W1
Product
Windows 11 22h2
On CISA KEVExploited in the wildRansomware-linked
1,651
CVEs
74
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 41High 446Medium 13Low 0
Watch
Add Windows 11 22h2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54102 | 7.8 | Sep 9 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-54098 | 7.8 | Sep 9 | Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-54092 | 7.8 | Sep 9 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-54091 | 7.8 | Sep 9 | Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-53801 | 7.8 | Sep 9 | Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-53800 | 7.8 | Sep 9 | No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5909 |
| CVE-2025-55230 | 7.8 | Aug 21 | Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-53789 | 7.8 | Aug 12 | Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-53726 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53725 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53724 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53723 | 7.8 | Aug 12 | Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53155 | 7.8 | Aug 12 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53154 | 7.8 | Aug 12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53152 | 7.8 | Aug 12 | Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally Affected: before 10.0.22621.5768 |
| CVE-2025-53151 | 7.8 | Aug 12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53149 | 7.8 | Aug 12 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53141 | 7.8 | Aug 12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-53132 | 7.8 | Aug 12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-50176 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally Affected: before 10.0.22621.5768 |
| CVE-2025-50173 | 7.8 | Aug 12 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-50170 | 7.8 | Aug 12 | Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-50168 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-50155 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-50153 | 7.8 | Aug 12 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-49761 | 7.8 | Aug 12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5768 |
| CVE-2025-49742 | 7.8 | Jul 8 | Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally Affected: before 10.0.22621.5624 |
| CVE-2025-49733 | 7.8 | Jul 8 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49732 | 7.8 | Jul 8 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49730 | 7.8 | Jul 8 | Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49726 | 7.8 | Jul 8 | Use after free in Windows Notification allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49725 | 7.8 | Jul 8 | Use after free in Windows Notification allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49721 | 7.8 | Jul 8 | Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49693 | 7.8 | Jul 8 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49689 | 7.8 | Jul 8 | Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49686 | 7.8 | Jul 8 | Null pointer dereference in Windows TCP/IP allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49683 | 7.8 | Jul 8 | Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to execute code locally Affected: before 10.0.22621.5624 |
| CVE-2025-49679 | 7.8 | Jul 8 | Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49675 | 7.8 | Jul 8 | Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49667 | 7.8 | Jul 8 | Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49665 | 7.8 | Jul 8 | Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49661 | 7.8 | Jul 8 | Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49660 | 7.8 | Jul 8 | Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-49659 | 7.8 | Jul 8 | Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-48820 | 7.8 | Jul 8 | Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
| CVE-2025-48816 | 7.8 | Jul 8 | Integer overflow or wraparound in HID class driver allows an authorized attacker to elevate privileges locally Affected: before 10.0.22621.5624 |
The 500 most important CVEs for this product (exploited first, then by severity)
