Microsoft Windows 11 Version 24H2 vulnerabilities

CVE-2024-43629 [HIGH] CWE-822 CVE-2024-43629: Windows DWM Core Library Elevation of Privilege Vulnerability Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2024-38141 [HIGH] CWE-416 CVE-2024-38141: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2024-38150 [HIGH] CWE-416 CVE-2024-38150: Windows DWM Core Library Elevation of Privilege Vulnerability Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2025-21420 [HIGH] CWE-59 CVE-2025-21420: Windows Disk Cleanup Tool Elevation of Privilege Vulnerability Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

CVE-2024-43560 [HIGH] CWE-122 CVE-2024-43560: Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability

CVE-2025-21292 [HIGH] CWE-94 CVE-2025-21292: Windows Search Service Elevation of Privilege Vulnerability Windows Search Service Elevation of Privilege Vulnerability

CVE-2026-62702 [HIGH] CWE-476 CVE-2026-62702: Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network.

CVE-2025-49687 [HIGH] CWE-125 CVE-2025-49687: Out-of-bounds read in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate p Out-of-bounds read in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

CVE-2025-27737 [HIGH] CWE-20 CVE-2025-27737: Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.

CVE-2025-26673 [HIGH] CWE-400 CVE-2025-26673: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

CVE-2025-27469 [HIGH] CWE-400 CVE-2025-27469: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

CVE-2025-33054 [HIGH] CWE-357 CVE-2025-33054: Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized atta Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-49691 [HIGH] CWE-122 CVE-2025-49691: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over an Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over an adjacent network.

CVE-2025-50168 [HIGH] CWE-122 CVE-2025-50168: Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an au Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

CVE-2026-20846 [HIGH] CWE-126 CVE-2026-20846: Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network. Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

CVE-2026-69733 [HIGH] CWE-426 CVE-2026-69733: Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

CVE-2026-69882 [HIGH] CWE-426 CVE-2026-69882: Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

CVE-2026-69923 [HIGH] CWE-427 CVE-2026-69923: Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges l Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.

CVE-2025-24995 [HIGH] CWE-122 CVE-2025-24995: Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacke Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-50173 [HIGH] CWE-1390 CVE-2025-50173: Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally.