What is the CVSS score of CVE-2026-21245?

CVE-2026-21245 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-21245?

A high-severity vulnerability in the Windows Kernel allows authenticated users to gain elevated system privileges, potentially enabling attackers to access sensitive data, deploy malware, or disrupt…. A patch is available.

How to fix or mitigate CVE-2026-21245?

Within 24 hours: Inventory all Windows systems and identify those with high-value assets or sensitive data access; disable unnecessary local admin accounts and review privileged access policies. Within 7 days: Implement enhanced monitoring for privilege escalation attempts and restrict user-to-admin elevation capabilities where operationally feasible; segment critical systems on isolated networks. Within 30 days: Establish daily patch tracking for vendor updates; develop and test an emergency patching process for when the fix becomes available; conduct security awareness training on social engineering that could lead to authorized account compromise.

Windows CVE-2026-21245

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-10 secure@microsoft.com

Windows Buffer Overflow Linux Heap Overflow Microsoft Windows 11 24h2 Windows 11 25h2 Windows Server 2025

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

AnalysisAI

Windows Kernel heap overflow in Windows 11 25h2 and Windows Server 2025 enables authenticated local attackers to achieve privilege escalation with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user privileges but no user interaction, making it a practical attack vector for lateral movement within systems. No patch is currently available, leaving affected systems exposed until remediation is released.

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Affects Windows 11 24H2. Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.