EUVD-2026-29587
GHSA-4mq6-f26v-8f5g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Server 2022 allows authenticated local attackers to gain SYSTEM-level privileges through heap corruption. Microsoft has released patches addressing this CWE-122 heap-based buffer overflow. EPSS data not available for risk quantification, and no CISA KEV listing indicates exploitation has not been publicly confirmed, though the vulnerability's low attack complexity (AC:L) and minimal prerequisites (PR:L) make it attractive for post-compromise privilege escalation in targeted attacks.
Technical ContextAI
This vulnerability involves a CWE-122 heap-based buffer overflow in the Windows Kernel, the core privileged component managing system resources, memory, and hardware abstraction. Heap overflows occur when data writes exceed allocated heap memory boundaries, potentially corrupting adjacent memory structures. In kernel space, such corruption can overwrite critical data structures like function pointers, security tokens, or process privilege levels. The affected CPE strings identify Windows 10 (21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2022 (including Server Core installations) as vulnerable. The local attack vector (AV:L) indicates the flaw requires code execution on the target system, typically exploited through kernel API calls or system calls that trigger the heap overflow condition in kernel memory management routines.
RemediationAI
Apply the vendor-released patches available through Microsoft Update or the Microsoft Update Catalog as documented in https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33841, prioritizing systems with multiple local users, those accessible via remote desktop services, or servers hosting sensitive workloads. For systems where patching must be delayed, implement compensating controls including restricting local logon rights to only essential administrative users (reducing PR:L attack surface), enabling and monitoring Windows Defender Application Control or AppLocker to prevent unauthorized code execution that could trigger the heap overflow, and deploying endpoint detection and response (EDR) solutions configured to alert on anomalous kernel-mode operations or privilege escalation attempts. Note that these mitigations do not eliminate the vulnerability but raise the bar for exploitation; performance impact of application control policies should be tested in non-production environments before broad deployment.
More in Windows 10 Version 21H2
View allLocal privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Win32K kernel subsystem (CWE-122 heap-based buffer overflow) lets an already-a
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and s
Elevation of privilege in the Windows NTFS file-system driver lets an already-authenticated local user escalate to SYSTE
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in the Windows Server Network driver stems from a race condition (CWE-362) that lets an unauthoriz
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary co
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today