EUVD-2026-56399
GHSA-4rqg-xw8g-5x6w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges required to invoke Win32K syscall; no user interaction needed; full CIA impact upon SYSTEM escalation, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Technical ContextAI
Win32K (win32k.sys) is the kernel-mode driver that implements the Windows Graphics Device Interface (GDI) and USER subsystem, handling windowing, drawing primitives, and graphical I/O. Because it operates in ring-0 kernel space and is accessible from low-privilege user-mode processes through system calls, it presents an attractive attack surface. CWE-121 (Stack-Based Buffer Overflow) describes a memory corruption class where data written to a stack-allocated buffer exceeds its declared bounds, overwriting adjacent stack contents - including saved return addresses and frame pointers - enabling an attacker to hijack control flow. In the kernel context, successful exploitation bypasses user/kernel privilege boundaries, typically yielding SYSTEM or kernel execution. The CVSS vector AV:L/AC:L/PR:L confirms that exploitation occurs locally with low privilege and low complexity, consistent with a Win32K syscall reachable from a standard user session.
RemediationAI
Apply the vendor-released patches immediately via Windows Update or WSUS. The fixed build versions per release are: Windows 10 1607 and Server 2016 → 10.0.14393.9418; Windows 10 1809, Server 2019 → 10.0.17763.9115; Windows 10 21H2 → 10.0.19044.7663; Windows 10 22H2 → 10.0.19045.7663; Windows 11 23H2 → 10.0.22631.7517; Windows 11 24H2 and Server 2025 → 10.0.26100.9168 (client) / 10.0.26100.33296 (server); Windows 11 25H2 → 10.0.26200.9168; Windows 11 26H1 → 10.0.28000.2704; Server 2012 → 6.2.9200.26279; Server 2012 R2 → 6.3.9600.23337; Server 2022 → 10.0.20348.5499. Full details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62877. Where immediate patching is not feasible, restrict interactive and remote logon to systems to only the accounts that strictly require it, reducing the pool of potential attackers who can reach the vulnerable syscall path. Note that this compensating control does not eliminate risk on systems where shared or multi-tenant access is inherent to the workload.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today