EUVD-2026-35576
GHSA-gv67-34rh-v566
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write in Windows Hotpatch Monitoring Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Hotpatch Monitoring Service enables an authenticated low-privileged attacker to gain elevated privileges through an out-of-bounds write (CWE-787) memory corruption flaw. The CVSS 7.8 (AV:L/AC:L/PR:L) reflects local attack vector with low complexity once a foothold is obtained, and no public exploit identified at time of analysis. The vulnerability was reported by Microsoft's own security team (secure@microsoft.com), suggesting internal discovery prior to disclosure.
Technical ContextAI
The Windows Hotpatch Monitoring Service is part of Microsoft's Hotpatch infrastructure that enables applying security updates to running processes without requiring a system restart, primarily used in Azure and Windows Server environments. The root cause is CWE-787 (Out-of-bounds Write), a memory safety flaw where the service writes data past the boundaries of an allocated buffer - typically corrupting adjacent memory structures such as function pointers, return addresses, or object headers. Because the Hotpatch service runs with elevated system privileges to manage kernel and user-mode patching operations, corruption of its memory space provides a direct path to privilege elevation. The 'Buffer Overflow, Memory Corruption' tags reinforce that this is a classic memory-safety defect rather than a logic flaw.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42910 as the primary remediation - patch available per vendor advisory, with exact build numbers to be retrieved from the MSRC update guide per affected Windows Server / Azure SKU. Because the attack requires local low-privileged access, defenders without an immediate patch window should harden local access controls: restrict interactive and remote PowerShell/RDP logon to Hotpatch-enabled hosts to administrators only, enforce LAPS-managed local accounts, and monitor for unexpected child processes spawned by the Hotpatch service (trade-off: tighter access controls may break automation accounts that rely on low-privilege local logon). If Hotpatch is not actively required, disabling the feature and reverting to scheduled-restart patching removes the attack surface entirely at the cost of patch-induced downtime.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today