Windows 10 1607 CVEs and Security Vulnerabilities

CVE-2026-25187

Winlogon Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 3.4% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-20931

Windows Telephony Service Elevation of Privilege Vulnerability

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-32177

.NET Elevation of Privilege Vulnerability

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Visual Studio 2017 and 18 more

CVE-2025-30388

Windows Graphics Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS 4.4% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Office Long Term Servicing Channel and 26 more

CVE-2025-26687

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Windows 10 1507 and 23 more

CVE-2026-24285

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Office For Android and 28 more

CVE-2026-25180

Windows Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Office For Android and 30 more

CVE-2025-53799

Windows Imaging Component Information Disclosure Vulnerability

Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Windows 10 1507 and 23 more

CVE-2025-60724

GDI+ Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Graphics Component Office and 29 more

CVE-2025-53766

GDI+ Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 11.5% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Gdi+ Gdiplus and 27 more

CVE-2024-38250

Windows Graphics Component Elevation of Privilege Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Office Long Term Servicing Channel and 23 more

CVE-2026-40407

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2025-21338

GDI+ Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Office Office Long Term Servicing Channel Office Macos and 26 more

CVE-2022-26934

Windows Graphics Component Information Disclosure Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 25 more

CVE-2023-29335

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

Search vulnerabilities

Winlogon Elevation of Privilege Vulnerability

Windows Telephony Service Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

Windows Graphics Component Remote Code Execution Vulnerability

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows Graphics Component Information Disclosure Vulnerability

Windows Imaging Component Information Disclosure Vulnerability

GDI+ Remote Code Execution Vulnerability

GDI+ Remote Code Execution Vulnerability

Windows Graphics Component Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

GDI+ Remote Code Execution Vulnerability

Windows Graphics Component Information Disclosure Vulnerability

Microsoft Word Security Feature Bypass Vulnerability

Windows Telephony Service Elevation of Privilege Vulnerability

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Windows Graphics Component Remote Code Execution Vulnerability

Windows TCP/IP Information Disclosure Vulnerability

Windows WAN ARP Driver Elevation of Privilege Vulnerability