What is the CVSS score of CVE-2026-65678?

CVE-2026-65678 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Win32K are affected by CVE-2026-65678?

Windows 10, 11, and Server 2016-2025 contain a privilege escalation vulnerability (CVE-2026-65678) that enables authenticated local users to escalate to SYSTEM-level access and compromise system…. A patch is available.

How to fix or mitigate CVE-2026-65678?

Within 24 hours, inventory all Windows 10, 11, and Server 2016-2025 systems and verify current patch status for CVE-2026-65678 using Microsoft security advisories. Within 7 days, obtain the vendor patch from Microsoft Update or WSUS and deploy to a test environment to validate compatibility with critical applications and services. Within 30 days, complete enterprise-wide deployment of the CVE-2026-65678 patch to all affected Windows systems, prioritizing domain-joined servers and workstations running elevated-privilege services.

Windows Win32K CVE-2026-65678

EUVD-2026-56438 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-v6j6-j5g3-h68m

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only vector and mandatory low-privilege authentication confirmed by description; AC:H reflects kernel heap grooming requirement for reliable UAF exploitation.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:30 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

Win32K (win32k.sys) is the kernel-mode graphics and windowing subsystem in Windows, responsible for GDI rendering, window object lifecycle management, user-input routing, and user-to-kernel graphics API dispatch. CWE-416 (Use After Free) arises when a kernel pool or heap object is freed while a dangling pointer to it remains accessible; if the freed region is subsequently reallocated by an attacker-controlled allocation, the stale pointer dereference enables arbitrary kernel read/write primitives or control-flow redirection. Win32K UAFs historically target object types such as window objects, menu objects, or device contexts. The CVSS AC:H rating is consistent with the exploit requiring precise heap grooming or a race condition to reliably place attacker-controlled data in the freed pool slot before the vulnerable dereference occurs.

RemediationAI

Apply the Microsoft security update for CVE-2026-65678 via Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog. Fixed build numbers confirmed by ENISA EUVD-2026-56438 are: Windows 10 1607 and Server 2016 → 10.0.14393.9418 or later; Windows 10 1809 and Server 2019 → 10.0.17763.9115 or later; Windows 10 21H2 → 10.0.19044.7663 or later; Windows 10 22H2 → 10.0.19045.7663 or later; Windows 11 23H2 → 10.0.22631.7517 or later; Windows 11 24H2 → 10.0.26100.9168 or later; Windows Server 2025 full install → 10.0.26100.33296 or later; Windows 11 25H2 → 10.0.26200.9168 or later; Windows 11 26H1 → 10.0.28000.2704 or later; Windows Server 2022 → 10.0.20348.5499 or later. The full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65678. Where immediate patching is not feasible, restrict interactive and remote desktop (RDP) logon rights to the minimum necessary set of trusted accounts - this directly limits the pool of attackers who can satisfy the PR:L prerequisite. Deploying Windows Defender Credential Guard and kernel-mode hardware-enforced stack protection (HVCI) increases the cost of reliable kernel pool manipulation but does not eliminate the vulnerability; apply these only with testing as they can affect driver compatibility.