cbcvebase.

Microsoft Windows Server 2025 vulnerabilities

3,648 known vulnerabilities affecting microsoft/windows_server_2025.

Total CVEs
3,648
CISA KEV
42
actively exploited
Public exploits
32
Exploited in wild
50
Severity breakdown
CRITICAL130HIGH2616MEDIUM893LOW9

Vulnerabilities

Page 14 of 183
CVE-2026-83777P3HIGHCVSS 8.8≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83777 [HIGH] CWE-122 CVE-2026-83777: Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate p Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.
nvd
CVE-2026-83928P2HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83928 [HIGH] CWE-306 CVE-2026-83928: Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthor Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-88121P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-88121 [HIGH] CWE-416 CVE-2026-88121: Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized atta Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21285P3HIGHCVSS 7.5fixed in 10.0.26100.2894≥ 10.0.26100.0, < 10.0.26100.28942025-01-14
CVE-2025-21285 [HIGH] CWE-476 CVE-2025-21285: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2026-105010P3CRITICALCVSS 9.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-105010 [CRITICAL] CWE-416 CVE-2026-105010: Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate priv Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2026-49164P3CRITICALCVSS 9.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-49164 [CRITICAL] CWE-122 CVE-2026-49164: Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to ex Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50380P3CRITICALCVSS 9.6fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50380 [CRITICAL] CWE-122 CVE-2026-50380: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a ne Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-40369P3HIGHCVSS 7.8fixed in 10.0.26100.32772≥ 10.0.26100.0, < 10.0.26100.328602026-05-12
CVE-2026-40369 [HIGH] CWE-822 CVE-2026-40369: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges loc Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-20840P3HIGHCVSS 7.8fixed in 10.0.26100.32230≥ 10.0.26100.0, < 10.0.26100.322302026-01-13
CVE-2026-20840 [HIGH] CWE-122 CVE-2026-20840: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
nvd
CVE-2025-50171P3CRITICALCVSS 9.1fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-50171 [CRITICAL] CWE-862 CVE-2025-50171: Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing o Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2025-24051P3HIGHCVSS 8.8fixed in 10.0.26100.3403fixed in 10.0.26100.3476+1 more2025-03-11
CVE-2025-24051 [HIGH] CWE-122 CVE-2025-24051: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-83784P3HIGHCVSS 8.8≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83784 [HIGH] CWE-36 CVE-2026-83784: Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to ele Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2025-64678P3HIGHCVSS 8.8fixed in 10.0.26100.7092≥ 10.0.26100.0, < 10.0.26100.71712025-12-09
CVE-2025-64678 [HIGH] CWE-122 CVE-2025-64678: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-70089P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70089 [HIGH] CWE-122 CVE-2026-70089: Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a net Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-77496P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-77496 [HIGH] CWE-122 CVE-2026-77496: Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute c Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-83523P3HIGHCVSS 8.8≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83523 [HIGH] CWE-122 CVE-2026-83523: Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute c Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-70258P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70258 [HIGH] CWE-122 CVE-2026-70258: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-100220P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-100220 [HIGH] CWE-122 CVE-2026-100220: Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-83642P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83642 [HIGH] CWE-843 CVE-2026-83642: Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized a Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-80096P3HIGHCVSS 8.8fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-80096 [HIGH] CWE-125 CVE-2026-80096: Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privi Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
nvd
← Previous14 / 183Next →
Microsoft Windows Server 2025 vulnerabilities | cvebase