Microsoft Windows 10 Version 21H2 vulnerabilities

2,449 known vulnerabilities affecting microsoft/windows_10_version_21h2.

Total CVEs
2,449
CISA KEV
94
actively exploited
Public exploits
36
Exploited in wild
75
Severity breakdown
CRITICAL60HIGH1758MEDIUM621LOW10

Vulnerabilities

Page 9 of 123
CVE-2026-21231HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21231 [HIGH] CWE-362 CVE-2026-21231: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21242HIGHCVSS 7.0≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21242 [HIGH] CWE-416 CVE-2026-21242: Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges lo Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21255HIGHCVSS 8.8≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21255 [HIGH] CWE-284 CVE-2026-21255: Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security featur Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.
cvelistv5nvd
CVE-2026-21238HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21238 [HIGH] CWE-284 CVE-2026-21238: Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attack Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21246HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21246 [HIGH] CWE-122 CVE-2026-21246: Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21247HIGHCVSS 7.3≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21247 [HIGH] CWE-20 CVE-2026-21247: Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.
cvelistv5nvd
CVE-2026-21533HIGHCVSS 7.8KEV≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21533 [HIGH] CWE-269 CVE-2026-21533: Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate pri Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21234HIGHCVSS 7.0≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21234 [HIGH] CWE-362 CVE-2026-21234: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21235HIGHCVSS 7.3≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21235 [HIGH] CWE-416 CVE-2026-21235: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges l Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-21222MEDIUMCVSS 5.5≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21222 [MEDIUM] CWE-532 CVE-2026-21222: Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
cvelistv5nvd
CVE-2026-21525MEDIUMCVSS 6.2KEV≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21525 [MEDIUM] CWE-476 CVE-2026-21525: Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
cvelistv5nvd
CVE-2026-21249LOWCVSS 3.3≥ 10.0.19044.0, < 10.0.19044.69372026-02-10
CVE-2026-21249 [LOW] CWE-73 CVE-2026-21249: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spo External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally.
cvelistv5nvd
CVE-2026-20836HIGHCVSS 7.0≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20836 [HIGH] CWE-362 CVE-2026-20836: Concurrent execution using shared resource with improper synchronization ('race condition') in Graph Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-20919HIGHCVSS 7.5≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20919 [HIGH] CWE-362 CVE-2026-20919: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
cvelistv5nvd
CVE-2026-20864HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20864 [HIGH] CWE-122 CVE-2026-20864: Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attac Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-20840HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20840 [HIGH] CWE-122 CVE-2026-20840: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
cvelistv5nvd
CVE-2026-20826HIGHCVSS 7.0≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20826 [HIGH] CWE-362 CVE-2026-20826: Concurrent execution using shared resource with improper synchronization ('race condition') in Table Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-20865HIGHCVSS 7.8≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20865 [HIGH] CWE-416 CVE-2026-20865: Use after free in Windows Management Services allows an authorized attacker to elevate privileges lo Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2026-20875HIGHCVSS 7.5≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20875 [HIGH] CWE-476 CVE-2026-20875: Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an una Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
cvelistv5nvd
CVE-2026-20844HIGHCVSS 7.4≥ 10.0.19044.0, < 10.0.19044.68092026-01-13
CVE-2026-20844 [HIGH] CWE-362 CVE-2026-20844: Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges loc Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally.
cvelistv5nvd
← Previous9 / 123Next →