← Back

Windows 11 23h2

windows_11_23h2

Vendor: Microsoft • 1,647 CVEs

CVEs (1,647)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-54098
1Microsoft
15Windows 10 1507
Windows 10 1607Windows 10 1809+12 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2025-54094
1Microsoft
15Windows 10 1507
Windows 10 1607Windows 10 1809+12 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
6.7 MEDIUM· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVE-2025-54093
1Microsoft
15Windows 10 1507
Windows 10 1607Windows 10 1809+12 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.0 HIGH· v3
N/A· v2
Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2025-54092
1Microsoft
10Windows 10 1809
Windows 10 21h2Windows 10 22h2+7 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2025-54091
1Microsoft
14Windows 10 1507
Windows 10 1607Windows 10 1809+11 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2025-53810
1Microsoft
15Windows 10 1507
Windows 10 1607Windows 10 1809+12 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
6.7 MEDIUM· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVE-2025-53808
1Microsoft
15Windows 10 1507
Windows 10 1607Windows 10 1809+12 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
6.7 MEDIUM· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVE-2025-53807
1Microsoft
10Windows 10 1809
Windows 10 21h2Windows 10 22h2+7 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.0 HIGH· v3
N/A· v2
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-53805
1Microsoft
6Windows 11 22h2
Windows 11 23h2Windows 11 24h2+3 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
CVE-2025-53804
1Microsoft
14Windows 10 1507
Windows 10 1607Windows 10 1809+11 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2025-53803
1Microsoft
14Windows 10 1507
Windows 10 1607Windows 10 1809+11 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2025-53802
1Microsoft
8Windows 10 21h2
Windows 10 22h2Windows 11 22h2+5 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.0 HIGH· v3
N/A· v2
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVE-2025-53801
1Microsoft
11Windows 10 1507
Windows 10 1607Windows 10 1809+8 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally.
CVE-2025-53800
1Microsoft
12Windows 10 1607
Windows 10 1809Windows 10 21h2+9 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-53799
1Microsoft
16Office
Windows 10 1507Windows 10 1607+13 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
CVE-2025-49734
1Microsoft
13Powershell
Windows 10 1607Windows 10 1809+10 more
Oct 2, 2025
Sep 9, 2025
N/A· v4
7.0 HIGH· v3
N/A· v2
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
CVE-2025-9491
1Microsoft
1Windows 11 23h2
Nov 5, 2025
Aug 26, 2025
4.6 MEDIUM· v4
7.8 HIGH· v3
N/A· v2
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction i...Show more
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.Show less
CVE-2025-55230
1Microsoft
15Windows 10 1507
Windows 10 1607Windows 10 1809+12 more
Sep 30, 2025
Aug 21, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.
CVE-2025-55229
1Microsoft
13Windows 10 1507
Windows 10 1607Windows 10 1809+10 more
Sep 30, 2025
Aug 21, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-53789
1Microsoft
13Windows 10 1507
Windows 10 1607Windows 10 1809+10 more
Aug 14, 2025
Aug 12, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.