EUVD-2026-99868
GHSA-wpqv-r4pg-8xgj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged code execution
-
DeliveryTrigger use-after-free in Win32k object
-
ExploitWin race to reclaim freed memory
-
ExecutionCorrupt kernel structures
-
ImpactElevate privileges to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated local access with the ability to run code as a low-privileged user on an affected Windows build (PR:L, AV:L); it is not remotely exploitable and needs no user interaction. The key limiting factor is the use-after-free race condition reflected by AC:H - the attacker must reliably win a timing window to reclaim the freed Win32k kernel object, which reduces exploit reliability and typically requires multiple attempts. Affected systems are specific Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2025 builds below the patched versions; fully patched hosts are not exploitable. |
| Impact | Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local privilege-escalation flaw: the attacker must already have authenticated low-privilege code execution on the host (PR:L) and must win a race/meet timing conditions typical of a use-after-free (AC:H), which materially lowers reliability. CISA's SSVC framework agrees exploitation is currently 'none' (no observed activity) and 'Automatable: no' (consistent with the high-complexity race), while rating 'Technical Impact: total' - matching the C:H/I:H/A:H kernel-level compromise once triggered. There is no CISA KEV listing and no POC referenced, so this is not confirmed exploited. EPSS is not provided in the input and cannot be assessed. In short: high technical impact but gated behind local access plus a difficult race, so it is a standard patch-cycle priority rather than a drop-everything issue, with the caveat that Win32k EoP bugs are historically attractive for chaining after an initial foothold. |
| Exploit ScenarioDerived | An attacker who already has low-privileged code execution on a Windows host (for example via a phishing payload or a compromised standard user account) runs a crafted program that triggers the use-after-free in the Win32k kernel subsystem, racing the kernel to reuse the freed object. On a successful race, the attacker corrupts kernel memory to elevate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means the race may require multiple attempts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker running as a low-privileged user to abuse a use-after-free condition in a kernel object and elevate to full system privileges, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) below Microsoft's fixed builds are affected; exploitation is not remote, requires no user interaction, and hinges on winning a timing-dependent race window, which lowers exploit reliability. No public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has shipped a vendor patch, so fully updated hosts are not exploitable - the overall priority is moderate rather than emergency.
RemediationAI
Apply the Microsoft security update for CVE-2026-70144 as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70144) - patch availability is confirmed by the vendor, and the EUVD affected-version data indicates the remediated build thresholds as 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2), 10.0.26200.9711 (Windows 11 25H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.26300.9711 (Windows 11 26H2), and 10.0.26100.33650 (Windows Server 2025, including Server Core); verify the exact applicable build for each edition against the vendor advisory before treating a host as fixed, and schedule the mandatory reboot so the kernel image is actually replaced. Because the flaw is only reachable by an attacker who can already execute code locally as a low-privileged user, the most effective compensating control is reducing the number of principals who can obtain that foothold: enforce least privilege and remove unnecessary local interactive/RDP rights so untrusted users cannot log on to affected hosts, at the cost of restricting legitimate administrative workflows. Application-control mechanisms such as WDAC or AppLocker can block untrusted binaries that would host the exploit primitives, but they carry significant deployment and maintenance overhead and will not stop exploitation through already-permitted software. Exploitation requires winning a use-after-free race (AC:H) with no user interaction, so there is no meaningful user-behaviour mitigation to rely on, and generic hardening such as attack-surface reduction or blocking network access does not address the local vector - treat patching as the only complete fix, and note that no public exploit code was identified at time of analysis, so emergency out-of-band measures are not indicated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Win32 kernel subsystem (win32k.sys with its win32kbase/win32kfull components) implements the kernel-mode side of the Windows USER and GDI APIs, maintaining a large population of kernel objects - windows, menus, hooks, and graphics objects - whose lifetimes are managed in kernel memory on behalf of lower-privileged user-mode processes. CVE-2026-70144 is a CWE-416 use-after-free: a reference-counting or object-lifetime flaw lets an object be freed while a stale pointer to it can still be dereferenced, allowing an attacker who controls the timing to have the freed memory reclaimed with attacker-influenced content and then have kernel code operate on it. This class of bug in win32k is a classic local privilege-escalation primitive because the corrupted object is processed at kernel privilege, which can lead to arbitrary kernel memory corruption, code execution in kernel context, or bugcheck (consistent with the Denial Of Service and Memory Corruption tags associated with this record). The assessed vector, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflects that the attacker must already hold authenticated local code execution as a low-privileged user and must reliably win the use-after-free race (AC:H), while no user interaction and no scope change are involved; technical impact per SSVC is 'total', but the race requirement and local-access prerequisite keep this a post-compromise elevation step rather than a remote attack path. Cross-references: NVD/Microsoft MSRC update guide (CVE-2026-70144) and ENISA EUVD-2026-99868.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP requiring an existing low-privilege foothold (AV:L, PR:L) and winning a use-after-free race (AC:H); successful exploitation yields full kernel compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Executive ViewAI
CVE-2026-70144 is a local privilege-escalation flaw in the Windows Win32 kernel subsystem affecting Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core, in which a low-privileged user on an affected host could gain full system-level control of that machine. Because exploitation requires an authenticated local presence and a timing-dependent race condition, this is not a remote or self-spreading threat, but a successful escalation could expose sensitive data, allow system tampering, and disrupt availability on the compromised endpoint. Leadership should treat this as a time-bound patch-management obligation for endpoint and server fleets rather than an emergency, while recognizing that already-updated hosts are not exposed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB