Microsoft Windows 11 23H2 vulnerabilities

CVE-2025-62218 [HIGH] CWE-362 CVE-2025-62218: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.

CVE-2025-62219 [HIGH] CWE-362 CVE-2025-62219: Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privi Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.

CVE-2025-60708 [MEDIUM] CWE-822 CVE-2025-60708: Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service lo Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.

CVE-2025-62209 [MEDIUM] CWE-532 CVE-2025-62209: Insertion of sensitive information into log file in Windows License Manager allows an authorized att Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

CVE-2025-62208 [MEDIUM] CWE-532 CVE-2025-62208: Insertion of sensitive information into log file in Windows License Manager allows an authorized att Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

CVE-2025-59510 [MEDIUM] CWE-59 CVE-2025-59510: Improper link resolution before file access ('link following') in Windows Routing and Remote Access Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.

CVE-2025-60706 [MEDIUM] CWE-125 CVE-2025-60706: Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.

CVE-2025-59509 [MEDIUM] CWE-201 CVE-2025-59509: Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.

CVE-2025-59513 [MEDIUM] CWE-125 CVE-2025-59513: Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to discl Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally.

CVE-2025-60723 [MEDIUM] CWE-362 CVE-2025-60723: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network.

CVE-2025-49708 [CRITICAL] CWE-416 CVE-2025-49708: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges o Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

CVE-2025-58730 [HIGH] CWE-416 CVE-2025-58730: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVE-2025-58725 [HIGH] CWE-122 CVE-2025-58725: Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locall Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.

CVE-2025-59261 [HIGH] CWE-367 CVE-2025-59261: Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authoriz Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CVE-2025-55326 [HIGH] CWE-416 CVE-2025-55326: Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to exe Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.

CVE-2025-55692 [HIGH] CWE-20 CVE-2025-55692: Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privil Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2025-59502 [HIGH] CWE-400 CVE-2025-59502: Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker t Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

CVE-2025-53150 [HIGH] CWE-362 CVE-2025-53150: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

CVE-2025-59202 [HIGH] CWE-416 CVE-2025-59202: Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privilege Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

CVE-2025-55701 [HIGH] CWE-1287 CVE-2025-55701: Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.