Microsoft Windows 11 Version 25H2 vulnerabilities

CVE-2026-96307 [HIGH] CWE-416 CVE-2026-96307: Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-83649 [MEDIUM] CWE-125 CVE-2026-83649: Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorize Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

CVE-2026-83667 [MEDIUM] CWE-125 CVE-2026-83667: Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.

CVE-2026-83648 [MEDIUM] CWE-476 CVE-2026-83648: Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

CVE-2026-69374 [MEDIUM] CWE-770 CVE-2026-69374: Allocation of resources without limits or throttling in Windows SMB Server allows an authorized atta Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network.

CVE-2026-83521 [MEDIUM] CWE-125 CVE-2026-83521: Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information ov Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.

CVE-2026-56186 [MEDIUM] CWE-125 CVE-2026-56186: Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network.

CVE-2025-64670 [MEDIUM] CWE-200 CVE-2025-64670: Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network.

CVE-2026-85821 [MEDIUM] CWE-125 CVE-2026-85821: Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized a Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

CVE-2026-50432 [MEDIUM] CWE-416 CVE-2026-50432: Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny ser Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny service over a network.

CVE-2026-65794 [MEDIUM] CWE-126 CVE-2026-65794: Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-96938 [MEDIUM] CWE-122 CVE-2026-96938: Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-85337 [MEDIUM] CWE-125 CVE-2026-85337: Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-69350 [MEDIUM] CWE-122 CVE-2026-69350: Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privil Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

CVE-2026-42907 [MEDIUM] CWE-200 CVE-2026-42907: Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized att Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.

CVE-2026-85805 [MEDIUM] CWE-358 CVE-2026-85805: Improperly implemented security check for standard in Windows PowerShell allows an unauthorized atta Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-40413 [HIGH] CWE-476 CVE-2026-40413: Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an a Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.

CVE-2026-45585 [MEDIUM] CWE-77 CVE-2026-45585: Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as &qu Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until th

CVE-2026-41097 [MEDIUM] CWE-1329 CVE-2026-41097: Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2025-59214 [MEDIUM] CWE-200 CVE-2025-59214: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauth Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.