EUVD-2026-35550
GHSA-c8fm-pg8v-hrr3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows Internet (wininet.dll) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Internet (wininet.dll) allows an authenticated low-privileged attacker to elevate to higher privileges by triggering an integer overflow condition. With a CVSS score of 7.8 and full impact on confidentiality, integrity, and availability, this flaw represents a meaningful post-compromise risk on affected Windows systems, though no public exploit identified at time of analysis. The vulnerability has been reported by Microsoft's own security team (secure@microsoft.com), indicating internal discovery and coordinated disclosure.
Technical ContextAI
The vulnerability resides in wininet.dll, the Windows Internet API library that provides high-level HTTP, FTP, and Gopher client functionality used by Internet Explorer, Edge legacy components, and numerous third-party applications that link against the WinINet API. The root cause is CWE-190 (Integer Overflow or Wraparound), where arithmetic operations on integer values exceed the maximum representable size, wrapping around to small or negative values. In a library like wininet.dll, such overflows typically occur during length calculations on protocol fields, content-length headers, URL parsing, or buffer-size computations, and the wrapped value is then used to allocate or index a buffer - leading to heap or stack memory corruption. The 'Buffer Overflow' tag alongside 'Integer Overflow' confirms that the integer wrap is the precursor to a subsequent memory corruption primitive that enables privilege escalation.
RemediationAI
Apply the security update referenced in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45592 via Windows Update or WSUS as soon as it is staged in your patch rings - the MSRC update guide enumerates the per-SKU KB numbers and exact patched binary versions, which must be cited from that page since no fix version is included in the input data (Patch available per vendor advisory). Because exploitation requires local low-privileged access, compensating controls in the interim include enforcing least-privilege on interactive users and service accounts, restricting standard users from running untrusted binaries (AppLocker or WDAC policies), and monitoring EDR telemetry for anomalous child processes spawned from wininet.dll-consuming applications such as legacy IE components, Outlook, or third-party HTTP clients; the trade-off is that AppLocker/WDAC enforcement requires upfront application inventory work and can break line-of-business apps if rolled out without an audit phase. Disabling WinINet itself is not a viable workaround because it is a core Windows component depended on by the OS and many shipped applications.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to S
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today