Microsoft Windows 11 Version 24H2 vulnerabilities

CVE-2024-38240 [CRITICAL] CWE-125 CVE-2024-38240: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

CVE-2026-105010 [CRITICAL] CWE-416 CVE-2026-105010: Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate priv Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-49164 [CRITICAL] CWE-122 CVE-2026-49164: Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to ex Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

CVE-2026-50380 [CRITICAL] CWE-122 CVE-2026-50380: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a ne Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

CVE-2026-40369 [HIGH] CWE-822 CVE-2026-40369: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges loc Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-20840 [HIGH] CWE-122 CVE-2026-20840: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

CVE-2025-50171 [CRITICAL] CWE-862 CVE-2025-50171: Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing o Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-24051 [HIGH] CWE-122 CVE-2025-24051: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVE-2026-83784 [HIGH] CWE-36 CVE-2026-83784: Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to ele Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

CVE-2025-64678 [HIGH] CWE-122 CVE-2025-64678: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVE-2026-70089 [HIGH] CWE-122 CVE-2026-70089: Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a net Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.

CVE-2026-77496 [HIGH] CWE-122 CVE-2026-77496: Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute c Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

CVE-2026-83523 [HIGH] CWE-122 CVE-2026-83523: Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute c Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

CVE-2026-70258 [HIGH] CWE-122 CVE-2026-70258: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

CVE-2026-100220 [HIGH] CWE-122 CVE-2026-100220: Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.

CVE-2026-83642 [HIGH] CWE-843 CVE-2026-83642: Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized a Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.

CVE-2026-80096 [HIGH] CWE-125 CVE-2026-80096: Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privi Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.

CVE-2026-83778 [HIGH] CWE-122 CVE-2026-83778: Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to ex Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.

CVE-2026-96952 [HIGH] CWE-122 CVE-2026-96952: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

CVE-2026-102203 [HIGH] CWE-843 CVE-2026-102203: Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.