Executive brief
Windows Win32K is a core kernel-mode driver that handles graphical user interface operations and window management on all Windows systems. A race condition in this component allows a local authenticated user to bypass privilege restrictions and gain elevated system access, potentially compromising the entire system.
Technical details
A time-of-check time-of-use (TOCTOU) race condition exists in Windows Win32K kernel driver. The vulnerability occurs between a security check and the subsequent use of the checked value, allowing an attacker to alter the state in between these operations. An attacker with local access and valid credentials can exploit this race condition to escalate privileges to SYSTEM level. No precondition beyond local authentication and execution capability is required. The vulnerability was patched by Microsoft in the security update released on 2026-09-08.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed