Microsoft Windows Server 2012 vulnerabilities
4,005 known vulnerabilities affecting microsoft/windows_server_2012.
Total CVEs
4,005
CISA KEV
150
actively exploited
Public exploits
332
Exploited in wild
207
Severity breakdown
CRITICAL178HIGH2668MEDIUM1104LOW55
Vulnerabilities
Page 149 of 201
CVE-2023-35332P4MEDIUMCVSS 6.8vr2≥ 6.2.9200.0, < 6.2.9200.243742023-07-11
CVE-2023-35332 [MEDIUM] CWE-326 CVE-2023-35332: Windows Remote Desktop Protocol Security Feature Bypass
Windows Remote Desktop Protocol Security Feature Bypass
nvd
CVE-2025-29830P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29830 [MEDIUM] CWE-908 CVE-2025-29830: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29832P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29832 [MEDIUM] CWE-125 CVE-2025-29832: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29835P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29835 [MEDIUM] CWE-125 CVE-2025-29835: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2024-37976P4MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.251182024-10-08
CVE-2024-37976 [MEDIUM] CWE-190 CVE-2024-37976: Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
nvd
CVE-2024-37983P4MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.251182024-10-08
CVE-2024-37983 [MEDIUM] CWE-822 CVE-2024-37983: Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
nvd
CVE-2025-49671P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.255732025-07-08
CVE-2025-49671 [MEDIUM] CWE-125 CVE-2025-49671: Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Serv
Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-54104P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54104 [MEDIUM] CWE-843 CVE-2025-54104: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-54915P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54915 [MEDIUM] CWE-843 CVE-2025-54915: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-54109P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54109 [MEDIUM] CWE-843 CVE-2025-54109: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-53808P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-53808 [MEDIUM] CWE-843 CVE-2025-53808: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-55226P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-55226 [MEDIUM] CWE-362 CVE-2025-55226: Concurrent execution using shared resource with improper synchronization ('race condition') in Graph
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally.
nvd
CVE-2025-53810P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-53810 [MEDIUM] CWE-843 CVE-2025-53810: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-54094P3MEDIUMCVSS 6.7vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54094 [MEDIUM] CWE-843 CVE-2025-54094: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service a
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2016-3251P4LOWCVSS 2.8vr22016-07-13
CVE-2016-3251 [LOW] CWE-200 CVE-2016-3251: The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2
The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application, aka "Win32k Information Disclosure Vulnerabi
nvd
CVE-2026-21265P4MEDIUMCVSS 6.4vr2≥ 6.2.9200.0, < 6.2.9200.258682026-01-13
CVE-2026-21265 [MEDIUM] CWE-1329 CVE-2026-21265: Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificate
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot.
The ope
nvd
CVE-2026-49804P3MEDIUMCVSS 6.6vr2≥ 6.2.9200.0, < 6.2.9200.262262026-07-14
CVE-2026-49804 [MEDIUM] CWE-122 CVE-2026-49804: Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate pr
Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack.
nvd
CVE-2020-1397P4MEDIUMCVSS 6.5vr22020-07-14
CVE-2020-1397 [MEDIUM] CVE-2020-1397: An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails t
An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory, aka 'Windows Imaging Component Information Disclosure Vulnerability'.
nvd
CVE-2020-0880P4MEDIUMCVSS 6.5vr22020-03-12
CVE-2020-0880 [MEDIUM] CVE-2020-0880: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0774, CVE-2020-0874, CVE-2020-0879, CVE-2020-0882.
nvd
CVE-2020-0882P4MEDIUMCVSS 6.5vr22020-03-12
CVE-2020-0882 [MEDIUM] CVE-2020-0882: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0774, CVE-2020-0874, CVE-2020-0879, CVE-2020-0880.
nvd