CVE-2025-58715

Windows Speech Runtime Elevation of Privilege Vulnerability

Integer overflow or wraparound in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 18 more

CVE-2025-58716

Windows Speech Runtime Elevation of Privilege Vulnerability

Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 18 more

CVE-2025-58719

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 17 more

CVE-2025-58722

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DWM allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 17 more

CVE-2025-58728

Windows Bluetooth Service Elevation of Privilege Vulnerability

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 Windows 10 1809 and 20 more

CVE-2025-58732

Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 Windows 10 1507 and 26 more

CVE-2025-58735

Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 23 more

CVE-2025-59196

Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 23 more

CVE-2025-59199

Software Protection Platform (SPP) Elevation of Privilege Vulnerability

Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 4.5% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 15 more

CVE-2025-59201

Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability

Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 23 more

CVE-2025-59202

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 19 more

CVE-2025-59207

Windows Kernel Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 15 more

CVE-2025-59242

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 23 more

CVE-2025-49708

Microsoft Graphics Component Elevation of Privilege Vulnerability

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Graphics Component Windows Windows 10 and 20 more

CVE-2025-59255

Windows DWM Core Library Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 Windows 10 1809 and 19 more

CVE-2025-59282

Internet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Iis Windows Windows 10 and 28 more

CVE-2025-59295

Windows URL Parsing Remote Code Execution Vulnerability

Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Microsoft

Products

Internet Explorer Windows Windows 10 and 28 more

CVE-2025-48813

Virtual Secure Mode Spoofing Vulnerability

Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 Windows 10 1809 and 19 more

CVE-2025-25004

PowerShell Elevation of Privilege Vulnerability

Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Powershell Windows Windows 10 and 28 more

CVE-2025-53717

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 11 Windows 11 22h2 and 7 more