EUVD-2026-56663
GHSA-p32h-7xpq-58gg
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with a low-privilege account required; high complexity reflects race condition timing; no scope change as impact stays within the vulnerable kernel.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.
Technical ContextAI
The Windows Kernel - the privileged core of Microsoft's NT-based operating system responsible for memory management, process scheduling, and hardware abstraction - contains a use-after-free (UAF) flaw triggered by a race condition (CWE-362). In this class of vulnerability, two concurrent execution threads compete over the lifecycle of a shared kernel object: one thread frees the memory while another retains a stale reference to it. If the freed region is subsequently reallocated and overwritten with attacker-controlled data before the stale reference is used, the attacker can redirect kernel execution flow or manipulate privileged data structures, achieving ring-0 code execution. The CWE-362 classification indicates the primary root cause is the lack of proper synchronization primitives (e.g., missing locks, incorrect lock ordering, or TOCTOU window) rather than a straightforward memory safety failure in isolation. Affected CPE strings cover the kernel components of Windows Server 2025 (builds below 10.0.26100.33296) and Windows 11 versions 23H2, 24H2, 25H2, and 26H1.
RemediationAI
Microsoft has released patches for all affected Windows versions; organizations should apply the relevant cumulative update immediately. Target build floors are: Windows 11 23H2 - update to build 10.0.22631.7517 or later; Windows 11 24H2 and Windows Server 2025 - update to build 10.0.26100.33296 or later; Windows 11 25H2 - update to build 10.0.26200.9168 or later; Windows 11 26H1 - update to build 10.0.28000.2704 or later. The Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62780 provides official patch links and update guidance. If immediate patching cannot be completed (e.g., due to change-control freeze), restrict interactive local logon rights to only necessary administrative accounts via Group Policy (deny 'Log on locally' for non-essential users), and deploy Endpoint Detection and Response tooling with kernel-level privilege escalation detection rules; note that neither control eliminates the vulnerability - they only reduce the attack surface by limiting which accounts can establish the required local session.
More in Windows 11 23h2
View allInternet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Windows SmartScreen Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.6), this vulnerability is remotel
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today