windows_server_2012 vulnerabilities
CVEs whose affected-version data names the windows_server_2012 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
995 CVEsRSS
CVE-2026-61349High· 7.8Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.
Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.
CVE-2026-61348High· 7.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-61347Medium· 5.5Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-61345Medium· 6.5Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
CVE-2026-59138Medium· 6.5Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
CVE-2026-59137Medium· 5.5Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-59136Medium· 5.5Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
CVE-2026-59135Medium· 5.5Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
CVE-2026-59134High· 7.5Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-59132High· 7.5Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
CVE-2026-59131Medium· 5.6No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
CVE-2026-59130Medium· 5.6No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
CVE-2026-59128Medium· 5.5Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
CVE-2026-59127High· 7.8Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-59122High· 7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVE-2026-54984High· 7.8PoCHeap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
CVE-2026-54113High· 7.5Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.
CVE-2026-50472High· 7.0Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
CVE-2026-49179High· 8.8PoCImproper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
CVE-2026-42976High· 7.8Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.
CVE-2026-55004High· 7.8Windows Print Configuration Elevation of Privilege Vulnerability
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-54992High· 8.4PoCMicrosoft Message Queuing Queue Manager Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
CVE-2026-54989High· 7.0Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
CVE-2026-54983High· 7.5Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-54982High· 8.8Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-54107High· 8.8PoCWindows Win32k Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-50697High· 7.8Windows Common Log File System Driver Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-50695High· 7.5Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-55003Medium· 6.5Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
CVE-2026-54999High· 8.8Windows TCP/IP Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.