CVE-2025-21337

Windows NTFS Elevation of Privilege Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-21375

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-21369

Microsoft Digest Authentication Remote Code Execution Vulnerability

Microsoft Digest Authentication Remote Code Execution Vulnerability

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-21368

Microsoft Digest Authentication Remote Code Execution Vulnerability

Microsoft Digest Authentication Remote Code Execution Vulnerability

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-21352

Internet Connection Sharing (ICS) Denial of Service Vulnerability

Internet Connection Sharing (ICS) Denial of Service Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-26645

Remote Desktop Client Remote Code Execution Vulnerability

Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed

Vendors

Microsoft

Products

Remote Desktop Remote Desktop Client Windows 10 1507 and 25 more

CVE-2025-24992

Windows NTFS Information Disclosure Vulnerability

Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24072

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24064

Windows Domain Name Service Remote Code Execution Vulnerability

Use after free in DNS Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Sp2 and 8 more

CVE-2025-24059

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24056

Windows Telephony Service Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24055

Windows USB Video Class System Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24051

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-21247

MapUrlToZone Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24996

NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 20 more

CVE-2025-21180

Windows exFAT File System Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24988

Windows USB Video Class System Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24987

Windows USB Video Class System Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24035

Windows Remote Desktop Services Remote Code Execution Vulnerability

Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-29810

Active Directory Domain Services Elevation of Privilege Vulnerability

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more