EUVD-2026-29651
GHSA-4qhv-qjg6-r699
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated attacker with low privileges runs code to trigger the kernel dereference (AV:L/PR:L/AC:L); successful SYSTEM escalation yields total host compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an untrusted pointer dereference (CWE-822) lets an already-authenticated local attacker execute code with SYSTEM-level privileges. Microsoft has released a patch, and no public exploit is identified at time of analysis; EPSS exploitation probability is very low (0.03%) and the flaw is not on CISA KEV. Despite the 'Information Disclosure' tag applied in vendor metadata, the CVSS vector and description describe a privilege-elevation primitive with total confidentiality, integrity, and availability impact on the affected host.
Technical ContextAI
The vulnerability resides in the Windows Kernel (ntoskrnl/kernel-mode subsystem), the most privileged ring of the operating system that mediates process scheduling, memory management, and syscall handling. The root cause is CWE-822 (Untrusted Pointer Dereference): the kernel dereferences a pointer whose value is influenced by an attacker without validating that it references a legitimate, expected memory region. When a user-mode caller can steer a kernel pointer, dereferencing it can corrupt kernel memory or redirect execution, enabling an attacker to overwrite privilege-defining structures (e.g., a process token) and gain SYSTEM. The CPE data scopes this specifically to Windows 11 Version 24H2, 25H2, 26H1, Windows Server 2025, and the Server 2025 Server Core installation - all modern builds sharing the 10.0.26x00/28000 kernel lineage.
RemediationAI
Apply the Microsoft security update via Windows Update or WSUS/SCCM as the primary and sufficient fix - Vendor-released patch: update to at least build 10.0.26100.8457 (Windows 11 24H2), 10.0.26200.8457 (25H2), 10.0.28000.2113 (26H1), or 10.0.26100.32860 (Windows Server 2025 and Server Core). Full remediation details are in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40369. Because exploitation requires an authenticated local foothold with existing privileges, the most effective compensating controls until patching are to restrict interactive and code-execution access on affected hosts: enforce least-privilege so standard users cannot run untrusted binaries, apply application control (WDAC/AppLocker) to block unauthorized executables that would deliver the exploit, and prioritize patching internet-facing and multi-user systems (RDP/session hosts, Server 2025) where an initial-access attacker is most likely to chain this. Note these controls only reduce the opportunity to launch the exploit and do not remove the kernel flaw, so they are stopgaps rather than substitutes for the update.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today