EUVD-2026-35561
GHSA-672h-59xc-v8h6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local shell
-
DeliveryDrop kernel exploit binary
-
ExploitIssue crafted IOCTL to vulnerable driver
-
ExecutionTrigger type confusion in kernel object
-
PersistOverwrite process token with SYSTEM
-
ImpactDisable defenses and persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local code execution on the target Windows host as an authenticated low-privileged user (CVSS PR:L), with the ability to load and run an arbitrary user-mode binary that issues IOCTLs or syscalls reaching the vulnerable kernel-mode driver. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the attack vector is strictly local (AV:L) - the bug is not remotely exploitable over the network on its own and must be chained with an initial access vector. Exploitation is limited to Windows systems where the vulnerable kernel-mode driver is loaded (Microsoft has not enumerated specific Windows SKUs/builds in the provided data, so per-version applicability must be verified against the MSRC advisory); systems with HVCI/VBS enabled present a materially higher exploitation bar against kernel type-confusion primitives. |
| Impact | The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this requires local access with low privileges already obtained and no user interaction, with high impact across confidentiality, integrity, and availability - consistent with full SYSTEM compromise. EPSS data is not provided in the input, and the CVE is not listed in CISA KEV as of this analysis, with no public exploit identified at time of analysis. SSVC framing: exploitation is not currently observed, but kernel EoP bugs of this class are highly automatable once a PoC drops and are routinely chained by ransomware affiliates and commodity malware after initial access. Real-world priority is moderate-to-high for any Windows fleet, particularly multi-user systems, RDP/Citrix hosts, and endpoints reachable by phishing payloads - even though raw CVSS is not 'critical', the post-exploitation utility is significant. |
| Exploit ScenarioDerived | An attacker gains a foothold as a standard user - for example via a phishing-delivered loader, a stolen RDP credential, or a browser sandbox escape - and executes a local exploit binary that triggers the type confusion in the vulnerable kernel-mode driver to corrupt a kernel object and overwrite the current process token with that of SYSTEM. With SYSTEM privileges, the attacker disables EDR, dumps LSASS, and pivots laterally. No public exploit identified at time of analysis, but kernel type-confusion bugs of this profile have historically been weaponized within weeks of patch disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an authenticated low-privileged user to elevate to SYSTEM via a type confusion (CWE-843) flaw. The vulnerability carries a CVSS 7.8 (High) with low attack complexity and no user interaction once local access is obtained, though no public exploit identified at time of analysis. Reported by Microsoft's MSRC, this fits the recurring pattern of Windows kernel driver EoP bugs frequently abused in post-compromise stages.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update published in the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45600 as part of the corresponding Patch Tuesday cycle; exact KB numbers per Windows build should be retrieved from that advisory since they are not included in the provided data. Because exploitation requires local authenticated access, compensating controls while patching include restricting interactive and RDP logon rights to trusted administrators, enforcing application allowlisting (WDAC or AppLocker) to block unknown user-mode exploit binaries, enabling Hypervisor-Protected Code Integrity (HVCI) which raises the bar for kernel type-confusion exploitation by enforcing kernel code integrity (trade-off: incompatible with some older third-party drivers), and monitoring EDR telemetry for suspicious token-stealing or kernel memory access patterns. There is no documented configuration-level workaround that removes the vulnerable driver without functional loss.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 10 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Windows Kernel-Mode Drivers, which run in ring 0 and have unrestricted access to system memory and hardware. CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion') occurs when code allocates or accesses an object as one type but the underlying memory is actually a different type - leading to out-of-bounds reads/writes, corrupted vtables, or attacker-controlled function pointers. In kernel context, successful exploitation typically results in arbitrary kernel memory write primitives that can be turned into SYSTEM-level token replacement. The 'Memory Corruption' and 'Information Disclosure' tags suggest the bug can be leveraged both to leak kernel addresses (defeating KASLR) and to corrupt kernel structures.
Know when Windows 11 24h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Windows systems face a significant privilege escalation risk (CVE-2026-45600, CVSS 7.8) whereby authenticated, low-privileged users can escalate to SYSTEM-level access, effectively granting complete control over systems and data. This vulnerability is particularly dangerous in post-breach scenarios where attackers with initial local access can rapidly pivot to administrative control, enabling lateral movement and persistent compromise. With no patch currently available, organizations must deploy immediate compensating controls across Windows environments to prevent full system compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce principle of least privilege and restrict low-privileged user account provisioning; (2) Deploy endpoint detection and response (EDR) with kernel driver activity monitoring and privilege escalation detection; (3) Implement Credential Guard or Virtualization-based Security (VBS) to isolate credential storage; (4) Monitor Windows Event Logs (Event ID 4688, 4672) for suspicious privilege escalation patterns; (5) Restrict local administrative access through multi-factor authentication and network-level access controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Exploit-DB