What is the CVSS score of CVE-2026-45657?

CVE-2026-45657 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Kernel are affected by CVE-2026-45657?

CVE-2026-45657 in Windows Kernel exposes all Windows systems across your organization to immediate remote takeover by unauthenticated attackers without user interaction.. A patch is available.

How to fix or mitigate CVE-2026-45657?

Within 24 hours: Inventory all Windows systems in the environment; enable network monitoring and logging to detect exploitation attempts. Within 7 days: Implement network segmentation to isolate critical Windows infrastructure; deploy firewall rules restricting inbound network access to Windows systems where operationally feasible; configure intrusion detection/prevention signatures for CVE-2026-45657. Within 30 days: Continuously monitor Microsoft security advisories for patch availability; assess any vendor-provided workarounds; conduct vulnerability scans to identify systems with active exploitation indicators.

Windows Kernel CVE-2026-45657

EUVD-2026-35697 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-3r8r-9cjm-whj4

Buffer Overflow Denial Of Service Heap Overflow Microsoft Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

9.8

CVSS 3.1 · Vendor: microsoft

Temporal: 8.5

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.5 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:59 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in the Windows Kernel allows unauthenticated network attackers to execute arbitrary code by triggering a use-after-free condition (CWE-122 heap-related memory corruption). The flaw was reported by Microsoft (secure@microsoft.com) and carries a critical CVSS 9.8 with no public exploit identified at time of analysis. Tag metadata indicates the bug can also be leveraged for heap overflow and denial-of-service outcomes.

Technical ContextAI

The vulnerability resides in the Windows Kernel, the privileged core of the Microsoft Windows operating system responsible for memory management, process scheduling, device I/O, and network stack handling. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), and the description specifies a use-after-free pattern - meaning kernel code continues to dereference a pointer to a heap object after that object has been freed, allowing an attacker who can influence the reallocation of that heap chunk to corrupt adjacent kernel structures or hijack control flow. Because the issue is reachable 'over a network,' the affected code path almost certainly lives in a network-facing kernel component (for example a kernel-mode protocol handler such as SMB, RPC, HTTP.sys, or a similar driver) rather than in user-mode services. No specific CPE strings were provided in the input.

RemediationAI

Apply Microsoft's monthly security update that addresses CVE-2026-45657 as soon as it is published; the authoritative patch matrix and exact KB article numbers per Windows SKU are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657. Patch available per vendor advisory; specific fixed build numbers were not provided in the input and must be taken from the MSRC page. Until patching is complete, restrict exposure of network-facing Windows kernel services by blocking inbound traffic to commonly abused kernel-handled ports (SMB 445, RPC 135, and any HTTP.sys-bound listeners) at the perimeter and host firewall, segment Windows hosts so workstations and servers are not reachable from untrusted networks, and prioritize patching of internet-exposed and domain-controller systems first. Note that blocking SMB/RPC will break file sharing, Active Directory replication, and remote management workflows, so workarounds should be treated as short-term compensating controls rather than substitutes for the update.