EUVD-2026-44008
GHSA-764g-phpv-fv6g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation from a low-privileged user with no interaction; kernel heap corruption yields full SYSTEM control, so PR:L, AV:L, and C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) lets an already-authenticated low-privilege user corrupt kernel heap memory via a heap-based buffer overflow (CWE-122) to gain SYSTEM-level control. The flaw affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Win32K (win32k.sys / win32kfull.sys) is the kernel-mode component that implements the Windows GUI and window manager, historically one of the most heavily targeted local-attack surfaces because it is reachable from low-privilege user processes yet executes in ring 0. The weakness is CWE-122 (heap-based buffer overflow), meaning attacker-controlled input causes a write past the bounds of a kernel pool (heap) allocation. Corrupting adjacent pool objects or kernel structures is a well-understood primitive that can be groomed into arbitrary kernel read/write and ultimately privilege escalation. The CPE data confirms this is Microsoft's Windows operating system across x86/x64 client SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2016, 2019, 2022, 2025, including Server Core installations).
RemediationAI
Apply the Microsoft security update for CVE-2026-54986 (Patch available per vendor advisory / Vendor-released patch via Microsoft) - install the relevant cumulative update for each affected SKU as listed in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54986; the exact per-version KB build number should be pulled from that advisory as it is not enumerated in the provided data. Because exploitation requires local low-privileged code execution, interim risk can be reduced by tightening who can run code on sensitive hosts: limit interactive and RDP logon rights on servers and terminal/RDS hosts, remove unnecessary local user accounts, and enforce application allow-listing so untrusted binaries cannot launch - with the trade-off of added administrative overhead and potential disruption to legitimate power users. On hardened endpoints, enabling Win32k system-call filtering (Win32k lockdown) for eligible processes such as browsers further shrinks the attack surface, at the cost of possible compatibility issues with GUI-dependent applications, and should be tested before broad rollout. Prioritize patching multi-user, Server Core, and RDS systems first.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today