Microsoft Windows 11 24H2 vulnerabilities

CVE-2024-43523 [MEDIUM] CWE-20 CVE-2024-43523: Windows Mobile Broadband Driver Remote Code Execution Vulnerability Windows Mobile Broadband Driver Remote Code Execution Vulnerability

CVE-2024-43524 [MEDIUM] CWE-118 CVE-2024-43524: Windows Mobile Broadband Driver Remote Code Execution Vulnerability Windows Mobile Broadband Driver Remote Code Execution Vulnerability

CVE-2024-43543 [MEDIUM] CWE-601 CVE-2024-43543: Windows Mobile Broadband Driver Remote Code Execution Vulnerability Windows Mobile Broadband Driver Remote Code Execution Vulnerability

CVE-2024-43536 [MEDIUM] CWE-601 CVE-2024-43536: Windows Mobile Broadband Driver Remote Code Execution Vulnerability Windows Mobile Broadband Driver Remote Code Execution Vulnerability

CVE-2026-57097 [MEDIUM] CWE-426 CVE-2026-57097: Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-77892 [MEDIUM] CWE-693 CVE-2026-77892: No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-50298 [MEDIUM] CWE-190 CVE-2026-50298: Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate p Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2025-54104 [MEDIUM] CWE-843 CVE-2025-54104: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

CVE-2026-62881 [MEDIUM] CWE-122 CVE-2026-62881: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-62769 [MEDIUM] CWE-122 CVE-2026-62769: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-65798 [MEDIUM] CWE-197 CVE-2026-65798: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-62883 [MEDIUM] CWE-122 CVE-2026-62883: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-65797 [MEDIUM] CWE-122 CVE-2026-65797: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-32170 [MEDIUM] CWE-415 CVE-2026-32170: Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

CVE-2026-21530 [MEDIUM] CWE-415 CVE-2026-21530: Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

CVE-2025-48811 [MEDIUM] CWE-353 CVE-2025-48811: Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

CVE-2025-48803 [MEDIUM] CWE-353 CVE-2025-48803: Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

CVE-2026-69781 [MEDIUM] CWE-401 CVE-2026-69781: Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized att Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.

CVE-2026-70122 [MEDIUM] CWE-367 CVE-2026-70122: Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an au Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

CVE-2026-105006 [MEDIUM] CWE-416 CVE-2026-105006: Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a phys Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.