CVE-2025-21221

Windows Telephony Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-21205

Windows Telephony Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-27752

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 6 more

CVE-2025-27478

Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-27477

Windows Telephony Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-26668

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-26666

Windows Media Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 13 more

CVE-2025-24063

Kernel Streaming Service Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-32703

Visual Studio Information Disclosure Vulnerability

Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio 2017 Visual Studio 2019 Visual Studio 2022

CVE-2025-30376

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Excel 2016 and 8 more

CVE-2025-29979

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Excel Office and 8 more

CVE-2025-29967

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Remote Desktop Windows 10 1507 Windows 10 1607 and 22 more

CVE-2025-29966

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Remote Desktop Windows 10 1507 Windows 10 1607 and 23 more

CVE-2025-49742

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-49732

Windows Graphics Component Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-49730

Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 Windows 10 1507 and 24 more

CVE-2025-49705

Microsoft PowerPoint Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 10 more

CVE-2025-49683

Microsoft Virtual Hard Disk Remote Code Execution Vulnerability

Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-49666

Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Windows Server Windows Server 2016 Windows Server 2019 and 4 more

CVE-2025-49663

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Sp2 and 8 more