Executive brief
Windows Win32K, the low-level graphics and window management kernel component, contains an authorization flaw that allows a locally authenticated attacker to escalate their privileges to system level. An attacker with standard user access can exploit this to gain full system control, potentially compromising the entire computer and accessing sensitive data or deploying malware.
Technical details
This vulnerability is an incorrect authorization flaw in Windows Win32K, the kernel subsystem responsible for graphics and window management. The vulnerability allows an authenticated local attacker to bypass authorization checks and escalate privileges. Exploitation requires local access and prior authentication on the target system. A successful exploit grants the attacker system-level privileges, enabling code execution at the highest privilege level. Microsoft has issued security updates to address the authorization bypass.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed