Executive brief
A security vulnerability has been identified in the Windows Kernel, the core component of the Microsoft Windows operating system. This flaw allows an individual who already has basic access to a computer to gain full administrative control. If exploited, an attacker could bypass security restrictions to view sensitive data, install programs, or disrupt system operations.
Technical details
This vulnerability is classified as a Use-After-Free (CWE-416) within the Windows Kernel. The flaw occurs when the kernel continues to use a pointer after it has been freed, leading to memory corruption. An attacker with local access and low-level privileges can exploit this condition by running a specially crafted application. Successful exploitation allows the attacker to execute code with SYSTEM privileges, granting full control over the affected host. The vulnerability is reachable via a local attack vector with low complexity and requires no user interaction.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed: Initial publication by Microsoft and NVD.
- 2026-06-09: advisory