Microsoft Windows Server 2025 vulnerabilities
1,706 known vulnerabilities affecting microsoft/windows_server_2025.
Total CVEs
1,706
CISA KEV
38
actively exploited
Public exploits
32
Exploited in wild
46
Severity breakdown
CRITICAL40HIGH1216MEDIUM441LOW9
Vulnerabilities
Page 9 of 86
CVE-2025-33066P3HIGHCVSS 8.8fixed in 10.0.26100.4270≥ 10.0.26100.0, < 10.0.26100.43492025-06-10
CVE-2025-33066 [HIGH] CWE-122 CVE-2025-33066: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-49657P3HIGHCVSS 8.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-49657 [HIGH] CWE-122 CVE-2025-49657: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-48824P3HIGHCVSS 8.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-48824 [HIGH] CWE-122 CVE-2025-48824: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-47998P3HIGHCVSS 8.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-47998 [HIGH] CWE-122 CVE-2025-47998: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-49676P3HIGHCVSS 8.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-49676 [HIGH] CWE-122 CVE-2025-49676: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-49672P3HIGHCVSS 8.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-49672 [HIGH] CWE-122 CVE-2025-49672: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorize
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-32157P3HIGHCVSS 8.8fixed in 10.0.26100.32690≥ 10.0.26100.0, < 10.0.26100.326902026-04-14
CVE-2026-32157 [HIGH] CWE-416 CVE-2026-32157: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a netwo
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50474P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50474 [HIGH] CWE-416 CVE-2026-50474: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a netwo
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-47653P3HIGHCVSS 8.8fixed in 10.0.26100.32995≥ 10.0.26100.0, < 10.0.26100.329952026-06-09
CVE-2026-47653 [HIGH] CWE-416 CVE-2026-47653: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a netwo
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50340P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50340 [HIGH] CWE-416 CVE-2026-50340: Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network
Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-50370P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50370 [HIGH] CWE-20 CVE-2026-50370: Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code ov
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-34329P3HIGHCVSS 8.8fixed in 10.0.26100.32772≥ 10.0.26100.0, < 10.0.26100.328602026-05-12
CVE-2026-34329 [HIGH] CWE-122 CVE-2026-34329: Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute cod
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-42975P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-42975 [HIGH] CWE-122 CVE-2026-42975: Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execu
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-50692P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50692 [HIGH] CWE-122 CVE-2026-50692: Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privil
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-54999P3HIGHCVSS 8.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54999 [HIGH] CWE-362 CVE-2026-54999: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2026-40398P3HIGHCVSS 7.8fixed in 10.0.26100.32772≥ 10.0.26100.0, < 10.0.26100.328602026-05-12
CVE-2026-40398 [HIGH] CWE-122 CVE-2026-40398: Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privil
Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50387P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50387 [HIGH] CWE-121 CVE-2026-50387: Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges local
Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-54986P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54986 [HIGH] CWE-122 CVE-2026-54986: Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges loc
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-33837P3HIGHCVSS 7.8fixed in 10.0.26100.32772≥ 10.0.26100.0, < 10.0.26100.328602026-05-12
CVE-2026-33837 [HIGH] CWE-122 CVE-2026-33837: Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges loc
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50375P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50375 [HIGH] CWE-122 CVE-2026-50375: Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges lo
Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally.
nvd