EUVD-2026-99375
GHSA-rcfx-f25h-xxhp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryRun crafted kernel-triggering program
-
ExploitOverflow heap buffer in Windows Kernel
-
ExecutionCorrupt kernel memory structures
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have local, authenticated, low-privileged code execution on the affected Windows host (PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated actor. No user interaction is needed (UI:N) and default configurations are affected - the flaw is in the Windows Kernel itself, which is present on all supported Windows client and server editions including Server Core installations. The principal limiting factor is the local-access prerequisite, making this a post-foothold escalation primitive rather than an initial-access vector; patched builds (e.g., Windows 11 24H2 ≥10.0.26100.9711, Server 2022 ≥10.0.20348.5761) are not vulnerable. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms a local privilege-escalation flaw: an attacker must already have low-privileged authenticated access to the target host, which is why the base score is 7.8 (High) rather than Critical despite total C/I/A impact. CISA's SSVC framework aligns with a measured posture - Exploitation: none (no observed exploitation), Automatable: no (local prerequisite cannot be mass-scanned/wormed), Technical Impact: total (full kernel compromise if triggered). KEV status is not present and no POC is referenced, so per the SSVC 'Exploitation: none' signal there is no public exploit identified at time of analysis. EPSS score was NOT provided in the input, so probabilistic exploitation likelihood cannot be stated. The signals are internally consistent rather than conflicting: a high-impact local EoP, patched by Microsoft, with no current evidence of weaponization. Realistic risk is that of a classic post-compromise escalation primitive - valuable to an attacker who already has a foothold (e.g., chained after phishing/RCE), but not independently exploitable over the network. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host - for instance via a phishing payload or a compromised standard user account - runs a crafted program that triggers the heap-based buffer overflow in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. Because AV:L/AC:L requires only local low-privilege access with no user interaction, exploitation is reliable once a foothold exists, though no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-83833 as described in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83833), which raises affected systems to the fixed builds listed in the EUVD data - for example Windows 11 24H2 to 10.0.26100.9711, Windows Server 2022 to 10.0.20348.5761, Windows 10 22H2/21H2 to 10.0.19044.7807, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9376, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9612, Windows Server 2012 R2 to 6.3.9600.23470, and Windows Server 2012 to 6.2.9200.26434. Confirm the applied build number after updating, since patch level is the only reliable indicator that the vulnerable kernel binary has been replaced. Because exploitation requires an authenticated local foothold at low privilege, the effective compensating controls are proactive rather than substitutes for patching: enforce least privilege and remove unnecessary local interactive or service accounts so an attacker has fewer starting points (trade-off: adds administrative overhead and can break legacy service accounts); harden application allow-listing and endpoint detection to catch the follow-on escalation behavior rather than the initial flaw, accepting that this is detection-dependent and not a hard boundary; and for high-value multi-tenant or jump hosts, isolate untrusted local users onto separate virtual machines or session hosts so a kernel compromise cannot cross into other tenants (trade-off: increased infrastructure cost and operational complexity). No workaround short of the update fully closes a kernel pool overflow, and no public exploit code has been identified at time of analysis, so standard patch-cycle prioritization is appropriate - expedite only on hosts where untrusted or low-privileged users already run code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Windows kernel-mode code. This class of defect occurs when a kernel routine computes a required buffer length from attacker-influenced input, allocates kernel pool memory of that size, but then writes more data than the allocation holds - typically because of an integer/length mismatch or an unchecked size field supplied by the caller. Because the overflow happens in ring-0 pool memory, a successful overwrite can corrupt adjacent kernel structures and be steered into controlled execution or into disabling kernel-enforced protections; the SSVC assessment rates technical impact as 'total', consistent with the CVSS impact vector (C:H/I:H/A:H) and with the fact that kernel compromise defeats user-mode isolation and sandboxing. The access vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), meaning an attacker already running at a normal user level on the machine reaches the vulnerable code path locally rather than over the network. Affected builds across Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2 lines) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 - including Server Core - share the flawed kernel component; patched builds with the corresponding build-number increase are not vulnerable.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring a low-privileged foothold (AV:L, PR:L), reliably triggerable with no user interaction (AC:L, UI:N), yielding full kernel compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in the Windows kernel, CVE-2026-83833, allows an attacker with an existing foothold to gain SYSTEM-level control over supported Windows client and server editions, including Server Core. While exploitation requires local access and prior code execution, successful compromise would let an intruder fully take over affected systems, enabling lateral movement, data theft, or ransomware deployment. Security leadership should prioritize patching to eliminate this post-exploitation escalation path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB