CVE Vulnerability Advisory Database

[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8, and 8.1 systems

[Impact] Local attackers can execute a specially crafted application to gain SYSTEM-level privileges and fully compromise the host

[Mitigation] Immediately apply the official Microsoft security patch (MS14-058) and restrict local execution privileges on unpatched systems

[Affected Scope] Active Directory environments running Windows Vista SP2, 7 SP1, 8, 8.1, and Windows Server 2008 SP2/R2 SP1, 2012 Gold/R2 domain controllers and client systems

[Impact] Remote authenticated domain users can access the SYSVOL share, retrieve encrypted GPP XML files, and decrypt them using a publicly known AES key to obtain domain administrator credentials

[Mitigation] Apply the MS14-025 cumulative security update and permanently delete existing XML configuration files containing the 'cpassword' attribute from the SYSVOL share

[Affected Scope] Microsoft.XMLDOM ActiveX control and Internet Explorer on Microsoft Windows 8.1 and earlier

[Impact] Remote attackers can determine the existence of local pathnames, UNC shares, intranet hostnames, and IP addresses via error code analysis

[Mitigation] Apply the MS14-052 cumulative security update or restrict ActiveX execution in Internet Explorer

[Affected Scope] All currently supported versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server

[Impact] Attackers can inject malicious code into the unverified padding areas of signed PE files without invalidating the digital signature, bypassing security controls to execute arbitrary code

[Mitigation] Enable the 'EnableCertPaddingCheck' registry setting to enforce strict Authenticode signature verification across all endpoints

[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry

[Affected Scope] Windows Vista SP2, Server 2008 SP2, Office 2003/2007/2010, Lync 2010/2013

[Impact] Remote attackers can execute arbitrary code via a specially crafted TIFF image embedded in documents or emails

[Mitigation] Apply the MS13-096 security patch or implement registry workarounds to disable TIFF rendering in GDI+

[Affected Scope] Legacy Windows operating systems including Windows XP, Vista, 7, 8, and Windows Server 2003, 2008, 2012 utilizing the win32k.sys driver.

[Impact] Local attackers can trigger kernel memory corruption to execute arbitrary code with SYSTEM privileges, leading to complete host compromise.

[Mitigation] Immediately apply Microsoft official security patches (MS13-053 or later) and migrate end-of-life (EOL) operating systems to modern supported platforms.

[Affected Scope] Windows XP, Vista, 7, 8 Consumer Preview, and Windows Server 2003, 2008, 2008 R2

[Impact] Attackers can bypass Authenticode signature verification to execute arbitrary code via modified PE files containing malicious payloads that do not invalidate the digital signature

[Mitigation] Apply the official Microsoft MS12-024 security patch immediately and enforce strict software restriction policies

[Affected Scope] Windows XP, Vista, 7, and Windows Server 2003, 2008 kernel-mode drivers (win32k.sys)

[Impact] Remote code execution (RCE) with kernel-level privileges via crafted TrueType font data in Word documents or web pages

[Mitigation] Apply official MS11-087 security patches or implement the T2EMBED.DLL registry/ACL workaround

[Affected Scope] Microsoft Windows XP SP2/SP3 and Windows Server 2003 SP2.

[Impact] Local attackers can execute arbitrary code in kernel mode and gain elevated SYSTEM privileges via a crafted application.

[Mitigation] Apply the official Microsoft MS11-080 security patch, or restrict local execution privileges and isolate legacy systems.

[Affected Scope] Windows XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7

[Impact] Local attackers can exploit this to bypass User Account Control (UAC) and execute arbitrary code with SYSTEM privileges

[Mitigation] Apply the official Microsoft security update (MS11-011) and restrict write access to registry keys associated with system fonts

[Affected Scope] Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 SP2/R2, and Windows 7

[Impact] Local or remote attackers can execute arbitrary code with system privileges simply by tricking a user into viewing a folder containing a crafted .LNK or .PIF file

[Mitigation] Apply the official Microsoft MS10-046 security patch immediately, or implement workarounds to disable shortcut icon rendering and block outbound SMB/WebDAV traffic

[Affected Scope] Windows NT 3.1 through Windows 7, and Windows Server 2008 on 32-bit (x86) platforms with 16-bit application support (NTVDM) enabled.

[Impact] Local attackers can exploit this vulnerability to bypass kernel-mode security boundaries, execute arbitrary code with SYSTEM privileges, and fully compromise the host.

[Mitigation] Apply the official Microsoft MS10-015 security update, or disable the 16-bit application subsystem (NTVDM) via Group Policy or Registry modifications.

[Affected Scope] Systems running Microsoft Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista, and Server 2008 utilizing the MPEG2TuneRequest ActiveX control (msvidctl.dll)

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft security updates (MS09-037) or configure the ActiveX Kill Bit in the Windows Registry to disable the vulnerable control

[Affected Scope] Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista Gold/SP1/SP2, and Server 2008 SP2

[Impact] Local attackers can execute arbitrary code in kernel mode via a crafted application, gaining complete control over the affected system

[Mitigation] Immediately apply the Microsoft MS09-025 security update and restrict local interactive logon privileges on legacy systems

[Affected Scope] DirectShow (quartz.dll) in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2/SP3, and Windows Server 2003 SP2

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a specially crafted QuickTime media file

[Mitigation] Apply the official Microsoft security updates (MS09-028) or disable the QuickTime Movie Parser Filter via registry modification (Kill-bit)

[Affected Scope] Microsoft Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7 Pre-Beta

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges and gain full control of the target system via crafted RPC requests

[Mitigation] Apply the official Microsoft security patch (MS08-067) immediately and restrict external access to SMB ports (TCP 139/445)