Microsoft Windows Server 2012 vulnerabilities
5,228 known vulnerabilities affecting microsoft/windows_server_2012.
Total CVEs
5,228
CISA KEV
153
actively exploited
Public exploits
333
Exploited in wild
212
Severity breakdown
CRITICAL254HIGH3502MEDIUM1417LOW55
Vulnerabilities
Page 195 of 262
CVE-2026-83750P3HIGHCVSS 7.0vr2≥ 6.2.9200.0, < 6.2.9200.264342026-10-13
CVE-2026-83750 [HIGH] CWE-122 CVE-2026-83750: Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized at
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-47648P3HIGHCVSS 7.0vr2≥ 6.2.9200.0, < 6.2.9200.261322026-06-09
CVE-2026-47648 [HIGH] CWE-426 CVE-2026-47648: Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-69859P4HIGHCVSS 7.0vr2≥ 6.2.9200.0, < 6.2.9200.263492026-09-08
CVE-2026-69859 [HIGH] CWE-191 CVE-2026-69859: Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) a
Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-88098P3HIGHCVSS 7.0vr2≥ 6.2.9200.0, < 6.2.9200.264342026-10-13
CVE-2026-88098 [HIGH] CWE-822 CVE-2026-88098: Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized at
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-29958P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29958 [MEDIUM] CWE-908 CVE-2025-29958: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29961P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29961 [MEDIUM] CWE-125 CVE-2025-29961: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-27929P3HIGHCVSS 7.0vr2≥ 6.2.9200.0, < 6.2.9200.260262026-04-14
CVE-2026-27929 [HIGH] CWE-367 CVE-2026-27929: Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to
Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-85920P3HIGHCVSS 7.0vr2≥ 6.2.9200.0, < 6.2.9200.264342026-10-13
CVE-2026-85920 [HIGH] CWE-367 CVE-2026-85920: Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker
Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-29836P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29836 [MEDIUM] CWE-125 CVE-2025-29836: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-88160P4HIGHCVSS 7.0vr22026-10-13
CVE-2026-88160 [HIGH] CWE-362 CVE-2026-88160: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-29830P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29830 [MEDIUM] CWE-908 CVE-2025-29830: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29832P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29832 [MEDIUM] CWE-125 CVE-2025-29832: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29835P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.254752025-05-13
CVE-2025-29835 [MEDIUM] CWE-125 CVE-2025-29835: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2020-15707P4MEDIUMCVSS 6.4vr22020-07-29
CVE-2020-15707 [MEDIUM] CWE-362 CVE-2020-15707: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efili
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command
nvd
CVE-2025-55225P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-55225 [MEDIUM] CWE-125 CVE-2025-55225: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-49681P4MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.255732025-07-08
CVE-2025-49681 [MEDIUM] CWE-125 CVE-2025-49681: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-54097P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54097 [MEDIUM] CWE-125 CVE-2025-54097: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-54096P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54096 [MEDIUM] CWE-125 CVE-2025-54096: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-54095P3MEDIUMCVSS 6.5vr2≥ 6.2.9200.0, < 6.2.9200.256752025-09-09
CVE-2025-54095 [MEDIUM] CWE-125 CVE-2025-54095: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2023-35308P3MEDIUMCVSS 6.5vr22023-07-11
CVE-2023-35308 [MEDIUM] CWE-73 CVE-2023-35308: Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
nvd