Microsoft Windows Vista vulnerabilities

827 CVEs affecting Microsoft Windows Vista, 38 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-5364, published 2020-02-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-0147: Microsoft Windows SMBv1 Information Disclosure Vulnerability, published 2017-03-17. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 99.7% chance of exploitation in the next 30 days. The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;…
CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability, published 2017-04-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.5% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote…
CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability, published 2008-10-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 98.8% chance of exploitation in the next 30 days. The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a…
CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability, published 2014-11-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 94.9% chance of exploitation in the next 30 days. OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT…
CVE-2010-2568: Microsoft Windows Remote Code Execution Vulnerability, published 2010-07-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-09-15. EPSS: 91.3% chance of exploitation in the next 30 days. Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1)…
CVE-2012-0151: Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability, published 2012-04-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 87.7% chance of exploitation in the next 30 days. The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and…
CVE-2014-4113: Microsoft Win32k Privilege Escalation Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-04. EPSS: 86.9% chance of exploitation in the next 30 days. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
CVE-2015-2426: Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability, published 2015-07-20. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 86.6% chance of exploitation in the next 30 days. Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012…
CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability, published 2013-11-06. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 84.9% chance of exploitation in the next 30 days. GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows…
CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 81.6% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute…

Latest

CVE-2012-5364, published 2020-02-20. High severity, CVSS 7.5. EPSS: 14.5% chance of exploitation in the next 30 days. The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
CVE-2012-5362, published 2020-02-20. High severity, CVSS 7.5. EPSS: 14.5% chance of exploitation in the next 30 days. The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than…
CVE-2018-7250, published 2018-02-26. Medium severity, CVSS 5.5. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel…
CVE-2018-7249, published 2018-02-26. High severity, CVSS 7.0. EPSS: 1.5% chance of exploitation in the next 30 days. An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls…
CVE-2017-0192, published 2017-04-12. Medium severity, CVSS 4.3. EPSS: 6% chance of exploitation in the next 30 days. The Adobe Type Manager Font Driver (ATMFD.dll) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and…
CVE-2017-0166, published 2017-04-12. High severity, CVSS 8.1. EPSS: 6.4% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows when LDAP request buffer lengths are improperly calculated. In a remote attack scenario, an attacker could exploit this vulnerability by…
CVE-2017-0158, published 2017-04-12. High severity, CVSS 7.5. EPSS: 12.8% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1 Windows RT 8.1, and Windows Server 2012 R2 fails to properly sanitize handles…
CVE-2017-0155, published 2017-04-12. High severity, CVSS 7.0. EPSS: 2.1% chance of exploitation in the next 30 days. The Graphics component in the kernel in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka…
CVE-2017-0058, published 2017-04-12. Medium severity, CVSS 4.7. EPSS: 3.7% chance of exploitation in the next 30 days. A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability…