What is the CVSS score of CVE-2026-34341?

CVE-2026-34341 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Windows are affected by CVE-2026-34341?

Microsoft's Windows LLDP component contains a local privilege escalation vulnerability (CVE-2026-34341) requiring prior user authentication, affecting Windows client and server systems across the…. A patch is available.

How to fix or mitigate CVE-2026-34341?

Within 24 hours: identify all Windows systems in your environment and verify Microsoft's July 2026 servicing updates are available through your patch management channels; confirm that non-administrative users cannot exploit the LLDP component prior to patching. Within 7 days: deploy the vendor patch to all Windows servers and critical workstations using standard patch management tools or Group Policy; prioritize systems where standard users have active sessions. Within 30 days: complete patch deployment across the entire Windows client and server estate; validate completion through vulnerability scanning and patch compliance reporting to confirm CVSS 7.0 vulnerability is remediated.

Microsoft Windows CVE-2026-34341

EUVD-2026-29600 HIGH

Double Free (CWE-415)

2026-05-12 microsoft

GHSA-fp65-fgm7-x5xc

Information Disclosure Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 22H3 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

vuln.today AI

7.0 HIGH

Local low-privileged user triggers a heap double-free race (AV:L, PR:L, AC:H) with no scope change, yielding full SYSTEM compromise (C:H/I:H/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:22 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.0

DescriptionCVE.org

Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.

Technical ContextAI

LLDP is a vendor-neutral Layer 2 protocol (IEEE 802.1AB) that Windows uses to advertise and discover device identity and capabilities on the local network segment. The root cause is CWE-415 (Double Free): the same heap allocation is released twice, corrupting heap metadata and enabling an attacker to manipulate allocator state to achieve controlled memory writes and ultimately code execution in a higher-privileged context. Per the CPE and EUVD data, the vulnerable code is present across the Windows kernel/networking stack shipped in Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025), indicating a shared component rather than an edition-specific bug.

RemediationAI

Vendor-released patch: apply the Microsoft July 2026 cumulative/security update that raises the OS build to at or above the fixed version for your edition (e.g., Windows 11 24H2 to 10.0.26100.8457, Windows Server 2022 to 10.0.20348.5139, Windows Server 2025 to 10.0.26100.32860, Windows 10 22H2 to 10.0.19045.7291), as detailed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34341. Because the flaw resides in the LLDP component and requires local low-privileged access, interim compensating controls where immediate patching is not possible include restricting interactive and remote-interactive logon rights so untrusted users cannot obtain the local foothold this exploit needs, and - where LLDP is not operationally required - disabling the Microsoft LLDP protocol driver binding (MS_LLDP) on network adapters via 'Disable-NetAdapterBinding -ComponentID ms_lldp'; note the trade-off that disabling LLDP removes Layer 2 topology/neighbor discovery, which can affect network management, VoIP/switch integration, and inventory tooling. Prioritize patching servers with multiple interactive users and shared/RDP hosts first.