CVE-2025-24046

Kernel Streaming Service Driver Elevation of Privilege Vulnerability

Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 15 more

CVE-2025-21247

MapUrlToZone Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24996

NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 20 more

CVE-2025-24995

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 16 more

CVE-2025-21180

Windows exFAT File System Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24988

Windows USB Video Class System Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24987

Windows USB Video Class System Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-24044

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 18 more

CVE-2025-24035

Windows Remote Desktop Services Remote Code Execution Vulnerability

Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-29810

Active Directory Domain Services Elevation of Privilege Vulnerability

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-29809

Windows Kerberos Security Feature Bypass Vulnerability

Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.1 High EPSS 4.3% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 16 more

CVE-2025-27738

Windows Resilient File System (ReFS) Information Disclosure Vulnerability

Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 3.6% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 18 more

CVE-2025-27737

Windows Security Zone Mapping Security Feature Bypass Vulnerability

Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-27735

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

Insufficient verification of data authenticity in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 16 more

CVE-2025-27733

NTFS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 7 more

CVE-2025-27732

Windows Graphics Component Elevation of Privilege Vulnerability

Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-27727

Windows Installer Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 21 more

CVE-2025-27491

Windows Hyper-V Remote Code Execution Vulnerability

Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.1 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 16 more

CVE-2025-27487

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS 1.5% KEV · Not listed

Vendors

Microsoft

Products

Remote Desktop Remote Desktop Client Windows 10 1507 and 24 more

CVE-2025-27483

NTFS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 4 more