EUVD-2026-43877
GHSA-xcq8-m6wr-w65p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local post-foothold kernel UAF: AV:L and PR:L for existing low-priv code execution, AC:L for reliable trigger, C/I/A:H from SYSTEM-level kernel compromise.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Kernel-Mode Drivers on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated low-privilege user corrupt kernel memory via a use-after-free (CWE-416) and gain SYSTEM-level control. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none, though the technical impact is total. EPSS is low (0.20%, 10th percentile), consistent with a not-yet-exploited but fully impactful local EoP.
Technical ContextAI
The flaw resides in Windows Kernel-Mode Drivers, the ring-0 components that mediate hardware and core OS services. The root cause is a use-after-free (CWE-416): a kernel object is freed while a dangling reference remains, and subsequent reuse of that freed allocation lets an attacker influence kernel-controlled memory. Because kernel-mode code runs at the highest privilege boundary, controlled reuse of a freed object typically enables arbitrary read/write in kernel space and ultimately execution in the SYSTEM security context. CPE data scopes this specifically to microsoft:windows_11_version_24h2, 25h2, 26h1, windows_server_2025, and its Server Core installation.
RemediationAI
Apply the Microsoft security update that raises the affected component to at least the fixed builds: Windows 11 24H2 to 10.0.26100.8875, 25H2 to 10.0.26200.8875, 26H1 to 10.0.28000.2269, and Windows Server 2025 (including Server Core) to 10.0.26100.33158, per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396. Because exploitation requires an authenticated local presence, compensating controls until patching completes include restricting who can log on interactively or run code on affected hosts (limit local/RDP logon rights on servers and shared workstations), enforcing least privilege so fewer accounts have the standing foothold needed, and prioritizing patches on multi-user, jump-box, and terminal-server systems; note these controls reduce exposure but do not remove the kernel flaw, and there is no documented feature-toggle workaround since the defect is in kernel-mode driver code rather than an optional feature.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today