EUVD-2026-56367
GHSA-pgvw-22qq-2v4h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with standard user privileges sufficient; no configuration prerequisite or user interaction; full C/I/A impact reflects kernel-level code execution reaching SYSTEM privilege.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Kernel via an untrusted pointer dereference (CWE-822) enables a low-privileged, locally authenticated attacker to gain full SYSTEM-level control with high confidentiality, integrity, and availability impact. Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) makes this a reliable second-stage privilege escalation primitive for adversaries who have already achieved local access through any initial foothold.
Technical ContextAI
CWE-822 (Untrusted Pointer Dereference) describes a class of vulnerability where kernel-mode code dereferences a pointer value that is supplied or influenced by a less-privileged context without adequate validation. In the Windows Kernel, ring-0 code operates with unrestricted memory access; if an attacker-controlled value can steer a kernel pointer, the result is typically an arbitrary read/write primitive or direct code execution at the highest privilege level on the system. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is reachable from a standard user-mode process with no elevated permissions, no complex preconditions, and no user interaction beyond invoking the vulnerable syscall or IOCTL path. Affected build ranges per EUVD-2026-56367 are: Windows 11 26H1 below 10.0.28000.2704, Windows 11 25H2 below 10.0.26200.9168, Windows 11 24H2 below 10.0.26100.9168, and Windows Server 2025 (full and Server Core) below 10.0.26100.33296.
RemediationAI
Apply the vendor-released patch through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog; the confirmed fixed builds are 10.0.28000.2704 for Windows 11 26H1, 10.0.26200.9168 for Windows 11 25H2, 10.0.26100.9168 for Windows 11 24H2, and 10.0.26100.33296 for Windows Server 2025 (full and Server Core installations). The advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62737. Where immediate patching is not feasible, restrict interactive logon and Remote Desktop access to only trusted, explicitly authorized accounts, and enforce least-privilege account policies to reduce the pool of accounts capable of triggering the vulnerable code path - note this does not eliminate risk if an attacker achieves initial access through another channel. Monitor for anomalous privilege transitions and unexpected SYSTEM-level process spawning from standard user sessions as a detection compensating control.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today