Microsoft Windows Server 2022 23H2 vulnerabilities

CVE-2025-50167 [HIGH] CWE-362 CVE-2025-50167: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2025-53721 [HIGH] CWE-416 CVE-2025-53721: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevat Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

CVE-2025-60717 [HIGH] CWE-416 CVE-2025-60717: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privil Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

CVE-2025-59515 [HIGH] CWE-416 CVE-2025-59515: Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privil Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

CVE-2025-27492 [HIGH] CWE-362 CVE-2025-27492: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.

CVE-2025-59202 [HIGH] CWE-416 CVE-2025-59202: Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privilege Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

CVE-2025-55223 [HIGH] CWE-362 CVE-2025-55223: Concurrent execution using shared resource with improper synchronization ('race condition') in Graph Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-54105 [HIGH] CWE-362 CVE-2025-54105: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

CVE-2025-54114 [HIGH] CWE-362 CVE-2025-54114: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

CVE-2025-29960 [MEDIUM] CWE-125 CVE-2025-29960: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

CVE-2025-29959 [MEDIUM] CWE-908 CVE-2025-29959: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

CVE-2025-53135 [HIGH] CWE-362 CVE-2025-53135: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.

CVE-2025-55328 [HIGH] CWE-362 CVE-2025-55328: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2025-55687 [HIGH] CWE-362 CVE-2025-55687: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Resilient File System (ReFS) allows an unauthorized attacker to elevate privileges locally.

CVE-2025-55335 [HIGH] CWE-362 CVE-2025-55335: Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally. Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

CVE-2025-59196 [HIGH] CWE-362 CVE-2025-59196: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

CVE-2025-59220 [HIGH] CWE-362 CVE-2025-59220: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

CVE-2026-26166 [HIGH] CWE-415 CVE-2026-26166: Double free in Windows Shell allows an authorized attacker to elevate privileges locally. Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-34341 [HIGH] CWE-415 CVE-2026-34341: Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

CVE-2025-58727 [HIGH] CWE-362 CVE-2025-58727: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.