Security Warnings — Week: 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21266

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21273

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21282

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21286

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21302

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21303

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21305

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21306

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21339

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21409

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21411

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21413

highMicrosoft MSRC 2026-W14

Windows Telephony Service Remote Code Execution Vulnerability

2026-04-01 CVE-2025-21417

highMicrosoft MSRC 2026-W14

Windows Text Services Framework Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-21417

highMicrosoft MSRC 2026-W14

Windows Themes Spoofing Vulnerability

2026-04-01 CVE-2024-38030

mediumMicrosoft MSRC 2026-W14

Windows Themes Spoofing Vulnerability

2026-04-01 CVE-2025-21308

mediumMicrosoft MSRC 2026-W14

Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability

2026-04-01 CVE-2025-21300

highMicrosoft MSRC 2026-W14

Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability

2026-04-01 CVE-2025-21389

highMicrosoft MSRC 2026-W14

Windows Virtual Trusted Platform Module Denial of Service Vulnerability

2026-04-01 CVE-2025-21280

mediumMicrosoft MSRC 2026-W14

Windows Virtual Trusted Platform Module Denial of Service Vulnerability

2026-04-01 CVE-2025-21284

mediumMicrosoft MSRC 2026-W14

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

2026-04-01 CVE-2025-21370

highMicrosoft MSRC 2026-W14

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

2026-04-01 CVE-2025-21340

mediumMicrosoft MSRC 2026-W14

Windows Web Threat Defense User Service Information Disclosure Vulnerability

2026-04-01 CVE-2025-21343

highMicrosoft MSRC 2026-W14

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-30049

highMicrosoft MSRC 2026-W14

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38252

highMicrosoft MSRC 2026-W14

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38253

highMicrosoft MSRC 2026-W14

Windows Win32k Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38066

highMicrosoft MSRC 2026-W14

Windows WLAN AutoConfig Service Information Disclosure Vulnerability

2026-04-01 CVE-2025-21257

mediumMicrosoft MSRC 2026-W14

Windows Workstation Service Elevation of Privilege Vulnerability

2026-04-01 CVE-2024-38050

highMicrosoft MSRC 2026-W14

wireguard: netlink: access device through ctx instead of peer

2026-04-01 CVE-2024-26950

mediumMicrosoft MSRC 2026-W14

x86/coco: Require seeding RNG with RDRAND on CoCo systems

2026-04-01 CVE-2024-35875

mediumMicrosoft MSRC 2026-W14

x86/efistub: Call mixed mode boot services on the firmware's stack

2026-04-01 CVE-2024-35803

mediumMicrosoft MSRC 2026-W14

Xbox Wireless Adapter Remote Code Execution Vulnerability

2026-04-01 CVE-2024-38078

highMicrosoft MSRC 2026-W14

xdp: Remove WARN() from __xdp_reg_mem_model()

2026-04-01 CVE-2024-42082

mediumMicrosoft MSRC 2026-W14

xen-netfront: Add missing skb_mark_for_recycle

2026-04-01 CVE-2024-27393

mediumMicrosoft MSRC 2026-W14

xen: privcmd: Fix possible access to a freed kirqfd instance

2026-04-01 CVE-2024-46762

mediumMicrosoft MSRC 2026-W14

xfs: don't walk off the end of a directory data block

2026-04-01 CVE-2024-41013

highMicrosoft MSRC 2026-W14

xfs: fix log recovery buffer allocation for the legacy h_size fixup

2026-04-01 CVE-2024-39472

mediumMicrosoft MSRC 2026-W14

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

2026-04-01 CVE-2022-49043

highMicrosoft MSRC 2026-W14

XSS in Bootstrap button component

2026-04-01 CVE-2024-6485

mediumMicrosoft MSRC 2026-W14

xz: Schwachstelle ermöglicht Codeausführung

2026-04-01 WID-SEC-2026-0942

highBSI 2026-W14

ZScaler Client Connector: Schwachstelle ermöglicht Manipulation von Daten

2026-04-01 WID-SEC-2026-0938

mediumBSI 2026-W14

__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

2026-03-31 CVE-2025-38058

lowMicrosoft MSRC 2026-W14

.NET and Visual Studio Remote Code Execution Vulnerability

2026-03-31 CVE-2025-30399

highMicrosoft MSRC 2026-W14

.NET Elevation of Privilege Vulnerability

2026-03-31 CVE-2025-55247

highMicrosoft MSRC 2026-W14

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

2026-03-31 CVE-2025-55248

mediumMicrosoft MSRC 2026-W14

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

2026-03-31 CVE-2025-26646

highMicrosoft MSRC 2026-W14

<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore

2026-03-31 CVE-2025-23167

mediumMicrosoft MSRC 2026-W14

9p/net: fix improper handling of bogus negative read/write replies

2026-03-31 CVE-2025-37879

highMicrosoft MSRC 2026-W14

accel/ivpu: Fix locking order in ivpu_job_submit

2026-03-31 CVE-2025-37907

mediumMicrosoft MSRC 2026-W14

Active Directory Certificate Services (AD CS) Denial of Service Vulnerability

2026-03-31 CVE-2025-29968

mediumMicrosoft MSRC 2026-W14

AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)

2026-03-31 CVE-2025-48060

highMicrosoft MSRC 2026-W14

ALPN negotiation error contains attacker controlled information in crypto/tls

2026-03-31 CVE-2025-58189

highMicrosoft MSRC 2026-W14

ALSA: hda: Fix missing pointer check in hda_component_manager_init function

2026-03-31 CVE-2025-40097

mediumMicrosoft MSRC 2026-W14

ALSA: pcm: Fix race of buffer access at PCM OSS layer

2026-03-31 CVE-2025-38078

highMicrosoft MSRC 2026-W14

ALSA: ump: Fix buffer overflow at UMP SysEx message conversion

2026-03-31 CVE-2025-37891

mediumMicrosoft MSRC 2026-W14

ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card

2026-03-31 CVE-2025-40085

mediumMicrosoft MSRC 2026-W14

AMD CVE-2025-0033: RMP Corruption During SNP Initialization

2026-03-31 CVE-2025-0033

highMicrosoft MSRC 2026-W14

Apache Airflow: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

2026-03-31 WID-SEC-2026-0916

mediumBSI 2026-W14

Arbitrary writes via tarfile realpath overflow

2026-03-31 CVE-2025-4517

criticalMicrosoft MSRC 2026-W14