Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26641 State: PUBLISHED Published: 2025-04-08T17:23:46.600Z Last Updated: 2025-06-04T17:52:59.552Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service o
n: Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26641
CVE ID: CVE-2025-26642 State: PUBLISHED Published: 2025-04-08T17:23:45.434Z Last Updated: 2025-06-04T17:52:58.381Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft SharePoint Server 2019, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016, Microsoft Office 2016, Microsoft Access 2016 (32-bit edition), Microsoft Access 2016 Problem Types: CWE-125, CWE-190 Description: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to exe
oblem Types: CWE-125, CWE-190 Description: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26642
CVE ID: CVE-2025-26643 State: PUBLISHED Published: 2025-03-07T19:02:08.551Z Last Updated: 2025-05-19T21:38:26.130Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: CWE-449 Description: The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26643
CVE ID: CVE-2025-26644 State: PUBLISHED Published: 2025-04-08T17:23:47.267Z Last Updated: 2025-06-04T17:53:00.157Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-1039 Description: Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hell
Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26644
CVE ID: CVE-2025-26645 State: PUBLISHED Published: 2025-03-11T16:59:25.729Z Last Updated: 2025-05-19T21:38:26.814Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows App Client for Windows Desktop, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Remote Desktop client for Windows Desktop, Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Serve
ws 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-23, CWE-284 Description: Relative path traversal in
Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-23, CWE-284 Description: Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26645
CVE ID: CVE-2025-26646 State: PUBLISHED Published: 2025-05-13T21:39:52.529Z Last Updated: 2025-09-10T00:09:07.449Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: .NET 8.0, .NET 9.0, Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.13, Microsoft Visual Studio 2022 version 17.8, Microsoft Visual Studio 2022 version 17.10, Build Tools for Visual Studio 2022 Problem Types: CWE-73 Description: External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichm
Studio allows an authorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646
CVE ID: CVE-2025-26647 State: PUBLISHED Published: 2025-04-08T17:23:49.183Z Last Updated: 2025-06-04T17:53:01.888Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows
ce Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-20 Description: Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26647
CVE ID: CVE-2025-26648 State: PUBLISHED Published: 2025-04-08T17:23:47.873Z Last Updated: 2025-06-04T17:53:00.633Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591, CWE-416 Description: Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerab
cally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26648
CVE ID: CVE-2025-26649 State: PUBLISHED Published: 2025-04-08T17:23:48.643Z Last Updated: 2025-06-04T17:53:01.273Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally
synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26649
CVE ID: CVE-2025-26651 State: PUBLISHED Published: 2025-04-08T17:23:49.718Z Last Updated: 2025-06-04T17:53:02.669Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-749 Description: Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnric
Manager (LSM) allows an authorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26651
CVE ID: CVE-2025-26652 State: PUBLISHED Published: 2025-04-08T17:23:50.219Z Last Updated: 2025-06-04T17:53:03.241Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny servi
resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26652
CVE ID: CVE-2025-26653 State: PUBLISHED Published: 2025-04-08T07:10:34.185Z Last Updated: 2025-04-08T15:58:31.620Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Problem Types: CWE-79 Description: SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compromising the confident
site. When a user visits the compromised page, the injected script gets executed, potentially compromising the confidentiality and integrity within the scope of the victim�s browser. Availability is not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3559307 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26654 State: PUBLISHED Published: 2025-04-08T07:13:04.452Z Last Updated: 2025-04-09T04:00:45.108Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Commerce Cloud (Public Cloud) Problem Types: CWE-319 Description: SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request before the redirect may be impacted if the client is configured to use HTTP and sends confidential data on the first r
t before the redirect may be impacted if the client is configured to use HTTP and sends confidential data on the first request before the redirect. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3543274 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26655 State: PUBLISHED Published: 2025-03-11T00:35:06.396Z Last Updated: 2025-03-11T02:09:32.603Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Just In Time Problem Types: CWE-862 Description: SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3347991 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26656 State: PUBLISHED Published: 2025-03-11T00:35:18.381Z Last Updated: 2025-03-11T15:12:29.986Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: S/4HANA (Manage Purchasing Info Records) Problem Types: CWE-862 Description: OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3474392 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26657 State: PUBLISHED Published: 2025-04-08T07:13:16.882Z Last Updated: 2025-04-08T14:50:40.019Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP KMC WPC Problem Types: CWE-862 Description: SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3568307 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26658 State: PUBLISHED Published: 2025-03-11T00:35:34.989Z Last Updated: 2025-03-12T04:00:42.580Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Business One (Service Layer) Problem Types: CWE-384 Description: The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort
/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3561045 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26659 State: PUBLISHED Published: 2025-03-11T00:36:40.932Z Last Updated: 2025-03-11T14:14:36.613Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Problem Types: CWE-79 Description: SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser pot
unctionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3552824 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26660 State: PUBLISHED Published: 2025-03-11T00:36:54.383Z Last Updated: 2025-03-11T14:13:59.512Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Fiori apps (Posting Library) Problem Types: CWE-639 Description: SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichme
entially modify data. Confidentiality and Availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3557655 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26661 State: PUBLISHED Published: 2025-03-11T00:37:11.712Z Last Updated: 2025-03-12T04:00:29.868Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver (ABAP Class Builder) Problem Types: CWE-862 Description: Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
gh impact on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3563927 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26662 State: PUBLISHED Published: 2025-05-13T00:09:05.682Z Last Updated: 2025-11-07T05:03:29.249Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Data Services Management Console Problem Types: CWE-79 Description: The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted. Additional Analyst No
his potentially leads to an impact on confidentiality and integrity. Availability is not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3558755 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-26663 State: PUBLISHED Published: 2025-04-08T17:23:04.768Z Last Updated: 2025-06-04T17:52:15.938Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute cod
n: Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26663
CVE ID: CVE-2025-26664 State: PUBLISHED Published: 2025-04-08T17:23:05.579Z Last Updated: 2025-06-04T17:52:16.874Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windo