Veille CVE

Recherche « Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) »

81 CVE

Critique 4 Élevée 65 Moyenne 12 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) » ✕
  1. CVE-2026-42825 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  2. CVE-2026-41097 6.7 Moyenne

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  3. CVE-2026-41096 9.8 Critique

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

  4. CVE-2026-41095 7.8 Élevée

    Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation) · Microsoft Windows Server 2016 · Microsoft Windows Server 2016 (Server Core installation)

    Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.

  5. CVE-2026-41089 9.8 Critique

    Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation) · Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation)

    Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

  6. CVE-2026-41088 7.8 Élevée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  7. CVE-2026-40415 8.1 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

  8. CVE-2026-40414 7.4 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Windows TCP/IP Denial of Service Vulnerability

  9. CVE-2026-40413 7.4 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Windows TCP/IP Denial of Service Vulnerability

  10. CVE-2026-40410 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.

  11. CVE-2026-40408 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

  12. CVE-2026-40407 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  13. CVE-2026-40406 7.5 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.

  14. CVE-2026-40403 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

  15. CVE-2026-40401 7.1 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Windows TCP/IP Denial of Service Vulnerability

  16. CVE-2026-40399 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  17. CVE-2026-40398 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

  18. CVE-2026-40397 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  19. CVE-2026-40382 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  20. CVE-2026-40380 6.2 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

  21. CVE-2026-40377 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

  22. CVE-2026-35424 7.5 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

  23. CVE-2026-35423 5.4 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

  24. CVE-2026-35422 6.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.

  25. CVE-2026-35421 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.

  26. CVE-2026-35420 7.8 Élevée

    Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation) · Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation)

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  27. CVE-2026-35418 7.0 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

  28. CVE-2026-35417 7.8 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  29. CVE-2026-35416 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  30. CVE-2026-35415 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

  31. CVE-2026-34351 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  32. CVE-2026-34347 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  33. CVE-2026-34345 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  34. CVE-2026-34344 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  35. CVE-2026-34343 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.

  36. CVE-2026-34342 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

  37. CVE-2026-34341 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

  38. CVE-2026-34340 7.0 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

  39. CVE-2026-34339 5.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.

  40. CVE-2026-34338 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  41. CVE-2026-34337 7.0 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

  42. CVE-2026-34336 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  43. CVE-2026-34334 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  44. CVE-2026-34333 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  45. CVE-2026-34331 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  46. CVE-2026-34330 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  47. CVE-2026-34329 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.

  48. CVE-2026-33841 7.8 Élevée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

  49. CVE-2026-33839 7.0 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  50. CVE-2026-33838 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

  51. CVE-2026-33837 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  52. CVE-2026-33835 7.8 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

  53. CVE-2026-33834 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

  54. CVE-2026-32209 4.4 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.

  55. CVE-2026-32170 6.7 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

  56. CVE-2026-32161 7.5 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.

  57. CVE-2026-21530 6.7 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office LTSC 2021

    Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

  58. CVE-2026-33824 9.8 Critique Exploitée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

  59. CVE-2026-20805 5.5 Moyenne Exploitée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

  60. CVE-2025-62215 7.0 Élevée Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H3

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

  61. CVE-2025-59287 9.8 Critique Exploitée

    Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation) · Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation)

    Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

  62. CVE-2025-33073 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

  63. CVE-2025-26633 7.0 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

  64. CVE-2025-24993 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

  65. CVE-2025-24991 5.5 Moyenne Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

  66. CVE-2025-24985 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.

  67. CVE-2025-24984 4.6 Moyenne Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

  68. CVE-2025-21335 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

  69. CVE-2025-21334 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

  70. CVE-2025-21333 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

  71. CVE-2024-43573 8.1 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Windows MSHTML Platform Spoofing Vulnerability

  72. CVE-2024-43572 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Microsoft Management Console Remote Code Execution Vulnerability

  73. CVE-2024-43461 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Windows MSHTML Platform Spoofing Vulnerability

  74. CVE-2024-30088 7.0 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Windows Kernel Elevation of Privilege Vulnerability

  75. CVE-2024-29988 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    SmartScreen Prompt Security Feature Bypass Vulnerability

  76. CVE-2024-26169 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows Error Reporting Service Elevation of Privilege Vulnerability

  77. CVE-2024-21412 8.1 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 21H2

    Internet Shortcut Files Security Feature Bypass Vulnerability

  78. CVE-2024-21338 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 21H2

    Windows Kernel Elevation of Privilege Vulnerability

  79. CVE-2023-36033 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows DWM Core Library Elevation of Privilege Vulnerability

  80. CVE-2023-36025 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows SmartScreen Security Feature Bypass Vulnerability

  81. CVE-2013-3900 5.5 Moyenne Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900