Microsoft Windows Server 2012 vulnerabilities

CVE-2016-0091 [HIGH] CWE-20 CVE-2016-0091: OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0092.

CVE-2024-20678 [HIGH] CWE-843 CVE-2024-20678: Remote Procedure Call Runtime Remote Code Execution Vulnerability Remote Procedure Call Runtime Remote Code Execution Vulnerability

CVE-2022-29137 [HIGH] CVE-2022-29137: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

CVE-2022-22014 [HIGH] CVE-2022-22014: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

CVE-2022-22013 [HIGH] CVE-2022-22013: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

CVE-2026-20840 [HIGH] CWE-122 CVE-2026-20840: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

CVE-2023-36423 [HIGH] CWE-122 CVE-2023-36423: Microsoft Remote Registry Service Remote Code Execution Vulnerability Microsoft Remote Registry Service Remote Code Execution Vulnerability

CVE-2025-24051 [HIGH] CWE-122 CVE-2025-24051: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVE-2023-35641 [HIGH] CWE-682 CVE-2023-35641: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

CVE-2026-83784 [HIGH] CWE-36 CVE-2026-83784: Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to ele Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

CVE-2025-64678 [HIGH] CWE-122 CVE-2025-64678: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVE-2026-70089 [HIGH] CWE-122 CVE-2026-70089: Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a net Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.

CVE-2026-77496 [HIGH] CWE-122 CVE-2026-77496: Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute c Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

CVE-2026-70258 [HIGH] CWE-122 CVE-2026-70258: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

CVE-2026-100220 [HIGH] CWE-122 CVE-2026-100220: Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.

CVE-2026-83642 [HIGH] CWE-843 CVE-2026-83642: Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized a Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.

CVE-2026-80096 [HIGH] CWE-125 CVE-2026-80096: Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privi Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.

CVE-2026-83778 [HIGH] CWE-122 CVE-2026-83778: Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to ex Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.

CVE-2019-1166 [MEDIUM] CWE-354 CVE-2019-1166: A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to s A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'.

CVE-2026-102203 [HIGH] CWE-843 CVE-2026-102203: Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.