EUVD-2026-29668
GHSA-6x55-xgvg-24hg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated local foothold (AV:L, PR:L) with no user interaction; a kernel UAF yields SYSTEM, giving full C/I/A impact within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Technical ContextAI
The flaw lives in Windows Kernel-Mode Drivers (kernel-space code running in ring 0). A use-after-free (CWE-416) occurs when the kernel continues to reference a memory object after it has been freed, allowing an attacker who controls the reallocated memory to corrupt kernel structures. Because the affected code executes with the highest OS privilege, successful exploitation of such a bug typically yields SYSTEM-level control. The CPE and EUVD data confirm the affected surface is the core OS across Windows 10 (1607/1809/21H2/22H2), Windows 11 (22H3/23H2/24H2/25H2/26H1), and Windows Server 2012 through 2025, indicating a shared kernel driver component rather than an add-on product. The 'Denial Of Service' and 'Memory Corruption' tags are consistent with a UAF that can also crash the kernel if exploitation is unsuccessful.
RemediationAI
Vendor-released patch: apply the Microsoft security update via the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40408, upgrading each affected build to at or above its fixed version (e.g. Windows 11 24H2 to 10.0.26100.8457, 23H2 to 10.0.22631.7079, Windows 10 22H2 to 10.0.19045.7291, Server 2022 to 10.0.20348.5139, Server 2025 to 10.0.26100.32860). This is a kernel driver fix delivered through standard cumulative updates, so deploy through Windows Update/WSUS/SCCM. No standalone workaround disables the vulnerable kernel code, so where patching must be delayed, reduce exposure by limiting who can log in interactively or run code locally on the host (restrict local and RDP logon rights, remove unnecessary local user accounts, and enforce least privilege), since exploitation requires an existing low-privileged local foothold; the trade-off is operational friction on multi-user and jump-host systems. Monitor for unexpected kernel faults/bugchecks, which may indicate failed exploitation attempts given the memory-corruption/DoS nature of the flaw.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today