Microsoft Windows 10 Version 22H2 vulnerabilities

CVE-2025-26644 [MEDIUM] CWE-1039 CVE-2025-26644: Automated recognition mechanism with inadequate detection or handling of adversarial input perturbat Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.

CVE-2024-21305 [MEDIUM] CWE-732 CVE-2024-21305: Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability

CVE-2026-83786 [MEDIUM] CWE-209 CVE-2026-83786: Generation of error message containing sensitive information in Windows NTFS allows an authorized at Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.

CVE-2025-55333 [MEDIUM] CWE-1023 CVE-2025-55333: Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to b Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-21328 [MEDIUM] CWE-41 CVE-2025-21328: MapUrlToZone Security Feature Bypass Vulnerability MapUrlToZone Security Feature Bypass Vulnerability

CVE-2025-21329 [MEDIUM] CWE-41 CVE-2025-21329: MapUrlToZone Security Feature Bypass Vulnerability MapUrlToZone Security Feature Bypass Vulnerability

CVE-2026-69969 [MEDIUM] CWE-59 CVE-2026-69969: Improper link resolution before file access ('link following') in Windows AppX Deployment Service al Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.

CVE-2026-69832 [MEDIUM] CWE-497 CVE-2026-69832: Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

CVE-2026-102186 [MEDIUM] CWE-822 CVE-2026-102186: Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclo Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

CVE-2026-70063 [MEDIUM] CWE-125 CVE-2026-70063: Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.

CVE-2026-69506 [MEDIUM] CWE-125 CVE-2026-69506: Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose informa Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

CVE-2026-85866 [MEDIUM] CWE-497 CVE-2026-85866: Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.

CVE-2026-69974 [MEDIUM] CWE-125 CVE-2026-69974: Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information l Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.

CVE-2026-68891 [MEDIUM] CWE-125 CVE-2026-68891: Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information l Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

CVE-2026-69853 [MEDIUM] CWE-908 CVE-2026-69853: Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose informatio Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

CVE-2026-96853 [MEDIUM] CWE-367 CVE-2026-96853: Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an author Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVE-2026-50661 [MEDIUM] CWE-693 CVE-2026-50661: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a securi Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-83697 [MEDIUM] CWE-367 CVE-2026-83697: Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows a Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

CVE-2026-26175 [MEDIUM] CWE-908 CVE-2026-26175: Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a se Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-54107 [MEDIUM] CWE-41 CVE-2025-54107: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to b Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.