EUVD-2026-43877
GHSA-xcq8-m6wr-w65p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local post-foothold kernel UAF: AV:L and PR:L for existing low-priv code execution, AC:L for reliable trigger, C/I/A:H from SYSTEM-level kernel compromise.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Kernel-Mode Drivers on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated low-privilege user corrupt kernel memory via a use-after-free (CWE-416) and gain SYSTEM-level control. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none, though the technical impact is total. EPSS is low (0.20%, 10th percentile), consistent with a not-yet-exploited but fully impactful local EoP.
Technical ContextAI
The flaw resides in Windows Kernel-Mode Drivers, the ring-0 components that mediate hardware and core OS services. The root cause is a use-after-free (CWE-416): a kernel object is freed while a dangling reference remains, and subsequent reuse of that freed allocation lets an attacker influence kernel-controlled memory. Because kernel-mode code runs at the highest privilege boundary, controlled reuse of a freed object typically enables arbitrary read/write in kernel space and ultimately execution in the SYSTEM security context. CPE data scopes this specifically to microsoft:windows_11_version_24h2, 25h2, 26h1, windows_server_2025, and its Server Core installation.
RemediationAI
Apply the Microsoft security update that raises the affected component to at least the fixed builds: Windows 11 24H2 to 10.0.26100.8875, 25H2 to 10.0.26200.8875, 26H1 to 10.0.28000.2269, and Windows Server 2025 (including Server Core) to 10.0.26100.33158, per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396. Because exploitation requires an authenticated local presence, compensating controls until patching completes include restricting who can log on interactively or run code on affected hosts (limit local/RDP logon rights on servers and shared workstations), enforcing least privilege so fewer accounts have the standing foothold needed, and prioritizing patches on multi-user, jump-box, and terminal-server systems; note these controls reduce exposure but do not remove the kernel flaw, and there is no documented feature-toggle workaround since the defect is in kernel-mode driver code rather than an optional feature.
More in Windows 11 Version 24H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today