Microsoft Windows Rt vulnerabilities

216 CVEs affecting Microsoft Windows Rt, 13 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-3237, published 2016-08-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability, published 2014-11-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 94.9% chance of exploitation in the next 30 days. OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT…
CVE-2014-4113: Microsoft Win32k Privilege Escalation Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-04. EPSS: 86.9% chance of exploitation in the next 30 days. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
CVE-2015-2426: Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability, published 2015-07-20. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 86.6% chance of exploitation in the next 30 days. Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012…
CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 81.6% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute…
CVE-2014-6352: Microsoft Windows Code Injection Vulnerability, published 2014-10-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-25. EPSS: 77.5% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute…
CVE-2015-0016: Microsoft Windows TS WebProxy Directory Traversal Vulnerability, published 2015-01-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 75.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012…
CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability, published 2013-11-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 73.7% chance of exploitation in the next 30 days. The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7…
CVE-2014-4148: Microsoft Windows Remote Code Execution Vulnerability, published 2014-10-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 59.9% chance of exploitation in the next 30 days. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
CVE-2013-3660: Microsoft Win32k Privilege Escalation Vulnerability, published 2013-05-24. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 39.3% chance of exploitation in the next 30 days. The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,…
CVE-2015-2387: Microsoft ATM Font Driver Privilege Escalation Vulnerability, published 2015-07-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 34.9% chance of exploitation in the next 30 days. ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012…

Latest

CVE-2016-3237, published 2016-08-09. High severity, CVSS 7.5. EPSS: 17.2% chance of exploitation in the next 30 days. Kerberos in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows…
CVE-2016-0016, published 2016-01-13. High severity, CVSS 7.8. EPSS: 29.7% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511…
CVE-2016-0014, published 2016-01-13. High severity, CVSS 7.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511…
CVE-2016-0008, published 2016-01-13. Medium severity, CVSS 4.3. EPSS: 13.8% chance of exploitation in the next 30 days. The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1…
CVE-2016-0007, published 2016-01-13. High severity, CVSS 7.8. EPSS: 5.2% chance of exploitation in the next 30 days. The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and…
CVE-2016-0006, published 2016-01-13. High severity, CVSS 7.3. EPSS: 4% chance of exploitation in the next 30 days. The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and…
CVE-2015-6174, published 2015-12-09. High severity, CVSS 7.2. EPSS: 3.1% chance of exploitation in the next 30 days. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and…
CVE-2015-6173, published 2015-12-09. High severity, CVSS 7.2. EPSS: 3.1% chance of exploitation in the next 30 days. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and…
CVE-2015-6171, published 2015-12-09. High severity, CVSS 7.2. EPSS: 3.3% chance of exploitation in the next 30 days. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and…
CVE-2015-6133, published 2015-12-09. High severity, CVSS 7.2. EPSS: 66.6% chance of exploitation in the next 30 days. Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a…