Microsoft Windows 11 Version 23H2 vulnerabilities

CVE-2026-85861 [HIGH] CWE-416 CVE-2026-85861: Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

CVE-2026-72929 [HIGH] CWE-354 CVE-2026-72929: Improper validation of integrity check value in Windows Installer allows an authorized attacker to e Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-26170 [HIGH] CWE-20 CVE-2026-26170: Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privilege Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

CVE-2026-27910 [HIGH] CWE-280 CVE-2026-27910: Improper handling of insufficient permissions or privileges in Windows Installer allows an authorize Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-32165 [HIGH] CWE-362 CVE-2026-32165: Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges lo Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2026-32164 [HIGH] CWE-362 CVE-2026-32164: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2026-32163 [HIGH] CWE-362 CVE-2026-32163: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2026-26172 [HIGH] CWE-362 CVE-2026-26172: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CVE-2026-27911 [HIGH] CWE-362 CVE-2026-27911: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2024-30092 [HIGH] CWE-20 CVE-2024-30092: Windows Hyper-V Remote Code Execution Vulnerability Windows Hyper-V Remote Code Execution Vulnerability

CVE-2026-73017 [HIGH] CWE-122 CVE-2026-73017: Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally.

CVE-2026-20844 [HIGH] CWE-362 CVE-2026-20844: Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges loc Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally.

CVE-2026-97813 [MEDIUM] CWE-122 CVE-2026-97813: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network.

CVE-2024-21417 [HIGH] CWE-862 CVE-2024-21417: Windows Text Services Framework Elevation of Privilege Vulnerability Windows Text Services Framework Elevation of Privilege Vulnerability

CVE-2026-50507 [MEDIUM] CWE-306 CVE-2026-50507: Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-24052 [HIGH] CWE-121 CVE-2025-24052: Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Window

CVE-2024-38127 [HIGH] CWE-126 CVE-2024-38127: Windows Hyper-V Elevation of Privilege Vulnerability Windows Hyper-V Elevation of Privilege Vulnerability

CVE-2026-69846 [HIGH] CWE-190 CVE-2026-69846: Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevat Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

CVE-2026-48573 [HIGH] CWE-1329 CVE-2026-48573: No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feat No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-48576 [HIGH] CWE-1329 CVE-2026-48576: No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feat No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.