Executive brief
A security vulnerability exists in the Windows Kernel, the core component of the Microsoft Windows operating system. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to access sensitive data, install malicious software, or disrupt business operations.
Technical details
A use-after-free (CWE-416) vulnerability exists within the Windows Kernel. The flaw is triggered when the kernel continues to use a memory pointer after the memory it points to has been freed, leading to memory corruption. To exploit this, an attacker must first have local access to the system with low-level user privileges. While the attack complexity is rated as high—likely due to race conditions or specific memory layout requirements—a successful exploit allows the attacker to gain SYSTEM-level privileges. Microsoft has released information regarding this vulnerability as part of their June 2026 update cycle.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory