EUVD-2026-99617
GHSA-mp69-3w85-5r94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local access
-
DeliveryRun crafted program invoking vulnerable kernel path
-
ExploitTrigger out-of-bounds write corrupting kernel memory
-
ExecutionOverwrite kernel structures to gain SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated access to the Windows host as at least a low-privileged user (PR:L) capable of running code that reaches the vulnerable kernel code path; there is no remote or unauthenticated vector and no network exposure. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists the trigger is reliable. The principal limiting factors are the mandatory pre-existing local account/code-execution foothold and the need for an unpatched build within the listed version ranges (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650); CISA SSVC rates it non-automatable, reflecting that it cannot be launched en masse without that prior access. |
| Impact | This is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw requiring an attacker to already hold low-privilege authenticated access and low attack complexity with no user interaction, yielding total confidentiality/integrity/availability impact within an unchanged scope. The signals are internally consistent and point to a classic post-compromise EoP rather than a remotely-wormable bug. CISA SSVC reinforces a measured urgency: Exploitation=none (no observed or public exploitation), Automatable=no (the attacker must already have a foothold, so mass automation is impractical), but Technical Impact=total (full SYSTEM/kernel compromise once triggered). No CISA KEV listing and no POC are indicated in the input, and no EPSS score was provided, so there is no evidence of active or imminent widespread exploitation. The high impact plus kernel attack surface and the fact that it was reported by Microsoft itself (secure@microsoft.com) suggest a credible, vendor-confirmed bug worth patching promptly, but the 'local + authenticated + not automatable + no known exploitation' profile means it is a second-stage escalation tool, not a perimeter-breaking threat. No signals conflict; the main missing data points are EPSS probability and any independent POC confirmation. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged code execution on a Windows host - for example via phishing, a malicious local app, or a compromised standard user account - runs a crafted program that triggers the out-of-bounds write in the Windows kernel to corrupt kernel memory and escalate to SYSTEM. No user interaction is required and attack complexity is low, but local authenticated access is a prerequisite. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on a host to trigger an out-of-bounds write and obtain SYSTEM-level rights, affecting a broad set of Windows 10, Windows 11, and Windows Server builds below the fixed build numbers published by Microsoft. The vector is strictly local (AV:L, PR:L, UI:N) with low attack complexity, meaning the trigger is reliable once a foothold exists, but CISA's SSVC rates it non-automatable and Microsoft's update is already available, so this functions as a post-compromise escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, making this a genuine but not emergency-level priority.
RemediationAI
Vendor-released patch: apply Microsoft's monthly security update for CVE-2026-70303 via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70303, which brings systems to or above the fixed builds 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.19044.7807 (Windows 10 21H2/22H2), 10.0.20348.5761 (Server 2022), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2), 10.0.26100.33650 (Server 2025), 10.0.26200.9711 (Windows 11 25H2), 10.0.26300.9711 (Windows 11 26H2), 10.0.28000.3231 (Windows 11 26H1), 6.2.9200.26434 (Server 2012), and 6.3.9600.23470 (Server 2012 R2); prioritize internet-facing and multi-user endpoints where an unprivileged local foothold is most likely to be obtained first. Because the exploit path requires pre-existing local code execution as a low-privileged user, compensating controls are defensible but weaker than patching: enforce least privilege and remove interactive logon or local code-execution rights for untrusted accounts, and use WDAC or AppLocker in enforcement mode to block unsigned or non-allowlisted binaries, at the cost of operational overhead and potential breakage of legitimate line-of-business tooling. Attack Surface Reduction rules and Credential Guard reduce the value of a stolen token after escalation but do not block the overflow itself, and disabling kernel debugging or driver test-signing exposure is advisable on production hosts. Detection should focus on unusual kernel memory corruption symptoms and privilege-token anomalies (processes suddenly running as SYSTEM from non-service parents) rather than network telemetry, since the attack generates no traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds write (CWE-787) in a Windows kernel-mode component, a memory-safety defect class in which a write operation exceeds the bounds of an allocated buffer in kernel memory. Because the code runs in Ring 0, a successful overflow corrupts kernel data structures and typically yields arbitrary read/write within the kernel address space, which an attacker converts into token manipulation (for example overwriting a process token's privilege fields) or into defeating kernel protections to escalate from a low-integrity user context to SYSTEM. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the scope is unchanged, so the impact is contained to the already-compromised host rather than crossing a security boundary such as a hypervisor or sandbox. Affected builds span Windows NT 6.2 through 10.0.26300, covering legacy Server 2012/2012 R2 kernels alongside current Windows 11 and Windows Server 2025 servicing branches, which indicates the defect exists in long-lived kernel code shared across those release trains rather than in a recent feature. Microsoft's MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70303) is the authoritative source, mirrored by the ENISA EUVD entry EUVD-2026-99617.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authorized attacker must run code on the host, so AV:L and PR:L; low complexity and no interaction, with kernel compromise giving full C/I/A impact in unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in the Windows Kernel (CVE-2026-70303) allows an attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server host to reliably elevate to SYSTEM-level control. The risk is concentrated in post-compromise escalation: it does not provide a remote entry point, but it can turn a contained malware infection or compromised user account into full administrative control of the machine, enabling credential theft, persistence, and lateral movement. Because exploitation requires pre-existing code execution, an available vendor fix, and no public exploit code identified at time of analysis, this is a genuine but manageable priority that should be handled through normal patch governance rather than emergency response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB