Executive brief
A security vulnerability has been identified in the Windows Kernel, the core component of the Microsoft Windows operating system. This flaw allows a user who already has basic access to a computer to gain full administrative control. Such an exploit could be used by attackers to bypass security restrictions, access sensitive data, or install persistent malware on affected servers and workstations.
Technical details
This vulnerability is characterized as a heap-based buffer overflow (CWE-122) and untrusted pointer dereference (CWE-822) within the Windows Kernel. An attacker with low-privileged local access can exploit this flaw by executing a specially crafted application to trigger memory corruption. Successful exploitation allows the attacker to gain elevated privileges, potentially achieving full SYSTEM-level access. The vulnerability affects multiple versions of Windows 11 and Windows Server 2025; patches have been released by Microsoft to address the issue.
Affected products
- Microsoft Windows 11 26H1 up to (excluding) 10.0.28000.2113
- Microsoft Windows 11 24H2 up to (excluding) 10.0.26100.8390
- Microsoft Windows 11 25H2 up to (excluding) 10.0.26200.8390
- Microsoft Windows Server 2025 up to (excluding) 10.0.26100.32772
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Initial advisory published by Microsoft
- 2026-06-01: other: Description updated from untrusted pointer dereference to heap-based buffer overflow