Microsoft Windows 11 24H2 vulnerabilities

CVE-2026-62708 [MEDIUM] CWE-416 CVE-2026-62708: Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physic Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-70582 [MEDIUM] CWE-362 CVE-2026-70582: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

CVE-2026-40380 [MEDIUM] CWE-122 CVE-2026-40380: Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execu Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

CVE-2026-32072 [MEDIUM] CWE-287 CVE-2026-32072: Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoof Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.

CVE-2026-50418 [MEDIUM] CWE-284 CVE-2026-50418: Improper access control in Windows System allows an unauthorized attacker to bypass a security featu Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.

CVE-2025-48823 [MEDIUM] CWE-310 CVE-2025-48823: Cryptographic issues in Windows Cryptographic Services allows an unauthorized attacker to disclose i Cryptographic issues in Windows Cryptographic Services allows an unauthorized attacker to disclose information over a network.

CVE-2026-68874 [MEDIUM] CWE-125 CVE-2026-68874: Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network.

CVE-2026-69591 [MEDIUM] CWE-125 CVE-2026-69591: Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a netw Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network.

CVE-2026-69572 [MEDIUM] CWE-125 CVE-2026-69572: Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network.

CVE-2026-69393 [MEDIUM] CWE-125 CVE-2026-69393: Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information ov Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network.

CVE-2026-96858 [MEDIUM] CWE-306 CVE-2026-96858: Missing authentication for critical function in Windows Security Account Manager allows an authorize Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.

CVE-2026-85831 [MEDIUM] CWE-122 CVE-2026-85831: Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose in Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally.

CVE-2025-21313 [MEDIUM] CWE-833 CVE-2025-21313: Windows Security Account Manager (SAM) Denial of Service Vulnerability Windows Security Account Manager (SAM) Denial of Service Vulnerability

CVE-2025-26637 [MEDIUM] CWE-693 CVE-2025-26637: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a securi Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-48800 [MEDIUM] CWE-693 CVE-2025-48800: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a securi Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-48818 [MEDIUM] CWE-367 CVE-2025-48818: Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attack Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-102188 [MEDIUM] CWE-822 CVE-2026-102188: Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elev Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-72999 [MEDIUM] CWE-125 CVE-2026-72999: Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges w Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-50299 [MEDIUM] CWE-122 CVE-2026-50299: Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to e Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.

CVE-2026-45658 [MEDIUM] CWE-284 CVE-2026-45658: Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feat Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally.