Microsoft Windows 10 Version 21H2 vulnerabilities
2,906 known vulnerabilities affecting microsoft/windows_10_version_21h2.
Total CVEs
2,906
CISA KEV
95
actively exploited
Public exploits
67
Exploited in wild
123
Severity breakdown
CRITICAL79HIGH2093MEDIUM721LOW13
Vulnerabilities
Page 23 of 146
CVE-2025-21222P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.57372025-04-08
CVE-2025-21222 [HIGH] CWE-122 CVE-2025-21222: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute c
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21221P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.57372025-04-08
CVE-2025-21221 [HIGH] CWE-122 CVE-2025-21221: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute c
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21205P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.57372025-04-08
CVE-2025-21205 [HIGH] CWE-122 CVE-2025-21205: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute c
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-29966P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.58542025-05-13
CVE-2025-29966 [HIGH] CWE-122 CVE-2025-29966: Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21417P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.53712025-01-14
CVE-2025-21417 [HIGH] CWE-122 CVE-2025-21417: Windows Telephony Service Remote Code Execution Vulnerability
Windows Telephony Service Remote Code Execution Vulnerability
nvd
CVE-2025-21409P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.53712025-01-14
CVE-2025-21409 [HIGH] CWE-122 CVE-2025-21409: Windows Telephony Service Remote Code Execution Vulnerability
Windows Telephony Service Remote Code Execution Vulnerability
nvd
CVE-2025-21339P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.53712025-01-14
CVE-2025-21339 [HIGH] CWE-122 CVE-2025-21339: Windows Telephony Service Remote Code Execution Vulnerability
Windows Telephony Service Remote Code Execution Vulnerability
nvd
CVE-2025-21411P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.53712025-01-14
CVE-2025-21411 [HIGH] CWE-122 CVE-2025-21411: Windows Telephony Service Remote Code Execution Vulnerability
Windows Telephony Service Remote Code Execution Vulnerability
nvd
CVE-2025-21413P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.53712025-01-14
CVE-2025-21413 [HIGH] CWE-122 CVE-2025-21413: Windows Telephony Service Remote Code Execution Vulnerability
Windows Telephony Service Remote Code Execution Vulnerability
nvd
CVE-2025-48817P3HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.60932025-07-08
CVE-2025-48817 [HIGH] CWE-23 CVE-2025-48817: Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code ove
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-20820P3HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20820 [HIGH] CWE-122 CVE-2026-20820: Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-59516P3HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.66912025-12-09
CVE-2025-59516 [HIGH] CWE-73 CVE-2025-59516: Missing authentication for critical function in Windows Storage VSP Driver allows an authorized atta
Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-62454P3HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.66912025-12-09
CVE-2025-62454 [HIGH] CWE-122 CVE-2025-62454: Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker t
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-54916P3HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.63322025-09-09
CVE-2025-54916 [HIGH] CWE-121 CVE-2025-54916: Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
nvd
CVE-2026-20856P3HIGHCVSS 8.1≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20856 [HIGH] CWE-20 CVE-2026-20856: Improper input validation in Windows Server Update Service allows an unauthorized attacker to execut
Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50460P3HIGHCVSS 8.1≥ 10.0.19044.0, < 10.0.19044.75482026-07-14
CVE-2026-50460 [HIGH] CWE-362 CVE-2026-50460: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2025-21277P3HIGHCVSS 7.5≥ 10.0.19044.0, < 10.0.19044.53712025-01-14
CVE-2025-21277 [HIGH] CWE-126 CVE-2025-21277: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2022-30165P3HIGHCVSS 8.8≥ 10.0.19043.0, < 10.0.19043.17662022-06-15
CVE-2022-30165 [HIGH] CVE-2022-30165: Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
nvd
CVE-2023-21818P3HIGHCVSS 7.5≥ 10.0.19043.0, < 10.0.19044.26042023-02-14
CVE-2023-21818 [HIGH] CWE-20 CVE-2023-21818: Windows Secure Channel Denial of Service Vulnerability
Windows Secure Channel Denial of Service Vulnerability
nvd
CVE-2026-20921P3HIGHCVSS 7.5≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20921 [HIGH] CWE-362 CVE-2026-20921: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd