Microsoft Windows 11 24H2 vulnerabilities

CVE-2026-20928 [MEDIUM] CWE-212 CVE-2026-20928: Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-59198 [MEDIUM] CWE-20 CVE-2025-59198: Improper input validation in Microsoft Windows Search Component allows an authorized attacker to den Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

CVE-2024-38143 [MEDIUM] CWE-306 CVE-2024-38143: Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability

CVE-2026-20828 [MEDIUM] CWE-125 CVE-2026-20828: Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to d Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack.

CVE-2025-59294 [MEDIUM] CWE-200 CVE-2025-59294: Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unautho Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack.

CVE-2026-58528 [MEDIUM] CWE-125 CVE-2026-58528: Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

CVE-2026-50453 [MEDIUM] CWE-125 CVE-2026-50453: Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

CVE-2026-49794 [MEDIUM] CWE-125 CVE-2026-49794: Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

CVE-2025-21278 [MEDIUM] CWE-362 CVE-2025-21278: Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability

CVE-2025-21274 [MEDIUM] CWE-59 CVE-2025-21274: Windows Event Tracing Denial of Service Vulnerability Windows Event Tracing Denial of Service Vulnerability

CVE-2025-21284 [MEDIUM] CWE-20 CVE-2025-21284: Windows Virtual Trusted Platform Module Denial of Service Vulnerability Windows Virtual Trusted Platform Module Denial of Service Vulnerability

CVE-2025-21280 [MEDIUM] CWE-20 CVE-2025-21280: Windows Virtual Trusted Platform Module Denial of Service Vulnerability Windows Virtual Trusted Platform Module Denial of Service Vulnerability

CVE-2025-47969 [MEDIUM] CWE-200 CVE-2025-47969: Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized att Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally.

CVE-2026-20936 [MEDIUM] CWE-125 CVE-2026-20936: Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a phys Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.

CVE-2025-49760 [LOW] CWE-73 CVE-2025-49760: External control of file name or path in Windows Storage allows an authorized attacker to perform sp External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.

CVE-2024-49098 [MEDIUM] CWE-125 CVE-2024-49098: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

CVE-2024-49099 [MEDIUM] CWE-125 CVE-2024-49099: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

CVE-2024-49103 [MEDIUM] CWE-125 CVE-2024-49103: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

CVE-2024-38123 [MEDIUM] CWE-125 CVE-2024-38123: Windows Bluetooth Driver Information Disclosure Vulnerability Windows Bluetooth Driver Information Disclosure Vulnerability

CVE-2025-24055 [MEDIUM] CWE-125 CVE-2025-24055: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.