Microsoft windows 10 version 1809, out-of-bounds write: 10 records, one defect family
Microsoft windows 10 version 1809 has been reported 10 separate times for the same kind of mistake, CWE-787, between 2021-02-25 and 2022-09-13. A defect family is our own grouping of the CVE corpus: every record naming one product and one weakness class, collected so a repeat is visible as a repeat. No public source publishes this, and what this page counts is how often this one product has gone wrong in this one way.
What this page is, and what it is not
The records are public. This grouping is not. No source publishes defect families, so we built them: every record in the corpus sorted by the product an authority named and the weakness class carried with it, 21316 families over 105586 records. This one holds every record that names Microsoft windows 10 version 1809 and carries CWE-787, matched character for character. We show the join because a grouping you cannot check is a grouping you should not cite.
One record is an incident. 10 filings, between 2021-02-25 and 2022-09-13, all landing on the same weakness class in the same product, is a habit in what gets reported here, and a habit is something you can plan around. This is what we held on 2026-09-20.
A repeat is evidence about where to look. If you are reviewing Microsoft windows 10 version 1809, the records below say which mistake has already been found more than once, which is the cheapest place a reviewer can start. If you are asking the vendor a question, a count under one weakness class is a better question than any single record is.
What this page cannot tell you is decided by what was joined. A product name and a weakness class settled membership, so those two values are the whole of what the page asserts. Records here may sit in the same line of code or in unrelated parts of the product, and we hold no value that separates those cases. A fixed version named in one record closes that record and says nothing about the others. And nothing here describes anyone's systems, because no value in this family connects a product name to an installation.
The names the authorities used
One spelling, used by every authority that filed one of these records: microsoft windows 10 version 1809.
Family membership: held values. Joined on the product and weakness class the assigning authorities wrote, with no model involved.
What the records offer
8 of 10 records publish a fixed version. For the other 2, held sources name none.
4 records are listed by CISA with a required action, which carries a federal remediation deadline on its own page.
The earliest was published 2021-02-25 and the latest 2022-09-13. That span is how long this product kept producing this weakness, not how long any one record took to fix.
What this family was researched, not held
Caught in the wild first: MSHTML, then Win32k, then the log driver
These records are memory corruption in different parts of the same operating system, grouped because they write past the end of a buffer and because they all name this build. Several were caught in use before they were fixed. Google's Project Zero records CVE-2021-33742 as an out of bounds write in the MSHTML component of Internet Explorer, found by Clement Lecigne of Google's Threat Analysis Group, patched on June 8, 2021, and delivered through Office documents that loaded web content in Internet Explorer. CVE-2022-21882 in Win32k exists because an earlier fix was incomplete: Unit 42 states that the patch for CVE-2021-1732 was not sufficient to prevent it, and that both overwrite the same window structure field to obtain an arbitrary write. The log file driver then produced two in the same year. Project Zero records CVE-2022-24521 as reported by the National Security Agency with researchers at CrowdStrike and patched on April 12, 2022, and Zscaler says it captured CVE-2022-37969 in the wild on September 2, 2022, tracing it to a missing bounds check in the driver that produces an out of bounds write at an arbitrary address.
What the recurrence shows is that a component can come back after a fix, and that these components are ordinary parts of a desktop install: a logging driver, the window manager, a browser engine. CISA marks the two log driver entries as used in known ransomware campaigns and its required action for each is to apply vendor updates. Patch state per record is the thing to check; the grouping is a reading aid.
This note says the records read alike and nothing more. It does not say they are one vulnerability, that they describe the same machines, or that the update for one of them addresses any other.
Written from googleprojectzero.github.io, googleprojectzero.github.io, unit42.paloaltonetworks.com, zscaler.com, cisa.gov. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.
What this page does not cover
This is a family of records that read alike. It is not a shared vulnerability, not an inventory, and not a statement that one fix closes the rest. Each record's own state, its own dates and its own receipts are on its own page.
Grouped by shared product and weakness, not by shared vulnerability. Each record's own state is on its own page.
Everything this vendor has, including records outside this family:
10 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.