Microsoft Windows 10 21H2 vulnerabilities

CVE-2025-54091 [HIGH] CWE-122 CVE-2025-54091: Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privilege Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2025-49659 [HIGH] CWE-126 CVE-2025-49659: Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.

CVE-2025-49679 [HIGH] CWE-197 CVE-2025-49679: Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locall Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-40378 [HIGH] CWE-789 CVE-2026-40378: Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (L Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

CVE-2025-50152 [HIGH] CWE-125 CVE-2025-50152: Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-50175 [HIGH] CWE-416 CVE-2025-50175: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

CVE-2025-48816 [HIGH] CWE-125 CVE-2025-48816: Integer overflow or wraparound in HID class driver allows an authorized attacker to elevate privileg Integer overflow or wraparound in HID class driver allows an authorized attacker to elevate privileges locally.

CVE-2025-55701 [HIGH] CWE-1287 CVE-2025-55701: Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.

CVE-2025-59511 [HIGH] CWE-73 CVE-2025-59511: External control of file name or path in Windows WLAN Service allows an authorized attacker to eleva External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.

CVE-2025-55233 [HIGH] CWE-125 CVE-2025-55233: Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privile Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2025-62467 [HIGH] CWE-126 CVE-2025-62467: Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to ele Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-69850 [HIGH] CWE-822 CVE-2026-69850: Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privi Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.

CVE-2025-47991 [HIGH] CWE-416 CVE-2025-47991: Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privi Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

CVE-2025-49742 [HIGH] CWE-122 CVE-2025-49742: Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to exec Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally.

CVE-2025-53150 [HIGH] CWE-362 CVE-2025-53150: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

CVE-2025-59502 [HIGH] CWE-400 CVE-2025-59502: Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker t Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

CVE-2026-26161 [HIGH] CWE-20 CVE-2026-26161: Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevat Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

CVE-2025-59192 [HIGH] CWE-126 CVE-2025-59192: Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.

CVE-2024-26248 [HIGH] CWE-303 CVE-2024-26248: Windows Kerberos Elevation of Privilege Vulnerability Windows Kerberos Elevation of Privilege Vulnerability

CVE-2024-38239 [HIGH] CWE-1390 CVE-2024-38239: Windows Kerberos Elevation of Privilege Vulnerability Windows Kerberos Elevation of Privilege Vulnerability