EUVD-2026-29654
GHSA-m8m3-jvh9-rpcr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation needing a low-privileged foothold (AV:L, PR:L), no user interaction, low complexity, yielding full SYSTEM control (C:H/I:H/A:H) within the same host scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.
Technical ContextAI
Windows Cryptographic Services (the cryptsvc / Cryptographic Services stack backing CryptoAPI, certificate handling, and related security functions) contains a heap-based buffer overflow classified as CWE-122. A heap overflow occurs when data written to a dynamically allocated buffer exceeds its bounds, corrupting adjacent heap metadata or object pointers; in a privileged service context this can be leveraged to overwrite control data and redirect execution or manipulate security tokens. The CPE data confirms the affected component ships as an integral part of the Windows operating system across client (Windows 10 1607/1809/21H2/22H2 and Windows 11 22H3/23H2/24H2/25H2/26H1) and server SKUs (Windows Server 2012 through 2025, including Server Core installations), meaning the vulnerable code path is a core OS service rather than an optional add-on.
RemediationAI
Apply the Microsoft security update for your specific Windows build as the primary remediation - Vendor-released patch is available; install the update that raises the OS to at least the fixed build for your SKU (for example Windows 10 22H2 to 10.0.19045.7291 or later, Windows 11 24H2 to 10.0.26100.8457 or later, Windows Server 2022 to 10.0.20348.5139 or later, Windows Server 2025 to 10.0.26100.32860 or later), as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40377. Because Cryptographic Services is a core OS service with no supported disable option, there is no clean feature-level workaround; interim compensating controls should focus on limiting who can obtain the local, low-privileged foothold required to trigger the flaw - enforce least privilege, restrict interactive and RDP logon rights to trusted accounts, apply application allowlisting to block untrusted local binaries, and monitor for anomalous privilege-escalation and crash activity in cryptsvc. These controls reduce the pool of potential attackers but do not remove the vulnerable code, so patching remains mandatory; prioritize multi-user, jump-host, and terminal/RDS servers where untrusted users share a host.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today