Microsoft Windows 11 25H2 vulnerabilities

CVE-2026-32181 [MEDIUM] CWE-269 CVE-2026-32181: Improper privilege management in Microsoft Windows allows an authorized attacker to deny service loc Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.

CVE-2026-72931 [MEDIUM] CWE-772 CVE-2026-72931: Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SS Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

CVE-2026-20834 [MEDIUM] CWE-36 CVE-2026-20834: Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.

CVE-2026-83582 [MEDIUM] CWE-416 CVE-2026-83582: Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information loca Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

CVE-2026-68849 [MEDIUM] CWE-125 CVE-2026-68849: Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose inform Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally.

CVE-2026-83865 [MEDIUM] CWE-23 CVE-2026-83865: Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform t Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.

CVE-2026-69425 [MEDIUM] CWE-59 CVE-2026-69425: Improper link resolution before file access ('link following') in Windows NTFS allows an authorized Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally.

CVE-2026-70195 [MEDIUM] CWE-362 CVE-2026-70195: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to dis Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

CVE-2026-69548 [MEDIUM] CWE-122 CVE-2026-69548: Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.

CVE-2026-69792 [MEDIUM] CWE-362 CVE-2026-69792: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to bypass a security feature locally.

CVE-2026-70116 [MEDIUM] CWE-121 CVE-2026-70116: Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-25168 [MEDIUM] CWE-476 CVE-2026-25168: Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny ser Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

CVE-2026-69978 [MEDIUM] CWE-476 CVE-2026-69978: Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally. Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally.

CVE-2025-59253 [MEDIUM] CWE-284 CVE-2025-59253: Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

CVE-2026-34339 [MEDIUM] CWE-476 CVE-2026-34339: Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorize Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.

CVE-2026-83786 [MEDIUM] CWE-209 CVE-2026-83786: Generation of error message containing sensitive information in Windows NTFS allows an authorized at Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.

CVE-2025-55333 [MEDIUM] CWE-1023 CVE-2025-55333: Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to b Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-69969 [MEDIUM] CWE-59 CVE-2026-69969: Improper link resolution before file access ('link following') in Windows AppX Deployment Service al Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.

CVE-2026-69832 [MEDIUM] CWE-497 CVE-2026-69832: Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

CVE-2026-102186 [MEDIUM] CWE-822 CVE-2026-102186: Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclo Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.