Executive brief
A security vulnerability has been identified in the Windows Win32K component, which manages graphics and windowing for the operating system. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to access sensitive data, install malicious software, or disrupt business operations.
Technical details
This vulnerability is a race condition (CWE-362) within the Windows Win32K kernel-mode driver. The flaw stems from improper synchronization when accessing shared resources, which can lead to a use-after-free (CWE-416) condition. An attacker with local access and low privileges can exploit this timing issue to execute code in kernel mode. Successful exploitation allows for a full privilege escalation to SYSTEM. The attack requires the attacker to win a race condition, making the exploit complexity high, but it does not require user interaction.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
Timeline
- 2026-07-14: disclosed: Initial disclosure by Microsoft and NVD
- 2026-07-14: advisory: Microsoft Security Update Guide published