Microsoft Windows 11 Version 25H2 vulnerabilities

CVE-2026-69288 [MEDIUM] CWE-908 CVE-2026-69288: Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.

CVE-2026-69376 [MEDIUM] CWE-125 CVE-2026-69376: Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information l Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

CVE-2026-72937 [MEDIUM] CWE-125 CVE-2026-72937: Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information loca Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally.

CVE-2026-69618 [MEDIUM] CWE-125 CVE-2026-69618: Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information local Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information locally.

CVE-2026-59136 [MEDIUM] CWE-908 CVE-2026-59136: Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

CVE-2026-62730 [MEDIUM] CWE-126 CVE-2026-62730: Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose infor Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally.

CVE-2026-62798 [MEDIUM] CWE-822 CVE-2026-62798: Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose informatio Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally.

CVE-2026-62709 [MEDIUM] CWE-908 CVE-2026-62709: Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.

CVE-2026-61360 [MEDIUM] CWE-822 CVE-2026-61360: Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information l Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally.

CVE-2026-49801 [MEDIUM] CWE-908 CVE-2026-49801: Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information l Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

CVE-2026-50690 [MEDIUM] CWE-908 CVE-2026-50690: Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information l Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

CVE-2026-40422 [MEDIUM] CWE-908 CVE-2026-40422: Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose inf Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-50401 [MEDIUM] CWE-125 CVE-2026-50401: Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclo Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

CVE-2026-50455 [MEDIUM] CWE-908 CVE-2026-50455: Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

CVE-2026-54997 [MEDIUM] CWE-908 CVE-2026-54997: Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information l Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

CVE-2026-50300 [MEDIUM] CWE-125 CVE-2026-50300: Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose i Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.

CVE-2026-45594 [MEDIUM] CWE-200 CVE-2026-45594: Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) S Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.

CVE-2026-42969 [MEDIUM] CWE-908 CVE-2026-42969: Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclos Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.

CVE-2026-85815 [MEDIUM] CWE-125 CVE-2026-85815: Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose i Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.

CVE-2026-96859 [MEDIUM] CWE-125 CVE-2026-96859: Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose informatio Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.