Executive brief
A security vulnerability exists in the core drivers that manage the Windows operating system. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security protections, access sensitive data, or install malicious software.
Technical details
A use-after-free (CWE-416) vulnerability exists within Windows Kernel-Mode Drivers. The flaw is triggered when the kernel continues to use a memory pointer after it has been freed, leading to memory corruption. An attacker with local access and low-level privileges can exploit this condition to execute arbitrary code in kernel mode. Successful exploitation results in a complete compromise of the system's integrity, confidentiality, and availability, effectively granting the attacker SYSTEM-level privileges. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows Kernel-Mode Drivers
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Microsoft released the security update guide for this vulnerability.