Skip to content

Microsoft · weakness class

Denial of Service

588 CVEs · 7 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

exploited in the wild
7
likely to be exploited
295

Every one of the 588 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability."…CVE-2018-8120Microsoft · CVSS 7 · 73% likely

    CWE-404

  2. Microsoft Defender Denial of Service VulnerabilityCVE-2026-45498Microsoft · CVSS 4 · 63% likelycovered by CyberSIXT

    CWE-400

  3. An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability."…CVE-2018-8639Microsoft · CVSS 8.4 · 22% likely

    CWE-404

  4. .NET and Visual Studio Denial of Service VulnerabilityCVE-2023-38180Microsoft · CVSS 7.5 · 14% likely

    CWE-400

  5. An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This…CVE-2018-8611Microsoft · CVSS 7.8 · 4.2% likely

    CWE-404

  6. An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Pr…CVE-2018-8406Microsoft · CVSS 7.8 · 3.4% likely

    CWE-404

  7. An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Pr…CVE-2018-8405Microsoft · CVSS 7.8 · 3.4% likely

    CWE-404

  8. Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote…CVE-2009-3103Microsoft · 92% likely

    CWE-399

  9. Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTM…CVE-2009-0075Microsoft · 85% likely

    CWE-399

  10. Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code vi…CVE-2005-1790Microsoft · 83% likely

    CWE-399

  11. Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service…CVE-2009-2521Microsoft · 82% likely

    CWE-400

  12. Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of servic…CVE-2009-2526Microsoft · 82% likely

    CWE-399

  13. Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8…CVE-2010-3971Microsoft · 82% likely

    CWE-399

  14. Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via…CVE-2015-0015Microsoft · 79% likely

    CWE-399

  15. The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP serv…CVE-2003-0714Microsoft · 78% likely

    CWE-400

  16. dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1) multiple Connection…CVE-2008-0927Microsoft · 70% likely

    CWE-399

  17. Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityCVE-2023-36606Microsoft · CVSS 7.5 · 69% likely

    CWE-400

  18. Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE…CVE-2008-5180Microsoft · CVSS 5.3 · 68% likely

    CWE-770

  19. The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) fi…CVE-2005-0803Microsoft · 68% likely

    CWE-399

  20. Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to e…CVE-2008-4844Microsoft · 67% likely

    CWE-399

  21. The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via crafted…CVE-2010-0242Microsoft · 66% likely

    CWE-399

  22. DHCP Server Service Denial of Service VulnerabilityCVE-2024-26212Microsoft · CVSS 7.5 · 63% likely

    CWE-400

  23. Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (applicatio…CVE-2005-2087Microsoft · 61% likely

    CWE-399

  24. Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause…CVE-2006-1364Microsoft · 59% likely

    CWE-400

  25. The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0…CVE-2011-3414Microsoft · 58% likely

    CWE-399

  26. HTTP.sys Denial of Service VulnerabilityCVE-2026-49160Microsoft · CVSS 7.5 · 57% likelycovered by CyberSIXT

    CWE-405

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.