Executive brief
A security vulnerability has been identified in the core drivers of the Windows operating system. This flaw could allow a user who already has limited access to a computer to gain full administrative control over the system. Such an escalation of privileges could lead to unauthorized access to sensitive data, the installation of malicious software, or a complete system takeover.
Technical details
A use-after-free vulnerability (CWE-416) exists in the Windows Kernel-Mode Drivers. The flaw is triggered when the kernel attempts to access a memory location that has already been deallocated. An attacker with low-privileged local access can exploit this condition to execute code in kernel mode. Successful exploitation allows the attacker to elevate their privileges to SYSTEM level. The attack requires high complexity, likely due to race conditions or specific memory layout requirements, but does not require user interaction. Microsoft has released security updates to address this issue across affected Windows 11 and Windows Server 2025 versions.
Affected products
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory