EUVD-2026-44086
GHSA-cfmr-fm5g-6ffw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and existing low privileges are needed to run the exploit (AV:L/PR:L), complexity is low with no user interaction, and kernel compromise yields total C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel (CWE-122 heap-based buffer overflow) allows an authenticated local attacker to gain SYSTEM-level control across a broad range of currently supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Exploitation grants total confidentiality, integrity, and availability impact (CVSS 3.1 7.8, C:H/I:H/A:H). There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and the EPSS score is low at 0.32% (24th percentile), indicating no evidence of active or imminent mass exploitation despite the critical technical impact.
Technical ContextAI
The flaw resides in the Windows Kernel, the core privileged component that mediates memory management, scheduling, and hardware access for every process on the system. CWE-122 (heap-based buffer overflow) means a kernel allocation on the heap is written beyond its bounds, corrupting adjacent heap metadata or object data; when a controlled overflow overwrites kernel pointers or object headers it can be leveraged to hijack kernel execution flow or manipulate privileged structures, yielding arbitrary code execution in ring 0. The CPE and EUVD data confirm the vulnerable code is present across the shared kernel lineage spanning Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations, indicating a defect in long-lived, common kernel code rather than a version-specific feature.
RemediationAI
Vendor-released patch: apply the Microsoft security updates that raise each build above its fixed threshold - for example Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2 to 10.0.26100.8875, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 to 10.0.26100.33158, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50477 (see also https://nvd.nist.gov/vuln/detail/CVE-2026-50477). Because the fix is a kernel update there is no supported configuration-level workaround; until patches are deployed, reduce exposure by limiting local and interactive logon rights to trusted accounts, enforcing least privilege so fewer users hold the low-privilege foothold this exploit requires, and prioritizing multi-user, RDP-exposed, and terminal-server hosts where untrusted code is most likely to run. These compensating controls only shrink the attacker population and do not remove the vulnerable code, so the kernel update remains mandatory.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today