Microsoft Windows Server 2025 vulnerabilities
3,648 known vulnerabilities affecting microsoft/windows_server_2025.
Total CVEs
3,648
CISA KEV
42
actively exploited
Public exploits
32
Exploited in wild
50
Severity breakdown
CRITICAL131HIGH2617MEDIUM891LOW9
Vulnerabilities
Page 21 of 183
CVE-2026-83725P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83725 [HIGH] CWE-122 CVE-2026-83725: Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-69326P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-69326 [HIGH] CWE-122 CVE-2026-69326: Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a n
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-85817P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-85817 [HIGH] CWE-807 CVE-2026-85817: Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized att
Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-88116P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-88116 [HIGH] CWE-822 CVE-2026-88116: Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a n
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-49729P3HIGHCVSS 8.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-49729 [HIGH] CWE-122 CVE-2025-49729: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-88112P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-88112 [HIGH] CWE-822 CVE-2026-88112: Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a n
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-85903P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-85903 [HIGH] CWE-822 CVE-2026-85903: Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a n
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-88114P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-88114 [HIGH] CWE-822 CVE-2026-88114: Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a n
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-83929P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83929 [HIGH] CWE-787 CVE-2026-83929: Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-62817P3HIGHCVSS 8.8fixed in 10.0.26100.33222≥ 10.0.26100.0, < 10.0.26100.332962026-08-11
CVE-2026-62817 [HIGH] CWE-787 CVE-2026-62817: Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent
Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-62816P3HIGHCVSS 8.8fixed in 10.0.26100.33222≥ 10.0.26100.0, < 10.0.26100.332962026-08-11
CVE-2026-62816 [HIGH] CWE-122 CVE-2026-62816: Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized at
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-54982P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54982 [HIGH] CWE-191 CVE-2026-54982: Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an una
Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-50370P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50370 [HIGH] CWE-20 CVE-2026-50370: Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code ov
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-34329P3HIGHCVSS 8.8fixed in 10.0.26100.32772≥ 10.0.26100.0, < 10.0.26100.328602026-05-12
CVE-2026-34329 [HIGH] CWE-122 CVE-2026-34329: Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute cod
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-40403P3HIGHCVSS 8.8fixed in 10.0.26100.32772≥ 10.0.26100.0, < 10.0.26100.328602026-05-12
CVE-2026-40403 [HIGH] CWE-122 CVE-2026-40403: Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code lo
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
nvd
CVE-2026-54999P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54999 [HIGH] CWE-362 CVE-2026-54999: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-24283P3HIGHCVSS 8.8fixed in 10.0.26100.32463≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-24283 [HIGH] CWE-122 CVE-2026-24283: Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privilege
Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-83716P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83716 [HIGH] CWE-122 CVE-2026-83716: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
nvd
CVE-2026-85905P3HIGHCVSS 8.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-85905 [HIGH] CWE-122 CVE-2026-85905: Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate p
Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-69603P3HIGHCVSS 8.8fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69603 [HIGH] CWE-122 CVE-2026-69603: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
nvd