Microsoft Windows 11 24H2 vulnerabilities

CVE-2026-73004 [MEDIUM] CWE-306 CVE-2026-73004: Missing authentication for critical function in Windows Autopilot allows an authorized attacker to p Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

CVE-2026-72964 [MEDIUM] CWE-306 CVE-2026-72964: Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

CVE-2026-69321 [MEDIUM] CWE-306 CVE-2026-69321: Missing authentication for critical function in Windows Power Dependency Coordinator allows an autho Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

CVE-2026-69674 [MEDIUM] CWE-306 CVE-2026-69674: Missing authentication for critical function in Windows Modern Device Management (MDM) allows an aut Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.

CVE-2026-83991 [MEDIUM] CWE-306 CVE-2026-83991: Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an aut Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

CVE-2024-43534 [MEDIUM] CWE-125 CVE-2024-43534: Windows Graphics Component Information Disclosure Vulnerability Windows Graphics Component Information Disclosure Vulnerability

CVE-2025-48804 [MEDIUM] CWE-349 CVE-2025-48804: Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorize Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-48003 [MEDIUM] CWE-693 CVE-2025-48003: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a securi Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-48001 [MEDIUM] CWE-367 CVE-2025-48001: Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attack Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-78451 [MEDIUM] CWE-822 CVE-2026-78451: Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized att Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-69490 [MEDIUM] CWE-125 CVE-2026-69490: Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthorized attacker to eleva Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-62699 [MEDIUM] CWE-122 CVE-2026-62699: Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an author Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

CVE-2026-83671 [MEDIUM] CWE-125 CVE-2026-83671: Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.

CVE-2026-55000 [MEDIUM] CWE-416 CVE-2026-55000: Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges wit Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-20821 [MEDIUM] CWE-200 CVE-2026-20821: Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows a Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.

CVE-2025-27471 [MEDIUM] CWE-591 CVE-2025-27471: Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthor Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network.

CVE-2026-58543 [MEDIUM] CWE-362 CVE-2026-58543: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack.

CVE-2026-83500 [MEDIUM] CWE-601 CVE-2026-83500: Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized atta Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-69569 [MEDIUM] CWE-822 CVE-2026-69569: Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to d Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network.

CVE-2026-85816 [MEDIUM] CWE-125 CVE-2026-85816: Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information ove Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information over an adjacent network.