Msrc Windows Server 2025 vulnerabilities

CVE-2025-59513 [MEDIUM] CWE-125 Windows Bluetooth RFCOM Protocol Driver Information Disclosure Vulnerability Windows Bluetooth RFCOM Protocol Driver Information Disclosure Vulnerability Description: Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. FAQ: According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), no loss of integrity (I:N), and some loss

CVE-2025-62208 [MEDIUM] CWE-532 Windows License Manager Information Disclosure Vulnerability Windows License Manager Information Disclosure Vulnerability Description: Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the local me

CVE-2025-62209 [MEDIUM] CWE-532 Windows License Manager Information Disclosure Vulnerability Windows License Manager Information Disclosure Vulnerability Description: Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the local me

CVE-2025-49708 [CRITICAL] CWE-416 Microsoft Graphics Component Elevation of Privilege Vulnerability Microsoft Graphics Component Elevation of Privilege Vulnerability Description: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. FAQ: How could a

CVE-2025-59287 [CRITICAL] CWE-502 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability Windows Server Update Service (WSUS) Remote Code Execution Vulnerability Description: Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. FAQ: How could an attacker exploit this vulnerability? A remote, unauthenticated attacker could send a crafted event that triggers unsafe object deserialization in a legacy s

CVE-2025-48004 [HIGH] CWE-416 Microsoft Brokering File System Elevation of Privilege Vulnerability Microsoft Brokering File System Elevation of Privilege Vulnerability Description: Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condit

CVE-2025-55697 [HIGH] CWE-122 Azure Local Elevation of Privilege Vulnerability Azure Local Elevation of Privilege Vulnerability Description: Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Azure Local: Azure Local Microsoft: Microsoft Customer Action Re

CVE-2025-55339 [HIGH] CWE-125 Windows Network Driver Interface Specification (NDIS) Driver Elevation of Privilege Vulnerability Windows Network Driver Interface Specification (NDIS) Driver Elevation of Privilege Vulnerability Description: Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could

CVE-2025-59193 [HIGH] CWE-362 Windows Management Services Elevation of Privilege Vulnerability Windows Management Services Elevation of Privilege Vulnerability Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally. FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation

CVE-2025-55680 [HIGH] CWE-367 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Description: Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? A domain user could use this vulnerability to elevat

CVE-2025-55681 [HIGH] CWE-125 Desktop Window Manager Elevation of Privilege Vulnerability Desktop Window Manager Elevation of Privilege Vulnerability Description: Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally. FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to manipulate system operations in a specific manner. F

CVE-2025-59255 [HIGH] CWE-122 Windows DWM Core Library Elevation of Privilege Vulnerability Windows DWM Core Library Elevation of Privilege Vulnerability Description: Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Windows DWM Core Library: W

CVE-2025-55692 [HIGH] CWE-20 Windows Error Reporting Service Elevation of Privilege Vulnerability Windows Error Reporting Service Elevation of Privilege Vulnerability Description: Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain administrator privileges. Windows Er

CVE-2025-58722 [HIGH] CWE-122 Microsoft DWM Core Library Elevation of Privilege Vulnerability Microsoft DWM Core Library Elevation of Privilege Vulnerability Description: Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Windows DWM: Windows DWM Microsoft:

CVE-2025-58738 [HIGH] CWE-416 Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability Description: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? An attacker must send a user a malicious Office file and convince them to open it. FAQ: According to the

CVE-2025-50152 [HIGH] CWE-125 Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability Description: Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Windows Kernel: Windows Kernel Microsoft: Microsoft Customer Ac

CVE-2025-59207 [HIGH] CWE-822 Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability Description: Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Windows Kernel: Windows Kernel Microsoft: Microsoft

CVE-2025-59195 [HIGH] CWE-362 Windows Graphics Component Denial of Service Vulnerability Windows Graphics Component Denial of Service Vulnerability Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to deny service locally. FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerabi

CVE-2025-59191 [HIGH] CWE-122 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability Windows Connected Devices Platform Service Elevation of Privilege Vulnerability Description: Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability cou

CVE-2025-59254 [HIGH] CWE-122 Microsoft DWM Core Library Elevation of Privilege Vulnerability Microsoft DWM Core Library Elevation of Privilege Vulnerability Description: Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Windows DWM Core Librar