Files Cleanup Elevation of Privilege Vulnerability Windows Setup Files Cleanup Elevation of Privilege Vulnerability

CVE-2024-30033 [HIGH] CWE-59 CVE-2024-30033: Windows Search Service Elevation of Privilege Vulnerability Windows Search Service Elevation of Privilege Vulnerability

CVE-2023-24023 [MEDIUM] CVE-2023-24023: Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.

CVE-2025-21414 [HIGH] CWE-122 CVE-2025-21414: Windows Core Messaging Elevation of Privileges Vulnerability Windows Core Messaging Elevation of Privileges Vulnerability

CVE-2025-21184 [HIGH] CWE-122 CVE-2025-21184: Windows Core Messaging Elevation of Privileges Vulnerability Windows Core Messaging Elevation of Privileges Vulnerability

CVE-2024-38022 [HIGH] CWE-59 CVE-2024-38022: Windows Image Acquisition Elevation of Privilege Vulnerability Windows Image Acquisition Elevation of Privilege Vulnerability

CVE-2024-38248 [HIGH] CWE-416 CVE-2024-38248: Windows Storage Elevation of Privilege Vulnerability Windows Storage Elevation of Privilege Vulnerability