EUVD-2026-35697
GHSA-3r8r-9cjm-whj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable Windows host with vulnerable kernel service
-
DeliverySend crafted network protocol message
-
ExploitTrigger use-after-free on kernel heap object
-
ExecutionReclaim freed chunk with controlled data
-
PersistHijack kernel control flow
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no special conditions are required beyond network reachability to the vulnerable Windows Kernel network endpoint on a default, unpatched Windows installation - no authentication, no user interaction, and low attack complexity. The principal limiting factor is exposure of the specific kernel-mode network service that contains the use-after-free: if that service (the exact protocol is not named in the supplied data and should be confirmed via MSRC) is firewalled off, not bound to an external interface, or disabled by default on a given Windows SKU, exploitation is constrained to attackers who already have LAN-level reach. The exact Windows versions and builds in scope were not provided in the input. |
| Impact | All available signals point to a top-tier priority. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives a 9.8 base score: network reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability - the worst-case profile for a kernel bug. EPSS, KEV status, and SSVC decision points were NOT provided in the input, so exploitation probability and active-exploitation status cannot be quantified here; this is a notable data gap. No public exploit was identified at time of analysis, but Microsoft-credited kernel UAFs with network reach historically attract rapid exploit development and have, in past cases (e.g., SMBGhost-class issues), become wormable. The description states 'over a network' while not specifying which protocol or service is reachable - defenders should verify the exact attack surface with Microsoft's MSRC advisory before assuming internet-facing exposure. |
| Exploit ScenarioDerived | An attacker on the same network as a vulnerable Windows host (or, depending on the affected kernel component, anywhere on the internet if the service is exposed) sends a specially crafted protocol message that drives the kernel to free a heap object while another code path still holds a dangling reference. By racing a controlled allocation into the freed slot, the attacker overwrites a function pointer or virtual table inside the kernel heap and gains SYSTEM-level code execution without any credentials or user interaction. No public exploit identified at time of analysis, but the CVSS profile is consistent with prior wormable Windows kernel bugs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in the Windows Kernel allows unauthenticated network attackers to execute arbitrary code by triggering a use-after-free condition (CWE-122 heap-related memory corruption). The flaw was reported by Microsoft (secure@microsoft.com) and carries a critical CVSS 9.8 with no public exploit identified at time of analysis. Tag metadata indicates the bug can also be leveraged for heap overflow and denial-of-service outcomes.
RemediationAI
Apply Microsoft's monthly security update that addresses CVE-2026-45657 as soon as it is published; the authoritative patch matrix and exact KB article numbers per Windows SKU are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657. Patch available per vendor advisory; specific fixed build numbers were not provided in the input and must be taken from the MSRC page. Until patching is complete, restrict exposure of network-facing Windows kernel services by blocking inbound traffic to commonly abused kernel-handled ports (SMB 445, RPC 135, and any HTTP.sys-bound listeners) at the perimeter and host firewall, segment Windows hosts so workstations and servers are not reachable from untrusted networks, and prioritize patching of internet-exposed and domain-controller systems first. Note that blocking SMB/RPC will break file sharing, Active Directory replication, and remote management workflows, so workarounds should be treated as short-term compensating controls rather than substitutes for the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Windows Kernel, the privileged core of the Microsoft Windows operating system responsible for memory management, process scheduling, device I/O, and network stack handling. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), and the description specifies a use-after-free pattern - meaning kernel code continues to dereference a pointer to a heap object after that object has been freed, allowing an attacker who can influence the reallocation of that heap chunk to corrupt adjacent kernel structures or hijack control flow. Because the issue is reachable 'over a network,' the affected code path almost certainly lives in a network-facing kernel component (for example a kernel-mode protocol handler such as SMB, RPC, HTTP.sys, or a similar driver) rather than in user-mode services. No specific CPE strings were provided in the input.
Know when Windows 11 23h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
CVE-2026-45657 in Windows Kernel exposes all Windows systems across your organization to immediate remote takeover by unauthenticated attackers without user interaction. No vendor patch is currently available, meaning this critical vulnerability cannot be resolved through standard update procedures and requires urgent emergency protective measures. This represents an enterprise-wide operational and security risk requiring immediate containment action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation and firewall rules to restrict inbound access to Windows systems; (2) Intrusion detection and prevention system deployment with CVE-2026-45657 signatures; (3) Enhanced monitoring and logging of network traffic to Windows systems; (4) Regular vulnerability assessments to detect exploitation; (5) Backup and disaster recovery procedures to enable rapid system recovery if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Windows Kernel Use-After-Free Privilege Escalation
View all 3More in Windows 11 23h2
View allInternet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Exploit-DB