Microsoft Windows 11 24H2 vulnerabilities

CVE-2024-43546 [MEDIUM] CWE-203 CVE-2024-43546: Windows Cryptographic Information Disclosure Vulnerability Windows Cryptographic Information Disclosure Vulnerability

CVE-2025-21257 [MEDIUM] CWE-125 CVE-2025-21257: Windows WLAN AutoConfig Service Information Disclosure Vulnerability Windows WLAN AutoConfig Service Information Disclosure Vulnerability

CVE-2024-43500 [MEDIUM] CWE-126 CVE-2024-43500: Windows Resilient File System (ReFS) Information Disclosure Vulnerability Windows Resilient File System (ReFS) Information Disclosure Vulnerability

CVE-2025-21374 [MEDIUM] CWE-125 CVE-2025-21374: Windows CSC Service Information Disclosure Vulnerability Windows CSC Service Information Disclosure Vulnerability

CVE-2026-45606 [MEDIUM] CWE-125 CVE-2026-45606: Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny service locally.

CVE-2026-83909 [MEDIUM] CWE-497 CVE-2026-83909: Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel S Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVE-2026-69483 [MEDIUM] CWE-125 CVE-2026-69483: Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to disclose informatio Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to disclose information locally.

CVE-2026-69895 [MEDIUM] CWE-125 CVE-2026-69895: Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information lo Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally.

CVE-2026-83788 [MEDIUM] CWE-126 CVE-2026-83788: Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a phy Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.

CVE-2026-84009 [MEDIUM] CWE-367 CVE-2026-84009: Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authori Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.

CVE-2026-20825 [MEDIUM] CWE-284 CVE-2026-20825: Improper access control in Windows Hyper-V allows an authorized attacker to disclose information loc Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally.

CVE-2026-27906 [MEDIUM] CWE-20 CVE-2026-27906: Improper input validation in Windows Hello allows an authorized attacker to bypass a security featur Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

CVE-2026-102221 [MEDIUM] CWE-299 CVE-2026-102221: No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feat No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-69713 [MEDIUM] CWE-1395 CVE-2026-69713: Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-70075 [MEDIUM] CWE-367 CVE-2026-70075: Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enc Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2026-32220 [MEDIUM] CWE-284 CVE-2026-32220: Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2026-32209 [MEDIUM] CWE-284 CVE-2026-32209: Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.

CVE-2024-43555 [MEDIUM] CWE-125 CVE-2024-43555: Windows Mobile Broadband Driver Denial of Service Vulnerability Windows Mobile Broadband Driver Denial of Service Vulnerability

CVE-2024-43561 [MEDIUM] CWE-20 CVE-2024-43561: Windows Mobile Broadband Driver Denial of Service Vulnerability Windows Mobile Broadband Driver Denial of Service Vulnerability

CVE-2024-43558 [MEDIUM] CWE-20 CVE-2024-43558: Windows Mobile Broadband Driver Denial of Service Vulnerability Windows Mobile Broadband Driver Denial of Service Vulnerability