Microsoft Windows 11 Version 24H2 vulnerabilities

CVE-2026-103577 [HIGH] CWE-453 CVE-2026-103577: Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-42992 [HIGH] CWE-122 CVE-2026-42992: Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-44799 [HIGH] CWE-122 CVE-2026-44799: Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-42993 [HIGH] CWE-122 CVE-2026-42993: Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-32161 [HIGH] CWE-362 CVE-2026-32161: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-87713 [HIGH] CWE-416 CVE-2026-87713: Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privilege Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.

CVE-2024-43630 [HIGH] CWE-121 CVE-2024-43630: Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-49093 [HIGH] CWE-681 CVE-2024-49093: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

CVE-2025-55694 [HIGH] CWE-284 CVE-2025-55694: Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileg Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2025-58715 [HIGH] CWE-190 CVE-2025-58715: Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

CVE-2025-21299 [HIGH] CWE-922 CVE-2025-21299: Windows Kerberos Security Feature Bypass Vulnerability Windows Kerberos Security Feature Bypass Vulnerability

CVE-2025-24084 [HIGH] CWE-822 CVE-2025-24084: Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to exec Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.

CVE-2026-69906 [HIGH] CWE-122 CVE-2026-69906: Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate pr Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

CVE-2026-72962 [HIGH] CWE-122 CVE-2026-72962: Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate priv Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-69365 [HIGH] CWE-125 CVE-2026-69365: Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attack Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network.

CVE-2025-47972 [HIGH] CWE-362 CVE-2025-47972: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges over a network.

CVE-2026-96844 [HIGH] CWE-191 CVE-2026-96844: Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker t Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.

CVE-2025-32713 [HIGH] CWE-122 CVE-2025-32713: Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-25181 [HIGH] CWE-125 CVE-2026-25181: Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a ne Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network.

CVE-2025-26666 [HIGH] CWE-122 CVE-2025-26666: Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.