Executive brief
A security vulnerability exists in the Windows Kernel, the core component of the Windows operating system that manages system memory and hardware. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive data, install malicious software, or disrupt business operations.
Technical details
This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition within the Windows Kernel Memory management. The flaw occurs when the kernel validates a memory pointer or condition but the state is modified by a malicious local process before the kernel actually uses it. An attacker with low-privileged local access can exploit this race condition to trigger a heap-based buffer overflow or otherwise manipulate kernel memory. Successful exploitation allows the attacker to execute code with SYSTEM privileges, effectively bypassing local security boundaries. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2012 R2 All versions
Timeline
- 2026-01-13: disclosed
- 2026-01-13: advisory