Microsoft Windows 11 Version 23H2 vulnerabilities
3,415 known vulnerabilities affecting microsoft/windows_11_version_23h2.
Total CVEs
3,415
CISA KEV
63
actively exploited
Public exploits
44
Exploited in wild
77
Severity breakdown
CRITICAL100HIGH2449MEDIUM858LOW8
Vulnerabilities
Page 107 of 171
CVE-2026-85846P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-85846 [HIGH] CWE-416 CVE-2026-85846: Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges lo
Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-96307P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-96307 [HIGH] CWE-416 CVE-2026-96307: Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-50166P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.57682025-08-12
CVE-2025-50166 [MEDIUM] CWE-190 CVE-2025-50166: Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized a
Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-83649P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-83649 [MEDIUM] CWE-125 CVE-2026-83649: Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorize
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83667P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-83667 [MEDIUM] CWE-125 CVE-2026-83667: Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83648P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-83648 [MEDIUM] CWE-476 CVE-2026-83648: Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
nvd
CVE-2026-69374P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.75822026-09-08
CVE-2026-69374 [MEDIUM] CWE-770 CVE-2026-69374: Allocation of resources without limits or throttling in Windows SMB Server allows an authorized atta
Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83521P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-83521 [MEDIUM] CWE-125 CVE-2026-83521: Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information ov
Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.
nvd
CVE-2025-64670P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.63452025-12-09
CVE-2025-64670 [MEDIUM] CWE-200 CVE-2025-64670: Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-85821P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-85821 [MEDIUM] CWE-125 CVE-2026-85821: Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized a
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
nvd
CVE-2026-65794P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.75172026-08-11
CVE-2026-65794 [MEDIUM] CWE-126 CVE-2026-65794: Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over
Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-96938P3MEDIUMCVSS 6.7≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-96938 [MEDIUM] CWE-122 CVE-2026-96938: Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-85337P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-85337 [MEDIUM] CWE-125 CVE-2026-85337: Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-69350P3MEDIUMCVSS 6.7≥ 10.0.22631.0, < 10.0.22631.75822026-09-08
CVE-2026-69350 [MEDIUM] CWE-122 CVE-2026-69350: Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privil
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-42907P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.72192026-06-09
CVE-2026-42907 [MEDIUM] CWE-200 CVE-2026-42907: Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized att
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-85805P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.76522026-10-13
CVE-2026-85805 [MEDIUM] CWE-358 CVE-2026-85805: Improperly implemented security check for standard in Windows PowerShell allows an unauthorized atta
Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2025-21181P3HIGHCVSS 7.5≥ 10.0.22631.0, < 10.0.22631.48902025-02-11
CVE-2025-21181 [HIGH] CWE-400 CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2024-49096P3HIGHCVSS 7.5≥ 10.0.22631.0, < 10.0.22631.46022024-12-12
CVE-2024-49096 [HIGH] CWE-400 CVE-2024-49096: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2024-49075P3HIGHCVSS 7.5≥ 10.0.22631.0, < 10.0.22631.46022024-12-12
CVE-2024-49075 [HIGH] CWE-400 CVE-2024-49075: Windows Remote Desktop Services Denial of Service Vulnerability
Windows Remote Desktop Services Denial of Service Vulnerability
nvd
CVE-2025-21300P3HIGHCVSS 7.5≥ 10.0.22631.0, < 10.0.22631.47512025-01-14
CVE-2025-21300 [HIGH] CWE-400 CVE-2025-21300: Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability
Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability
nvd