Microsoft Windows 10 21H2 vulnerabilities

CVE-2026-83585 [HIGH] CWE-134 CVE-2026-83585: Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-24290 [HIGH] CWE-284 CVE-2026-24290: Improper access control in Windows Projected File System allows an authorized attacker to elevate pr Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-69966 [HIGH] CWE-190 CVE-2026-69966: Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to eleva Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

CVE-2026-83583 [HIGH] CWE-862 CVE-2026-83583: Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.

CVE-2026-83670 [HIGH] CWE-125 CVE-2026-83670: Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disc Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.

CVE-2025-54092 [HIGH] CWE-362 CVE-2025-54092: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2026-70123 [HIGH] CWE-122 CVE-2026-70123: Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate pr Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CVE-2026-65799 [HIGH] CWE-122 CVE-2026-65799: Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges lo Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-77503 [HIGH] CWE-125 CVE-2026-77503: Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

CVE-2026-83918 [HIGH] CWE-190 CVE-2026-83918: Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-69295 [HIGH] CWE-20 CVE-2026-69295: Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-69738 [HIGH] CWE-122 CVE-2026-69738: Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

CVE-2026-69900 [HIGH] CWE-822 CVE-2026-69900: Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized atta Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-69707 [HIGH] CWE-190 CVE-2026-69707: Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an authorized Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-73002 [HIGH] CWE-190 CVE-2026-73002: Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

CVE-2026-69687 [HIGH] CWE-191 CVE-2026-69687: Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an au Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-69844 [HIGH] CWE-125 CVE-2026-69844: Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-69535 [HIGH] CWE-122 CVE-2026-69535: Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privilege Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

CVE-2026-77489 [HIGH] CWE-476 CVE-2026-77489: Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privi Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

CVE-2026-69532 [HIGH] CWE-125 CVE-2026-69532: Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.