Common Vulnerabilities and Exposures (CVE)
CVE-2025-64678
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVE-2025-64672
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2025-64671
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
CVE-2025-64661
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2025-62565
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2025-62570
Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.
CVE-2025-62569
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVE-2025-62567
Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network.
CVE-2025-62560
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62559
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62558
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62557
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-62556
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62555
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62554
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.