EUVD-2026-73467
GHSA-3phw-p7mq-hmvf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish low-privileged local session
-
DeliveryCraft malformed Win32K system call
-
ExploitTrigger kernel heap buffer overflow
-
ExecutionCorrupt adjacent kernel pool or token structure
-
PersistOverwrite process security token
-
ImpactExecute as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a low-privileged local user account on an affected Windows 11 (24H2, 25H2, or 26H1) or Windows Server 2025 system - confirmed by CVSS PR:L and AV:L. The attacker must be able to execute arbitrary code locally; this is satisfied by any standard domain or local account with interactive or remote desktop access. No non-default configuration or special feature flag is required: the Win32K subsystem is active on all desktop and server Windows installations by default. Remote unauthenticated exploitation is not possible (AV:L). Exploitation is further bounded to the specific build ranges listed in EUVD-2026-73467; systems patched to 10.0.26200.9445 / 10.0.26100.9445 / 10.0.28000.2954 / 10.0.26100.33438 or later are not affected. |
| Impact | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat model: local privilege escalation requiring only a standard user session, with low attack complexity and no user interaction needed. The full C:H/I:H/A:H triad is consistent with kernel-level code execution that typically results in SYSTEM access. No EPSS data was provided in the input, and the CVE does not appear in CISA KEV - indicating no confirmed active exploitation at this time. No public exploit code has been identified. However, Win32K LPE vulnerabilities are historically attractive for post-exploitation use - threat actors who have already established a foothold via phishing or another initial-access vector frequently chain Win32K flaws to escalate from a restricted user session to SYSTEM, enabling persistence and lateral movement. Organizations running unpatched Windows 11 or Windows Server 2025 systems where untrusted users can execute code locally should treat this as a high-priority patch given the low exploitation complexity once a local session is available. |
| Exploit ScenarioDerived | An attacker who has established a standard user session on an affected Windows 11 or Server 2025 system - for example, following phishing-based initial access or escape from a sandboxed application - executes a specially crafted program that issues a malformed Win32K system call. The call triggers a heap buffer overflow in the kernel graphics subsystem, corrupting adjacent pool metadata or a security token structure. The attacker leverages this corruption to overwrite their process token with SYSTEM privileges, achieving full local administrative access without any additional user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the Microsoft security update for CVE-2026-69348 via Windows Update, WSUS, or Microsoft Endpoint Configuration Manager. The patch brings Windows 11 25H2 to build 10.0.26200.9445 or later, Windows 11 24H2 to 10.0.26100.9445 or later, Windows 11 26H1 to 10.0.28000.2954 or later, and Windows Server 2025 (including Server Core) to 10.0.26100.33438 or later, per EUVD-2026-73467. The advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69348. Where immediate patching is not feasible, restricting interactive logon rights to only trusted administrator accounts via Group Policy (User Rights Assignment → 'Allow log on locally' and 'Allow log on through Remote Desktop Services') reduces the attacker surface by eliminating untrusted local user sessions; this compensating control trades user access flexibility for risk reduction and should be treated as temporary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Win32K (win32k.sys) is the Windows kernel-mode component implementing the graphical subsystem - USER for window management and GDI for graphics rendering. It executes in kernel context and processes system calls from user-mode applications. A heap-based buffer overflow (CWE-122) occurs when a write operation exceeds the allocated size of a heap buffer, overwriting adjacent heap metadata or control structures. In kernel mode this is especially dangerous: overwriting a kernel pool chunk can corrupt security token pointers or function dispatch tables, yielding arbitrary kernel code execution. The CVSS vector AV:L/AC:L/PR:L confirms exploitation requires local code execution with at least a standard user account, and the S:U scope reflects exploitation confined to the targeted system. Affected CPE ranges cover Windows 11 builds below 10.0.26200.9445 (25H2), 10.0.26100.9445 (24H2), and 10.0.28000.2954 (26H1), plus Windows Server 2025 builds below 10.0.26100.33438.
Know when Windows 11 24h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel exploitation requires only a standard user session (PR:L, AV:L); heap overflow to SYSTEM grants full C:H/I:H/A:H with no user interaction or scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege escalation vulnerability in Windows 11 (builds 24H2, 25H2, 26H1) and Windows Server 2025 allows low-privileged users to gain SYSTEM-level access through a kernel subsystem flaw, with no public exploit identified at time of analysis. Organizations face heightened risk of insider threats and lateral movement by any user with local system access. Microsoft has released patches addressing all affected versions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Exploit-DB