Microsoft Windows 11 24H2 vulnerabilities

CVE-2026-70063 [MEDIUM] CWE-125 CVE-2026-70063: Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.

CVE-2026-69506 [MEDIUM] CWE-125 CVE-2026-69506: Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose informa Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

CVE-2026-85866 [MEDIUM] CWE-497 CVE-2026-85866: Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.

CVE-2026-69974 [MEDIUM] CWE-125 CVE-2026-69974: Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information l Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.

CVE-2026-68891 [MEDIUM] CWE-125 CVE-2026-68891: Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information l Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

CVE-2026-69853 [MEDIUM] CWE-908 CVE-2026-69853: Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose informatio Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

CVE-2026-83504 [MEDIUM] CWE-367 CVE-2026-83504: Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attack Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.

CVE-2026-96853 [MEDIUM] CWE-367 CVE-2026-96853: Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an author Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVE-2026-50661 [MEDIUM] CWE-693 CVE-2026-50661: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a securi Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-83697 [MEDIUM] CWE-367 CVE-2026-83697: Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows a Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

CVE-2026-26175 [MEDIUM] CWE-908 CVE-2026-26175: Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a se Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-54107 [MEDIUM] CWE-41 CVE-2025-54107: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to b Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

CVE-2025-54917 [MEDIUM] CWE-693 CVE-2025-54917: Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a sec Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-83926 [MEDIUM] CWE-295 CVE-2026-83926: Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

CVE-2025-21254 [MEDIUM] CWE-125 CVE-2025-21254: Internet Connection Sharing (ICS) Denial of Service Vulnerability Internet Connection Sharing (ICS) Denial of Service Vulnerability

CVE-2025-21352 [MEDIUM] CWE-400 CVE-2025-21352: Internet Connection Sharing (ICS) Denial of Service Vulnerability Internet Connection Sharing (ICS) Denial of Service Vulnerability

CVE-2025-21212 [MEDIUM] CWE-125 CVE-2025-21212: Internet Connection Sharing (ICS) Denial of Service Vulnerability Internet Connection Sharing (ICS) Denial of Service Vulnerability

CVE-2025-21216 [MEDIUM] CWE-125 CVE-2025-21216: Internet Connection Sharing (ICS) Denial of Service Vulnerability Internet Connection Sharing (ICS) Denial of Service Vulnerability

CVE-2026-83766 [MEDIUM] CWE-863 CVE-2026-83766: Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security featur Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network.

CVE-2025-21336 [MEDIUM] CWE-203 CVE-2025-21336: Windows Cryptographic Information Disclosure Vulnerability Windows Cryptographic Information Disclosure Vulnerability