Junglewise Threat Intelligence

CVE-2026-20809: Microsoft Windows Kernel privilege escalation via TOCTOU race condition

CVE-2026-20809 · Severity: high · CVSS 7.8 · Published 2026-01-13

Technologies: Microsoft Windows Server 2012 R2, Microsoft Windows 10, Microsoft Windows 11. Vendors: Microsoft.

Executive brief

A security vulnerability exists in the Windows Kernel, the core component of the Windows operating system that manages system memory and hardware. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive data, install malicious software, or disrupt business operations.

Technical details

This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition within the Windows Kernel Memory management. The flaw occurs when the kernel validates a memory pointer or condition but the state is modified by a malicious local process before the kernel actually uses it. An attacker with low-privileged local access can exploit this race condition to trigger a heap-based buffer overflow or otherwise manipulate kernel memory. Successful exploitation allows the attacker to execute code with SYSTEM privileges, effectively bypassing local security boundaries. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server versions.

Affected products

  • Microsoft Windows 10 1607, 1809, 21H2, 22H2
  • Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
  • Microsoft Windows Server 2012 R2 All versions

Timeline

  • 2026-01-13: disclosed
  • 2026-01-13: advisory

References

Related threats