Junglewise Threat Intelligence

CVE-2026-35417: Microsoft Windows Win32K use after free in GRFX

CVE-2026-35417 · Severity: high · CVSS 7.8 · Published 2026-05-12

Technologies: Microsoft Windows 11, Microsoft Windows, Microsoft Windows Server 2019, Microsoft Windows Server 2025, Microsoft Windows Server 2022, Microsoft Windows 10. Vendors: Microsoft.

Executive brief

A security vulnerability exists in the Windows kernel component responsible for graphics and window management. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to install programs, view or delete sensitive data, or create new accounts with full user rights.

Technical details

This vulnerability is a use-after-free (UAF) located within the Win32K GRFX component of the Windows kernel. While initially reported as a type confusion (CWE-843) in the ICOMP component, updated advisory data confirms it as a UAF in GRFX. An attacker with low-privileged local access can trigger the flaw without user interaction to execute arbitrary code in kernel mode. Successful exploitation results in a complete loss of confidentiality, integrity, and availability, typically leading to local privilege escalation (LPE) to SYSTEM. Microsoft has released security updates to address this issue across supported versions of Windows and Windows Server.

Affected products

  • Microsoft Windows 10 1809, 21H2, 22H2
  • Microsoft Windows 11 23H2, 24H2, 25H2, 26H1
  • Microsoft Windows Server 2019 All versions
  • Microsoft Windows Server 2022 23H2
  • Microsoft Windows Server 2025 All versions

Timeline

  • 2026-05-12: disclosed: Initial disclosure by Microsoft
  • 2026-05-12: advisory: NVD published the CVE record
  • 2026-06-01: other: Description updated from type confusion to use-after-free

References

Related threats