Executive brief
A critical vulnerability has been identified in the Windows operating system kernel, which manages the core operations of the computer. This flaw allows a remote attacker to gain full control over a system without needing any user interaction or login credentials. An exploit could lead to a total compromise of the affected server or workstation, resulting in data theft, service disruption, or the installation of malware.
Technical details
This vulnerability is classified as a Use-After-Free (CWE-416) and Heap-based Buffer Overflow (CWE-122) within the Windows Kernel. The flaw is triggered when the kernel improperly handles objects in memory, allowing an attacker to send specially crafted network packets to a vulnerable system. Because the vulnerability exists at the kernel level and is reachable over the network without authentication (AV:N/AC:L/PR:N/UI:N), a successful exploit grants the attacker SYSTEM-level privileges. This can lead to full remote code execution (RCE). Microsoft has released security updates to address this issue via the MSRC.
Affected products
- Microsoft Windows All supported versions
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory