Microsoft Windows 11 24H2 vulnerabilities

CVE-2026-23670 [MEDIUM] CWE-822 CVE-2026-23670: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an autho Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2026-35423 [MEDIUM] CWE-125 CVE-2026-35423: Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a n Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-45595 [MEDIUM] CWE-693 CVE-2026-45595: Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to by Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.

CVE-2024-49101 [MEDIUM] CWE-125 CVE-2024-49101: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

CVE-2024-49109 [MEDIUM] CWE-125 CVE-2024-49109: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

CVE-2026-45608 [MEDIUM] CWE-125 CVE-2026-45608: Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information lo Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally.

CVE-2024-49081 [MEDIUM] CWE-122 CVE-2024-49081: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

CVE-2024-49094 [MEDIUM] CWE-122 CVE-2024-49094: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

CVE-2024-49111 [MEDIUM] CWE-125 CVE-2024-49111: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

CVE-2026-20935 [MEDIUM] CWE-822 CVE-2026-20935: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unaut Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.

CVE-2026-49807 [MEDIUM] CWE-200 CVE-2026-49807: Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

CVE-2026-50294 [MEDIUM] CWE-497 CVE-2026-50294: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.

CVE-2025-27735 [MEDIUM] CWE-345 CVE-2025-27735: Insufficient verification of data authenticity in Windows Virtualization-Based Security (VBS) Enclav Insufficient verification of data authenticity in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2025-48002 [MEDIUM] CWE-125 CVE-2025-48002: Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose informat Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network.

CVE-2026-32088 [MEDIUM] CWE-362 CVE-2026-32088: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-50475 [MEDIUM] CWE-126 CVE-2026-50475: Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally. Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.

CVE-2026-20839 [MEDIUM] CWE-284 CVE-2026-20839: Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker t Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally.

CVE-2025-62570 [MEDIUM] CWE-284 CVE-2025-62570: Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disc Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.

CVE-2026-50341 [MEDIUM] CWE-126 CVE-2026-50341: Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

CVE-2026-42914 [MEDIUM] CWE-125 CVE-2026-42914: Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.