Microsoft
91,472 known vulnerabilities
Top Products
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a ne
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privilege
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execut
Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally.
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Managem
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security fea
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to ex
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally.
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally
Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network.
Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate pr
Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose infor
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose infor
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose infor
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized
Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an
Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Compon
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose informa
Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a netwo
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose i
Frequently Asked Questions
How many CVEs affect Microsoft?
Microsoft has 91,472 CVE records in our database, including 2628 critical and 63090 high severity vulnerabilities. 351 of these are listed in CISA's Known Exploited Vulnerabilities catalog.
What are the most severe Microsoft vulnerabilities?
Microsoft has 2628 critical severity (CVSS 9.0+) and 63090 high severity (CVSS 7.0-8.9) vulnerabilities. 351 vulnerabilities are confirmed as actively exploited in the wild.
How can I scan for Microsoft vulnerabilities?
CyberStrike's AI-powered security agents automatically detect vulnerabilities in Microsoft products across your infrastructure. The platform provides continuous pentesting, DAST scanning, and real-time vulnerability monitoring with actionable remediation guidance.
Detect Microsoft Vulnerabilities
CyberStrike scans your infrastructure for Microsoft vulnerabilities and provides real-time remediation guidance.
Get Started