Microsoft Windows Server 2012 vulnerabilities

CVE-2023-24861 [HIGH] CWE-367 CVE-2023-24861: Windows Graphics Component Elevation of Privilege Vulnerability Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2025-48804 [MEDIUM] CWE-349 CVE-2025-48804: Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorize Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-48001 [MEDIUM] CWE-367 CVE-2025-48001: Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attack Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-69490 [MEDIUM] CWE-125 CVE-2026-69490: Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthorized attacker to eleva Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-62699 [MEDIUM] CWE-122 CVE-2026-62699: Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an author Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

CVE-2020-15705 [MEDIUM] CWE-347 CVE-2020-15705: GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions

CVE-2026-20821 [MEDIUM] CWE-200 CVE-2026-20821: Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows a Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.

CVE-2025-27471 [MEDIUM] CWE-591 CVE-2025-27471: Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthor Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network.

CVE-2019-1470 [MEDIUM] CWE-20 CVE-2019-1470: An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.

CVE-2026-69569 [MEDIUM] CWE-822 CVE-2026-69569: Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to d Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network.

CVE-2023-36713 [MEDIUM] CWE-908 CVE-2023-36713: Windows Common Log File System Driver Information Disclosure Vulnerability Windows Common Log File System Driver Information Disclosure Vulnerability

CVE-2022-30154 [MEDIUM] CVE-2022-30154: Microsoft File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege Vulnerability Microsoft File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege Vulnerability

CVE-2025-27472 [MEDIUM] CWE-693 CVE-2025-27472: Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to by Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-69405 [MEDIUM] CWE-401 CVE-2026-69405: Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attac Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

CVE-2016-0090 [HIGH] CWE-200 CVE-2016-0090: Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to ob Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

CVE-2026-70055 [MEDIUM] CWE-497 CVE-2026-70055: Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

CVE-2026-70260 [MEDIUM] CWE-497 CVE-2026-70260: Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

CVE-2026-70261 [MEDIUM] CWE-497 CVE-2026-70261: Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

CVE-2026-83705 [MEDIUM] CWE-497 CVE-2026-83705: Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allow Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

CVE-2026-83835 [MEDIUM] CWE-126 CVE-2026-83835: Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.