Microsoft Windows 11 Version 24H2 vulnerabilities

CVE-2025-59192 [HIGH] CWE-126 CVE-2025-59192: Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-59193 [HIGH] CWE-362 CVE-2025-59193: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CVE-2025-59210 [HIGH] CWE-416 CVE-2025-59210: Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability

CVE-2025-58728 [HIGH] CWE-416 CVE-2025-58728: Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges loca Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

CVE-2025-58722 [HIGH] CWE-122 CVE-2025-58722: Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locall Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally.

CVE-2025-58715 [HIGH] CWE-190 CVE-2025-58715: Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

CVE-2025-55335 [HIGH] CWE-362 CVE-2025-55335: Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally. Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

CVE-2025-59187 [HIGH] CWE-20 CVE-2025-59187: Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges loca Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-50152 [HIGH] CWE-125 CVE-2025-50152: Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-55689 [HIGH] CWE-416 CVE-2025-55689: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges l Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.

CVE-2025-59196 [HIGH] CWE-362 CVE-2025-59196: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

CVE-2025-58716 [HIGH] CWE-20 CVE-2025-58716: Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privi Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

CVE-2025-58734 [HIGH] CWE-416 CVE-2025-58734: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVE-2025-59241 [HIGH] CWE-59 CVE-2025-59241: Improper link resolution before file access ('link following') in Windows Health and Optimized Exper Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.

CVE-2025-59206 [HIGH] CWE-416 CVE-2025-59206: Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability

CVE-2025-55693 [HIGH] CWE-416 CVE-2025-55693: Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

CVE-2025-55331 [HIGH] CWE-416 CVE-2025-55331: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges l Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.

CVE-2025-59195 [HIGH] CWE-362 CVE-2025-59195: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to deny service locally.

CVE-2025-58727 [HIGH] CWE-362 CVE-2025-58727: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

CVE-2025-55698 [HIGH] CWE-476 CVE-2025-55698: Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a net Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network.