What is the CVSS score of CVE-2026-21239?

CVE-2026-21239 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-21239?

A critical Windows Kernel vulnerability (CVE-2026-21239) allows authorized users with local system access to escalate their privileges to administrator level, potentially enabling lateral movement,…. A patch is available.

How to fix or mitigate CVE-2026-21239?

Within 24 hours: Inventory all Windows systems running affected kernel versions and assess exposure scope; initiate incident response protocol and establish monitoring for exploitation attempts. Within 7 days: Implement access controls limiting local system access, disable unnecessary user privileges, and deploy endpoint detection tools to monitor for suspicious privilege escalation activity. Within 30 days: Develop and test a Windows kernel update strategy for rapid deployment once a patch becomes available; consider prioritizing critical business systems for early remediation and evaluate architectural changes to limit local access vectors.

Windows CVE-2026-21239

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-10 secure@microsoft.com

Linux Windows Buffer Overflow Heap Overflow Windows 10 21h2 Windows Server 2016 Windows 10 1809 Windows Server 2025 Windows 11 25h2 Windows Server 2022 23h2 Windows Server 2019 Windows 11 24h2 Windows 10 22h2 Windows Server 2022 Windows 10 1607 Windows Server 2012 Windows 11 23h2 Microsoft

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation via heap buffer overflow in Windows Kernel (Windows 10 21H2, Windows Server 2016) allows authenticated local users to gain elevated system privileges. The vulnerability requires local access and user-level permissions, making it exploitable by authorized account holders to bypass security boundaries. No patch is currently available for this issue.

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Affects Windows 10 1607. Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.