Microsoft Windows 11 25H2 vulnerabilities

CVE-2026-45604 [MEDIUM] CWE-125 CVE-2026-45604: Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker t Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.

CVE-2026-32079 [MEDIUM] CWE-200 CVE-2026-32079: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an author Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-34346 [MEDIUM] CWE-319 CVE-2026-34346: Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock all Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

CVE-2026-83798 [MEDIUM] CWE-20 CVE-2026-83798: Improper verification of cryptographic signature in Windows Update Stack allows an authorized attack Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.

CVE-2026-21249 [LOW] CWE-73 CVE-2026-21249: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spo External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally.

CVE-2026-83672 [MEDIUM] CWE-497 CVE-2026-83672: Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allo Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.

CVE-2025-60708 [MEDIUM] CWE-822 CVE-2025-60708: Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service lo Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.

CVE-2025-62463 [MEDIUM] CWE-476 CVE-2025-62463: Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally.

CVE-2025-62465 [MEDIUM] CWE-476 CVE-2025-62465: Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally.

CVE-2025-59284 [MEDIUM] CWE-200 CVE-2025-59284: Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized at Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.

CVE-2025-59211 [MEDIUM] CWE-200 CVE-2025-59211: Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.

CVE-2025-62209 [MEDIUM] CWE-532 CVE-2025-62209: Insertion of sensitive information into log file in Windows License Manager allows an authorized att Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

CVE-2025-62208 [MEDIUM] CWE-532 CVE-2025-62208: Insertion of sensitive information into log file in Windows License Manager allows an authorized att Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

CVE-2025-59510 [MEDIUM] CWE-59 CVE-2025-59510: Improper link resolution before file access ('link following') in Windows Routing and Remote Access Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.

CVE-2025-55699 [MEDIUM] CWE-200 CVE-2025-55699: Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized at Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

CVE-2025-59204 [MEDIUM] CWE-908 CVE-2025-59204: Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclo Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally.

CVE-2025-60706 [MEDIUM] CWE-125 CVE-2025-60706: Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.

CVE-2026-27931 [MEDIUM] CWE-125 CVE-2026-27931: Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

CVE-2026-69684 [MEDIUM] CWE-209 CVE-2026-69684: Generation of error message containing sensitive information in Windows Error Reporting allows an au Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.

CVE-2026-68873 [MEDIUM] CWE-532 CVE-2026-68873: Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.