EUVD-2026-29627
GHSA-g3c9-x495-5rjg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP requiring an existing low-privileged foothold (AV:L, PR:L), no user interaction, low complexity, yielding full kernel/SYSTEM control (C:H/I:H/A:H, scope unchanged).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Kernel affects a broad range of Windows Server releases (2012 through 2025, including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt kernel heap memory to gain SYSTEM-level privileges. Microsoft has released patches and rates it CVSS 7.8; there is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none but technical impact as total. EPSS is very low (0.04%, 13th percentile), consistent with the local-only attack vector that requires prior code execution on the host.
Technical ContextAI
The flaw resides in the Windows Kernel, the privileged core of the operating system that mediates memory management, process scheduling, and hardware access. CWE-122 (heap-based buffer overflow) indicates that a kernel routine writes more data into a dynamically allocated (heap) buffer than it was sized for, overwriting adjacent kernel heap structures such as object headers, pool metadata, or function pointers. Because the corruption occurs in kernel context (Scope: Unchanged, meaning the vulnerable and impacted components share the same kernel security authority), controlled overwrites can be leveraged to hijack execution or manipulate token/privilege structures and elevate to SYSTEM. The CPE data scopes the affected components strictly to Microsoft Windows Server SKUs: Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025, in both full and Server Core installation variants.
RemediationAI
Apply the Microsoft security update for your specific Windows Server build, which is the definitive fix: upgrade to at least 6.2.9200.26079 (Server 2012), 6.3.9600.23181 (Server 2012 R2), 10.0.14393.9140 (Server 2016), 10.0.17763.8755 (Server 2019), 10.0.20348.5139 (Server 2022), 10.0.25398.2330 (Server 2022 23H2 Server Core), or 10.0.26100.32860 (Server 2025), per Vendor-released patch guidance in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420. Because this is a local privilege-escalation bug with no remote or configuration-based trigger, there is no clean feature-level workaround; the practical compensating control until patching is to restrict interactive and local logon rights so untrusted users cannot execute code on affected servers - for example, limit RDP/terminal-services access, remove unnecessary local accounts, and enforce least privilege on shared or jump hosts. These controls reduce the pool of potential attackers but do not remediate the flaw, and overly aggressive logon restrictions can disrupt legitimate administrative or multi-user workflows, so patching should not be deferred.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today