EUVD-2026-100326
GHSA-vrjv-xmc7-wf6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitTrigger untrusted pointer dereference in Sysinternals tool
-
ImpactElevate to higher privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Requires the attacker to already hold a low-privileged authenticated local session (PR:L, AV:L) on a Windows system where an affected Microsoft Sysinternals utility is present and can be executed, then invoke the vulnerable code path that dereferences an attacker-influenced (untrusted) pointer per CWE-822. Exploitation is LIMITED by the need for prior local access and valid credentials - there is no remote vector (AV:L) and no network exposure; however, no user interaction is required (UI:N) and attack complexity is low (AC:L). The description does not name a specific feature, protocol, or non-default configuration toggle, so the primary gating factor is possession of an existing foothold plus presence of the affected tool rather than a special configuration mode. |
| Impact | The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1) describes a local privilege-escalation flaw requiring an authenticated low-privileged user - not a remotely reachable issue, so mass exploitation is not a factor. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation signals are entirely absent: this is 'no public exploit identified at time of analysis.' The high Integrity and Availability impacts (I:H/A:H) with no Confidentiality impact (C:N) are consistent with a privilege-escalation/untrusted-pointer-dereference (CWE-822) outcome rather than data theft. Notably, the supplied Tag 'Information Disclosure' conflicts with both the description ('elevate privileges') and the vector's C:N - treat that label as suspect. Overall this is a moderate-priority, local-only EoP: valuable to an attacker who already has a foothold (e.g., to escape a low-privilege account), but not a drive-by or wormable threat. Absence of EPSS/KEV/POC is not evidence of safety, merely of no observed weaponization in the provided sources. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated session on a Windows host where a vulnerable Sysinternals utility is present triggers an untrusted pointer dereference in the tool to corrupt execution flow and run code at a higher privilege level. Because the CVSS vector is AV:L/PR:L, the attacker needs an existing local foothold rather than network access, and no user interaction is required. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in Microsoft Sysinternals utilities allows an authenticated low-privileged user to trigger an untrusted pointer dereference (CWE-822) and have the affected tool operate with higher integrity than the caller, yielding high integrity and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Only Windows systems where an affected Sysinternals utility is present and executable by the attacker are exposed; because the vector is local (AV:L) with PR:L, the attacker must already hold a valid low-privileged local session, which limits mass or remote exploitation. No public exploit code or confirmed active exploitation is identified at time of analysis - no CISA KEV entry and no proof-of-concept were provided - and no EPSS score was supplied, so the practical risk is post-compromise escalation rather than initial access.
RemediationAI
Primary fix: apply the Microsoft security update published for this CVE, using the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105729 as the authoritative source for the fixed Sysinternals build; no exact fix version string is provided in the available data, so treat the advisory as the version reference rather than assuming a generic Windows patch level covers it, and re-download the Sysinternals binaries from the official Microsoft source after patching. Because Sysinternals is often a standalone suite rather than a serviced Windows component, verify remediation by replacing every copy on disk - including copies that were extracted into user-writable paths, copied for incident response, or bundled inside third-party tools - since a single stale binary preserves the escalation path. Compensating controls, with trade-offs: restrict execution of Sysinternals binaries to administrative accounts and trusted locations via AppLocker or WDAC rules (side effect: can break legitimate admin and incident-response tooling, so pair with an allowlisted admin-only path); remove unneeded Sysinternals utilities and archive copies from ordinary user-accessible directories (side effect: administrators lose ad-hoc diagnostic tools and must keep a controlled, current copy elsewhere); and monitor for low-privileged processes spawning Sysinternals executables from user-writable or temp directories as a detection signal for exploitation attempts (side effect: high false-positive volume in environments where technicians run tools from downloads folders). Windows already requires no user interaction (UI:N) for exploitation, so user-awareness training is not an effective control here; the meaningful risk reduction is removing the attacker's ability to launch the affected binaries from a low-privileged context and closing the escalation window by updating all copies promptly.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-822, Untrusted Pointer Dereference: the vulnerable Sysinternals code path takes a pointer value that can be influenced by the local caller (for example, through arguments, environment, file/registry data, or shared memory consumed by the utility) and dereferences it without validating that it refers to a legitimate, trusted location, resulting in writes or reads to attacker-chosen memory. Sysinternals utilities are a signed, widely deployed Microsoft tool suite that administrators frequently run from elevated contexts, so a flaw that lets a low-privileged process influence memory reachable by the tool converts a limited foothold into elevated code execution and system integrity/availability damage. The vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms this is a local-only, low-complexity, no-user-interaction elevation-of-privilege primitive with no confidentiality impact and no scope change; the accompanying 'Information Disclosure' tag is inconsistent with the assessed vector, which reports C:N with I:H/A:H, and should be treated as a tagging artifact rather than a description of the impact. The advisory does not name the specific Sysinternals utility, feature, or version, and no CPE strings were supplied, so the exact affected binary and build must be resolved from the Microsoft advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local privilege escalation by an authenticated low-privileged user (AV:L, PR:L) with no UI; untrusted pointer dereference yields integrity/availability compromise but no data disclosure, hence C:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Sysinternals utilities, widely deployed on Windows endpoints for administrative troubleshooting, carry a high-severity local privilege escalation flaw (CVE-2026-105729) for which no vendor patch is currently available. Any user who already holds a valid low-privileged session on a machine where an affected utility is installed and executable could leverage it to gain elevated integrity, potentially compromising the confidentiality of nothing but the integrity and availability of that system. Leadership should care because this is a post-compromise escalation path: it does not grant attackers initial access, but it materially strengthens an intruder who is already inside, and Sysinternals is often installed by administrators and developers rather than as standard enterprise software, so exposure is uneven and hard to inventory.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or uninstall affected Sysinternals utilities from hosts that do not require them; block standard-user execution via AppLocker/WDAC or NTFS permissions; restrict the tools to dedicated administrative accounts and workstations; enforce least privilege to reduce the number of low-privileged local sessions on exposed machines; monitor for unexpected elevation or process creation involving Sysinternals binaries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB