EUVD-2026-43892
GHSA-xqfq-fx8x-w875
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation needing an existing low-privileged foothold (AV:L, PR:L), reliably triggerable without user interaction (AC:L, UI:N), yielding SYSTEM control so C/I/A are High and scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker gain SYSTEM-level control by abusing a type-confusion (CWE-843) condition, affecting a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. Successful exploitation yields total loss of confidentiality, integrity, and availability on the host, though there is no public exploit identified at time of analysis and CISA's SSVC framework rates exploitation as 'none' and non-automatable. EPSS is low (0.29%, 21st percentile), consistent with a locally-scoped bug that requires prior code execution rather than a remotely wormable threat.
Technical ContextAI
The flaw resides in the Windows Kernel (ntoskrnl / kernel-mode components) and is classified as CWE-843, 'Access of Resource Using Incompatible Type,' commonly called type confusion. This class occurs when code allocates or references a kernel object as one type but later operates on it as an incompatible type, causing the kernel to misinterpret object fields, function pointers, or size boundaries. In kernel mode such confusion typically leads to controlled memory corruption - the Microsoft tags 'Memory Corruption' and 'Information Disclosure' corroborate this - which an attacker leverages to overwrite privileged structures and pivot from a low-privileged token to SYSTEM. The CPE data confirms the affected surface is the core operating system across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, indicating shared kernel code spanning more than a decade of releases.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises the kernel to at or above the fixed build for your OS - for example Windows 11 24H2 to 10.0.26100.8875, Windows 10 22H2/21H2 to 10.0.19045.7548/10.0.19044.7548, Windows Server 2022 to 10.0.20348.5386, Windows Server 2025 to 10.0.26100.33158, Windows Server 2019/10 1809 to 10.0.17763.9020, and the Server 2012/2012 R2 builds to 6.2.9200.26226 / 6.3.9600.23291. Deploy via Windows Update or WSUS/SCCM following the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50390 (NVD reference: https://nvd.nist.gov/vuln/detail/CVE-2026-50390). Because this is a kernel type-confusion bug with no vendor-published workaround, patching is the only reliable fix; as compensating controls until patches are deployed, restrict who can run code on affected hosts by enforcing least privilege and application allow-listing (e.g., Windows Defender Application Control) to deny attackers the low-privilege foothold this exploit requires, and prioritize multi-user and internet-facing servers where untrusted local code is more likely - noting these controls reduce but do not eliminate exposure and add administrative overhead.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today