EUVD-2026-99546
GHSA-jfxr-q9rm-vgx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv local code execution
-
DeliveryInvoke vulnerable kernel path
-
ExploitTrigger out-of-bounds read (CWE-125)
-
ExecutionLeak/corrupt kernel memory
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess the ability to execute code locally on the target as an authenticated low-privileged user (PR:L, AV:L) - there is no remote or unauthenticated path and no user interaction is needed. Affected systems are limited to the specified pre-patch builds: Windows 11 24H2 (<10.0.26100.9711), 25H2 (<10.0.26200.9711), 26H1 (<10.0.28000.3231), 26H2 (<10.0.26300.9711), and Windows Server 2025 including Server Core (<10.0.26100.33650). The primary limiting factor is the prerequisite local foothold; patched builds are not exploitable, so this functions as a post-compromise escalation step rather than an entry point. |
| Impact | CVSS 7.8 (HIGH) is driven by local attack vector (AV:L), low complexity (AC:L), and full triad impact (C:H/I:H/A:H) under an unchanged scope, with low privileges required (PR:L) and no user interaction. This is a classic local privilege-escalation profile: an attacker must already be able to run code on the host as a standard authenticated user, so it is not remotely exploitable and cannot be weaponized for initial access. EPSS probability and an SSVC decision point were NOT provided in the input, and the vulnerability is NOT listed in CISA KEV, with no public POC indicated - so there is no confirmed signal of active or imminent exploitation. Weighing these signals, this is a meaningful-but-not-emergency patch priority: a reliable second-stage EoP primitive commonly chained after phishing or commodity-malware foothold, but gated behind prior code execution. One inconsistency to verify: the Tags label this 'Information Disclosure', yet the CVSS vector and description assert full privilege elevation (I:H/A:H), which is broader than pure disclosure - treat the EoP framing (NVD/MSRC vector) as authoritative over the disclosure tag. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing payload or a compromised standard user account) runs a crafted program that triggers the out-of-bounds read in the Windows Kernel to leak sensitive kernel memory and corrupt privileged state, elevating to SYSTEM. No user interaction and no network access are required. No public exploit code is identified at time of analysis, so exploitation currently requires original development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on a vulnerable build to trigger an out-of-bounds read that the vendor rates as full-impact (C:H/I:H/A:H) on confidentiality, integrity, and availability. Only pre-patch builds of Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), are affected; patched builds are not exploitable, so this functions as a post-compromise escalation step rather than an initial access vector. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS 7.8 (HIGH) score and the low-privilege local prerequisite make it a realistic follow-on step after a workstation or server foothold, and Microsoft has released fixes.
RemediationAI
Apply the Microsoft security update for CVE-2026-85837 as documented in the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85837, which moves Windows 11 24H2 to 10.0.26100.9711 or later, 25H2 to 10.0.26200.9711 or later, 26H1 to 10.0.28000.3231 or later, 26H2 to 10.0.26300.9711 or later, and Windows Server 2025 (including Server Core) to 10.0.26100.33650 or later; patch status is vendor-released and no exploit code is currently public, so the standard monthly servicing channel is sufficient. Because exploitation requires an existing low-privileged local foothold (AV:L, PR:L), prioritize hosts where untrusted users already run code - multi-session VDI, jump boxes, RDS/Citrix hosts, and shared build servers - and treat the kernel fix as the only complete remedy; interim compensating controls such as WDAC or AppLocker policies to restrict unauthorized binaries, removal of unnecessary kernel drivers and privileged local tooling, and credential hygiene to limit the value of a local escalation will reduce exposure but do not close the memory-safety defect and carry operational overhead from blocked legitimate software. Detection efforts should focus on EDR telemetry for anomalous kernel-interface call patterns from low-integrity processes, since an escalation step after a foothold may already be preceded by other intrusion activity; note that no specific kernel-level workaround (such as disabling a feature or blocking a port) is documented, so patch latency is the dominant risk factor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-125 out-of-bounds read inside the Windows kernel, the privileged component that mediates memory, object, and scheduling operations for all user-mode processes. OOB reads of this class arise when a kernel routine parses a user-supplied buffer or structure without validating a length, index, or header field against the caller's actual buffer size, so a malformed request causes the kernel to read past the end of the allocated region. Because the caller must be able to reach the affected kernel interface, the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local, low-complexity, unauthenticated-at-network-level attack requiring only low local privileges (PR:L) and no user interaction. The multi-source tags classify the issue under both buffer overflow and information disclosure, which is consistent with an out-of-bounds read primitive, while the vendor-assessed impact extends to the full confidentiality, integrity, and availability triad - a reminder that in kernel context an OOB read can be chained with memory-layout manipulation to corrupt state or leak kernel addresses that defeat mitigations such as KASLR. Affected code paths are bound to the specific kernel binaries shipped in the listed Windows 11 and Windows Server 2025 builds.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP requiring an existing low-privileged account (AV:L/PR:L), no interaction, with kernel compromise yielding full confidentiality/integrity/availability impact within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Windows 11 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 contain a high-severity local privilege escalation vulnerability that enables a low-privileged user to achieve full system compromise, impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, but it represents a realistic escalation path after an initial foothold, making patching critical for both workstations and servers. Leadership should prioritize remediation to prevent attackers from escalating privileges and moving laterally within the environment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB