Microsoft Windows Server 2022 23H2 vulnerabilities

CVE-2025-59514 [HIGH] CWE-269 CVE-2025-59514: Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevat Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

CVE-2025-60704 [HIGH] CWE-325 CVE-2025-60704: Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

CVE-2025-62215 [HIGH] CWE-362 CVE-2025-62215: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-60708 [MEDIUM] CWE-822 CVE-2025-60708: Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service lo Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.

CVE-2025-62209 [MEDIUM] CWE-532 CVE-2025-62209: Insertion of sensitive information into log file in Windows License Manager allows an authorized att Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

CVE-2025-62208 [MEDIUM] CWE-532 CVE-2025-62208: Insertion of sensitive information into log file in Windows License Manager allows an authorized att Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

CVE-2025-59510 [MEDIUM] CWE-59 CVE-2025-59510: Improper link resolution before file access ('link following') in Windows Routing and Remote Access Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.

CVE-2025-60706 [MEDIUM] CWE-125 CVE-2025-60706: Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.

CVE-2025-59509 [MEDIUM] CWE-201 CVE-2025-59509: Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.

CVE-2025-59513 [MEDIUM] CWE-125 CVE-2025-59513: Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to discl Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally.

CVE-2025-60723 [MEDIUM] CWE-362 CVE-2025-60723: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network.

CVE-2025-59287 [CRITICAL] CWE-502 CVE-2025-59287: Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker t Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

CVE-2025-49708 [CRITICAL] CWE-416 CVE-2025-49708: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges o Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

CVE-2025-58730 [HIGH] CWE-416 CVE-2025-58730: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVE-2025-58725 [HIGH] CWE-122 CVE-2025-58725: Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locall Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.

CVE-2025-59261 [HIGH] CWE-367 CVE-2025-59261: Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authoriz Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CVE-2025-55326 [HIGH] CWE-416 CVE-2025-55326: Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to exe Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.

CVE-2025-55692 [HIGH] CWE-20 CVE-2025-55692: Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privil Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2025-59502 [HIGH] CWE-400 CVE-2025-59502: Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker t Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

CVE-2025-53150 [HIGH] CWE-362 CVE-2025-53150: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.