What is the CVSS score of CVE-2026-45653?

CVE-2026-45653 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Kernel are affected by CVE-2026-45653?

A local privilege escalation vulnerability in the Microsoft Windows Kernel (CVE-2026-45653, CVSS 7.0) allows authenticated low-privilege users to gain SYSTEM-level access through a use-after-free…. A patch is available.

How to fix or mitigate CVE-2026-45653?

Within 24 hours: Inventory all Windows systems with local user access, prioritizing shared environments and multi-user hosts. Within 7 days: Implement compensating controls including restricting local logon privileges for non-administrative accounts, disabling unnecessary local authentication methods, and enabling detailed audit logging for privilege escalation events (Token Elevation, Process Creation). Within 30 days: Monitor Microsoft Security Updates for CVE-2026-45653 patch availability and apply immediately upon release.

Windows Kernel CVE-2026-45653

EUVD-2026-35569 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-2f5f-6jgg-m49q

Denial Of Service Heap Overflow Microsoft Buffer Overflow Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:02 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Kernel allows an authenticated low-privilege attacker to elevate to SYSTEM by triggering a use-after-free condition in kernel memory. The flaw carries a CVSS 7.0 rating with high attack complexity, and no public exploit identified at time of analysis. Exploitation requires a race condition or specific timing to be won, which constrains reliable weaponization but does not eliminate the risk on multi-user or shared Windows hosts.

Technical ContextAI

The vulnerability resides in the Windows Kernel, the core ring-0 component responsible for process scheduling, memory management, and hardware abstraction across all supported Windows editions. The root cause is CWE-122 (heap-based buffer overflow) combined with a use-after-free pattern, where a kernel object is referenced after its backing memory has been freed and potentially reallocated. The 'Heap Overflow' and 'Buffer Overflow' tags suggest the freed object's slot can be reclaimed with attacker-controlled data, enabling type confusion or controlled writes into kernel heap structures. Successful manipulation of freed kernel pool memory typically leads to corruption of dispatch tables, token objects, or function pointers that the kernel later dereferences with full privilege.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45653 as soon as it appears in your normal Patch Tuesday cycle; exact fix KB numbers per Windows SKU are listed in that update guide and should be deployed via Windows Update, WSUS, Intune, or your standard patch management pipeline. Patch available per vendor advisory - no specific fix version was provided in the input data, so cross-reference the MSRC entry to map your build to the correct cumulative update. As compensating controls until patched, restrict interactive and remote logon to trusted users on sensitive hosts (Group Policy: 'Allow log on locally' and 'Allow log on through Remote Desktop Services'), tighten AppLocker or Windows Defender Application Control to block unsigned binaries from standard users (trade-off: may break legitimate developer or admin tooling), and enable Microsoft Defender attack-surface-reduction rules plus tamper protection so EDR can flag anomalous kernel-callback behavior (trade-off: increased telemetry volume but no functional impact on users).