Microsoft Windows Server 2012 R2 vulnerabilities
2,562 known vulnerabilities affecting microsoft/windows_server_2012_r2.
Total CVEs
2,562
CISA KEV
96
actively exploited
Public exploits
62
Exploited in wild
82
Severity breakdown
CRITICAL86HIGH1814MEDIUM653LOW9
Vulnerabilities
Page 23 of 129
CVE-2025-27468HIGHCVSS 7.0≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-27468 [HIGH] CWE-269 CVE-2025-27468: Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate
Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-32706HIGHCVSS 7.8KEV≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-32706 [HIGH] CWE-20 CVE-2025-32706: Improper input validation in Windows Common Log File System Driver allows an authorized attacker to
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-29966HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29966 [HIGH] CWE-122 CVE-2025-29966: Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-24063HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-24063 [HIGH] CWE-122 CVE-2025-24063: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges loc
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-30397HIGHCVSS 7.5KEVPoC≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-30397 [HIGH] CWE-843 CVE-2025-30397: Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows a
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-29968MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29968 [MEDIUM] CWE-20 CVE-2025-29968: Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized atta
Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network.
nvd
CVE-2025-29839MEDIUMCVSS 4.0≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29839 [MEDIUM] CWE-125 CVE-2025-29839: Out-of-bounds read in Windows File Server allows an unauthorized attacker to disclose information lo
Out-of-bounds read in Windows File Server allows an unauthorized attacker to disclose information locally.
nvd
CVE-2025-29960MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29960 [MEDIUM] CWE-125 CVE-2025-29960: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29958MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29958 [MEDIUM] CWE-908 CVE-2025-29958: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29830MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29830 [MEDIUM] CWE-908 CVE-2025-29830: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29974MEDIUMCVSS 5.7≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29974 [MEDIUM] CWE-125 CVE-2025-29974: Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to disclose
Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to disclose information over an adjacent network.
nvd
CVE-2025-29836MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29836 [MEDIUM] CWE-125 CVE-2025-29836: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29832MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29832 [MEDIUM] CWE-125 CVE-2025-29832: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29954MEDIUMCVSS 5.9≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29954 [MEDIUM] CWE-400 CVE-2025-29954: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-29959MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29959 [MEDIUM] CWE-908 CVE-2025-29959: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29835MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29835 [MEDIUM] CWE-125 CVE-2025-29835: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29957MEDIUMCVSS 6.2≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29957 [MEDIUM] CWE-400 CVE-2025-29957: Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to
Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally.
nvd
CVE-2025-30394MEDIUMCVSS 5.9≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-30394 [MEDIUM] CWE-591 CVE-2025-30394: Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unaut
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-29961MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29961 [MEDIUM] CWE-125 CVE-2025-29961: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-29956MEDIUMCVSS 5.4≥ 6.3.9600.0, < 6.3.9600.225772025-05-13
CVE-2025-29956 [MEDIUM] CWE-126 CVE-2025-29956: Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network
Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network.
nvd