CVE-2025-49685

Windows Search Service Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 10 more

CVE-2025-49727

Win32k Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-49729

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Sp2 and 8 more

CVE-2025-49733

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 Windows 10 1809 and 16 more

CVE-2025-49744

Windows Graphics Component Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 16 more

CVE-2025-29828

Windows Schannel Remote Code Execution Vulnerability

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 22h2 Windows 11 22h2 Windows 11 23h2 and 7 more

CVE-2025-32712

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-32713

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-32718

Windows SMB Client Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 18 more

CVE-2025-32721

Windows Recovery Driver Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 16 more

CVE-2025-33071

Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability

Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS 23.4% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 and 5 more

CVE-2025-33053

Internet Shortcut Files Remote Code Execution Vulnerability

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 87.1% KEV · Listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-33070

Windows Netlogon Elevation of Privilege Vulnerability

Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS 10.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 20 more

CVE-2025-33073

Windows SMB Client Elevation of Privilege Vulnerability

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 82.8% KEV · Listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-49757

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Server Windows Windows 2008 and 14 more

CVE-2025-49761

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Server Windows Windows 10 1507 and 26 more

CVE-2025-50160

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 R2 and 10 more

CVE-2025-50161

Win32k Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Windows 10 1507 Windows 10 1607 and 24 more

CVE-2025-50162

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Server Windows Windows 2008 and 14 more

CVE-2025-50163

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows Server Windows Server 2008 Windows Server 2008 R2 and 11 more