EUVD-2026-29592
GHSA-qj47-r3gf-wx2h
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Vendor asserts network-triggered code execution requiring a low-privileged account (PR:L) and victim interaction (UI:R); kernel-mode code execution yields total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Server 2025 kernel-mode drivers lets an authenticated attacker corrupt kernel memory via a use-after-free and run code with full system-level impact. Exploitation requires low-level privileges plus user interaction, and Microsoft has released a fix. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.06%).
Technical ContextAI
The flaw is a CWE-416 use-after-free in Windows kernel-mode drivers - the ring-0 components (win32k/graphics/filesystem/IO driver stack) that run inside the Windows NT kernel. A use-after-free occurs when a driver frees a kernel object but retains and later dereferences a dangling pointer to it; an attacker who can control the reallocation of that freed memory can redirect execution or corrupt privileged structures, yielding code execution in kernel context. Per the CPE data, the affected component ships in Windows Server 2025 (cpe:2.3:a:microsoft:windows_server_2025) including the Server Core installation, meaning both full-GUI and headless deployments are in scope.
RemediationAI
Vendor-released patch: Windows Server 2025 build 10.0.26100.32860 - apply the Microsoft cumulative update that raises the build to 10.0.26100.32860 or later, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34332, on both full and Server Core installations. Because the vulnerability is in kernel-mode drivers, there is no reliable in-product configuration workaround; if patching must be deferred, reduce exposure by limiting interactive and privileged logon rights on affected servers (exploitation needs PR:L plus user interaction), restricting who can run untrusted content or applications on the host, and enforcing least privilege so fewer accounts meet the PR:L precondition - with the trade-off that these controls reduce but do not eliminate risk and may impact legitimate administrative workflows. Prioritize patching over mitigation given a fix is already available.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today