Microsoft Windows 10 21H2 vulnerabilities

CVE-2026-70055 [MEDIUM] CWE-497 CVE-2026-70055: Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

CVE-2026-70260 [MEDIUM] CWE-497 CVE-2026-70260: Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

CVE-2026-70261 [MEDIUM] CWE-497 CVE-2026-70261: Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

CVE-2026-83705 [MEDIUM] CWE-497 CVE-2026-83705: Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allow Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

CVE-2026-83835 [MEDIUM] CWE-126 CVE-2026-83835: Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.

CVE-2025-29956 [MEDIUM] CWE-126 CVE-2025-29956: Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network.

CVE-2026-23670 [MEDIUM] CWE-822 CVE-2026-23670: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an autho Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2025-62567 [MEDIUM] CWE-191 CVE-2025-62567: Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny serv Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network.

CVE-2026-35423 [MEDIUM] CWE-125 CVE-2026-35423: Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a n Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-70084 [MEDIUM] CWE-22 CVE-2026-70084: Improper access control in Windows Projected File System allows an authorized attacker to disclose i Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally.

CVE-2026-85812 [MEDIUM] CWE-552 CVE-2026-85812: Files or directories accessible to external parties in Windows Bind Filter Driver allows an authoriz Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.

CVE-2026-68886 [MEDIUM] CWE-209 CVE-2026-68886: Use after free in Windows Network Connection Broker allows an authorized attacker to disclose inform Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.

CVE-2026-70137 [MEDIUM] CWE-306 CVE-2026-70137: Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally.

CVE-2026-69554 [MEDIUM] CWE-306 CVE-2026-69554: Missing authentication for critical function in Microsoft Windows Search Component allows an authori Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

CVE-2026-42914 [MEDIUM] CWE-125 CVE-2026-42914: Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.

CVE-2026-45595 [MEDIUM] CWE-693 CVE-2026-45595: Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to by Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.

CVE-2022-26934 [MEDIUM] CVE-2022-26934: Windows Graphics Component Information Disclosure Vulnerability Windows Graphics Component Information Disclosure Vulnerability

CVE-2023-35347 [HIGH] CWE-59 CVE-2023-35347: Microsoft Install Service Elevation of Privilege Vulnerability Microsoft Install Service Elevation of Privilege Vulnerability

CVE-2025-50158 [HIGH] CWE-367 CVE-2025-50158: Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally.

CVE-2023-23385 [HIGH] CWE-190 CVE-2023-23385: Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability