Executive brief
A security vulnerability has been identified in the Windows Win32K component, which manages graphics and windowing for the operating system. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive data, install malicious software, or disrupt business operations.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in the Windows Win32K kernel-mode driver. The flaw is triggered when the component improperly handles memory allocation for graphics-related objects. An attacker with low-privileged local access can exploit this by running a specially crafted application to overwrite adjacent memory, leading to local privilege escalation (LPE). Successful exploitation allows the attacker to escape the user context and execute code with SYSTEM privileges. Microsoft has released security updates to address this issue across multiple versions of Windows and Windows Server.
Affected products
- Microsoft Windows 10 Version 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Version 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 Standard and Server Core installations
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Security updates made available by Microsoft