# Unveiling the Landscape of Operating System Vulnerabilities
## 7 Conclusions  
In conclusion, this paper presents an extensive study of OS vulnerabilities, leveraging high-quality data from the NVD and employing a robust research methodology \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{4}{c}{**Count of Vulnerability Types**} \\ \hline
**OS Names** & **CWE-119** & **CWE-787** & **CWE-20** & **CWE-200** \\ \hline Debian Linux & 515 & 768 & 434 & 233 \\ Android & 371 & 744 & 367 & 321 \\ Windows & 205 & 75 & 266 & 325 \\ Fedora & 156 & 441 & 154 & 89 \\ Ubuntu Linux & 366 & 269 & 201 & 135 \\ Windows Server & 142 & 76 & 257 & 306 \\ Mac OS & 696 & 334 & 233 & 188 \\ openSUSE & 291 & 216 & 147 & 88 \\ Iphone OS & 757 & 297 & 200 & 205 \\ tvOS & 403 & 242 & 75 & 48 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Common vulnerability types observed in our top 10 vulnerable OS categories. \begin{table}
\begin{tabular}{c c c} \hline \hline
**OS Versions** & **Mostly Observed CWE** & **Count** \\ \hline Windows 10 & CWE-269 & 2043 \\ Windows 11 & CWE-269 & 225 \\ Android 11 & CWE-787 & 258 \\ Debian Linux 10 & CWE-787 & 373 \\ Android 12 & CWE-787 & 192 \\ Debian Linux 11 & CWE-787 & 130 \\ Windows Server 2012 & CWE-200 & 226 \\ Fedora 37 & CWE-416 & 59 \\ Android 13 & CWE-862 & 44 \\ HarmonyOS 2 & CWE-125 & 38 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Mostly observed CWE ID along with their maximum counts in our top 10 vulnerable OS versions in recent years (2021–2022). that involves creating two precise datasets, namely OS_CAT and OS_VER; sampling of vulnerable OSs; and an analysis of trends, severity, and types of vulnerabilities. A detailed analysis reveals that popular OSs such as Debian Linux, Android, Windows, and Fedora, among others, are highly susceptible to vulnerabilities. Most importantly, Windows 10, Windows 11, Android (v11.0, v12.0, v13.0), Windows Server 2012, Debian Linux (v10.0, v11.0), Fedora 37, and HarmonyOS 2 emerge as highly vulnerable OS versions that are still active and supported by vendors. From the vendor's perspective, Redhat exhibits the highest number of reported vulnerabilities. Our study reveals that the top 10 OS categories and versions consistently face highly severe vulnerabilities, with maximum CVSS scores of 7-8 and 9-10. The study also reveals that the highly vulnerable OSs commonly experience four common vulnerability types viz. CWE-119, CWE-20, CWE-200, and CWE-787. On the other hand, the Linux distributions Ubuntu Linux and openSUSE have demonstrated to be the most secure OS versions in recent years, with only nine and two vulnerability reports, respectively, in 2022. Based on these findings, it is highly recommended that OS vendors of all 10 OS categories focus on addressing these common weaknesses. The vulnerabilities represented by CWE-119, CWE-787, CWE-20, and CWE-200 are still prevalent in recent years (2021-2022). Furthermore, specific security measures should be implemented to mitigate CWE-269 (improper privilege management) in Windows 10 and Windows 11. For Android, attention should be given to addressing CWE-787 and CWE-862 (missing authorization) vulnerabilities. Debian Linux should strengthen its security measures to combat CWE-787, while Fedora 37 should focus on improving security measures related to CWE-416 (use after free). Additionally, HarmonyOS 2 should take steps to address vulnerabilities associated with CWE-125 (out-of-bounds read). These vulnerabilities are of significant concern as they largely fall into the CVSS score groups of 7-8 and 9-10, indicating a high severity. Finally, we also recommend that end-users of these OSs stay informed about the latest trends, severity levels, and types of vulnerabilities that can affect their OSs. By shedding light on these findings, this research contributes to a better understanding of the OS vulnerability landscape, promoting the enhancement of OS security measures and vulnerability risk mitigation.