Microsoft’s advisory for a newly referenced HTTP.sys vulnerability describes an out‑of‑bounds read in the Windows HTTP protocol stack that can be triggered remotely against Internet Information Services (IIS) and other HTTP.sys consumers, allowing an unauthenticated attacker to cause a...
Microsoft’s security advisory for CVE-2025-54919 describes a race‑condition flaw in the Windows Win32K graphics subsystem (GRFX) that can be abused by an authenticated local user to execute code in a privileged context; defenders should treat affected hosts as high priority for immediate...
Microsoft has confirmed CVE-2025-53132 — a race‑condition elevation‑of‑privilege vulnerability in the Windows Win32k – GRFX component — and administrators must treat affected hosts as high‑priority patch targets while applying layered mitigations to reduce immediate risk. (msrc.microsoft.com)...