Microsoft Windows 10 Version 22H2 vulnerabilities

CVE-2025-54102 [HIGH] CWE-416 CVE-2025-54102: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevat Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

CVE-2025-53726 [HIGH] CWE-843 CVE-2025-53726: Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows a Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CVE-2025-53724 [HIGH] CWE-843 CVE-2025-53724: Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows a Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CVE-2025-47976 [HIGH] CWE-416 CVE-2025-47976: Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

CVE-2025-50155 [HIGH] CWE-122 CVE-2025-50155: Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows a Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CVE-2025-53725 [HIGH] CWE-843 CVE-2025-53725: Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows a Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CVE-2025-53132 [HIGH] CWE-362 CVE-2025-53132: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVE-2025-60703 [HIGH] CWE-822 CVE-2025-60703: Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate pri Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

CVE-2025-60720 [HIGH] CWE-126 CVE-2025-60720: Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.

CVE-2025-47982 [HIGH] CWE-20 CVE-2025-47982: Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate pri Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-47159 [HIGH] CWE-693 CVE-2025-47159: Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an author Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

CVE-2025-55236 [HIGH] CWE-367 CVE-2025-55236: Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker t Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally.

CVE-2026-69760 [HIGH] CWE-125 CVE-2026-69760: Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a networ Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a network.

CVE-2026-70104 [HIGH] CWE-822 CVE-2026-70104: Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to ele Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

CVE-2026-83669 [HIGH] CWE-908 CVE-2026-83669: Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate pr Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2025-58728 [HIGH] CWE-416 CVE-2025-58728: Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges loca Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

CVE-2025-49660 [HIGH] CWE-416 CVE-2025-49660: Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.

CVE-2026-83848 [HIGH] CWE-822 CVE-2026-83848: Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

CVE-2026-25165 [HIGH] CWE-476 CVE-2026-25165: Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate pr Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.

CVE-2025-62457 [HIGH] CWE-125 CVE-2025-62457: Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevat Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.