Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

The remote Windows host is missing security update 5071507. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to     elevate privileges locally. (CVE-2025-62466)

  - Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to     elevate privileges locally. (CVE-2025-62470)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071543. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

  - Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to     elevate privileges locally. (CVE-2025-62466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071503. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

  - Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to     elevate privileges locally. (CVE-2025-62466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071546. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071544. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071506. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

  - Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to     elevate privileges locally. (CVE-2025-62466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071505. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

  - Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to     elevate privileges locally. (CVE-2025-62466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
278000	KB5071507: Windows Server 2008 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277997	KB5071543: Windows 10 Version 1607 / Windows Server 2016 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277995	KB5071503: Windows Server 2012 R2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277988	KB5071546: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277987	KB5071544: Windows 10 version 1809 / Windows Server 2019 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277984	KB5071506: Windows Server 2008 R2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277983	KB5071505: Windows Server 2012 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2025-62455

high

Tenable Plugins

high

high

high

high

high

high

high