CVE-2025-27730: Windows Digital Media Elevation of Privilege Vulnerability
Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE archive
April 2025
Browse CVE records published in April 2025, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 3966 matching CVEs · Page 2 of 80.
CVE-2025-27731: Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability
Improper input validation in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27728: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27729: Windows Shell Remote Code Execution Vulnerability
Use after free in Windows Shell allows an unauthorized attacker to execute code locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27727: Windows Installer Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27490: Windows Bluetooth Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27491: Windows Hyper-V Remote Code Execution Vulnerability
Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27492: Windows Secure Channel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27486: Windows Standards-Based Storage Management Service Denial of Service Vulnerability
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27489: Azure Local Elevation of Privilege Vulnerability
Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27487: Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27483: NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27482: Windows Remote Desktop Services Remote Code Execution Vulnerability
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27481: Windows Telephony Service Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27480: Windows Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27484: Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27485: Windows Standards-Based Storage Management Service Denial of Service Vulnerability
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-27469: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26679: RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26678: Windows Defender Application Control Security Feature Bypass Vulnerability
Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26676: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26675: Windows Subsystem for Linux Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26673: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26672: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26674: Windows Media Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26671: Windows Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26670: Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26652: Windows Standards-Based Storage Management Service Denial of Service Vulnerability
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26651: Windows Local Session Manager (LSM) Denial of Service Vulnerability
Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26647: Windows Kerberos Elevation of Privilege Vulnerability
Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26649: Windows Secure Channel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26648: Windows Kernel Elevation of Privilege Vulnerability
Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26644: Windows Hello Spoofing Vulnerability
Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26641: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26640: Windows Digital Media Elevation of Privilege Vulnerability
Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26642: Microsoft Office Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26637: Windows BitLocker Security Feature Bypass Vulnerability
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26635: Windows Hello Security Feature Bypass Vulnerability
Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26639: Windows USB Print Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-26628: Azure Local Cluster Information Disclosure Vulnerability
Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-25002: Azure Local Cluster Information Disclosure Vulnerability
Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-25001: Microsoft Edge for iOS Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Published Apr 4, 2025 · Updated Aug 10, 2026
CVE-2025-25000: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Published Apr 3, 2025 · Updated Aug 10, 2026
CVE-2025-24058: Windows DWM Core Library Elevation of Privilege Vulnerability
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-21222: Windows Telephony Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-21221: Windows Telephony Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-21204: Windows Process Activation Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-21203: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-21205: Windows Telephony Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
Published Apr 8, 2025 · Updated Aug 10, 2026
CVE-2025-21191: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
Published Apr 8, 2025 · Updated Aug 10, 2026