Microsoft Windows 11 25H2 vulnerabilities

CVE-2026-85812 [MEDIUM] CWE-552 CVE-2026-85812: Files or directories accessible to external parties in Windows Bind Filter Driver allows an authoriz Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.

CVE-2026-68886 [MEDIUM] CWE-209 CVE-2026-68886: Use after free in Windows Network Connection Broker allows an authorized attacker to disclose inform Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.

CVE-2026-85910 [MEDIUM] CWE-126 CVE-2026-85910: Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose informatio Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.

CVE-2026-70137 [MEDIUM] CWE-306 CVE-2026-70137: Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally.

CVE-2026-69554 [MEDIUM] CWE-306 CVE-2026-69554: Missing authentication for critical function in Microsoft Windows Search Component allows an authori Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

CVE-2026-42914 [MEDIUM] CWE-125 CVE-2026-42914: Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.

CVE-2026-45595 [MEDIUM] CWE-693 CVE-2026-45595: Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to by Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-45608 [MEDIUM] CWE-125 CVE-2026-45608: Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information lo Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally.

CVE-2026-69469 [MEDIUM] CWE-122 CVE-2026-69469: Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an unauthoriz Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-20851 [MEDIUM] CWE-125 CVE-2026-20851: Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.

CVE-2026-49807 [MEDIUM] CWE-200 CVE-2026-49807: Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

CVE-2026-50294 [MEDIUM] CWE-497 CVE-2026-50294: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.

CVE-2026-50485 [MEDIUM] CWE-126 CVE-2026-50485: Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent n Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.

CVE-2026-83907 [MEDIUM] CWE-497 CVE-2026-83907: Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows a Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.

CVE-2026-69644 [MEDIUM] CWE-497 CVE-2026-69644: Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows a Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.

CVE-2026-20824 [MEDIUM] CWE-693 CVE-2026-20824: Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-32088 [MEDIUM] CWE-362 CVE-2026-32088: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-72980 [MEDIUM] CWE-427 CVE-2026-72980: Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.

CVE-2026-68831 [MEDIUM] CWE-552 CVE-2026-68831: Files or directories accessible to external parties in Windows Defender Firewall Service allows an a Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.

CVE-2026-62687 [MEDIUM] CWE-59 CVE-2026-62687: Improper link resolution before file access ('link following') in Windows Backup Engine allows an au Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.