Executive brief
The Windows kernel's Win32 subsystem contains a heap memory corruption flaw that allows a user with local access to crash the system or take control with elevated privileges. This could enable an attacker with a legitimate user account to compromise the entire system and access sensitive data.
Technical details
A heap-based buffer overflow exists in the Windows Win32 Kernel Subsystem, a core component responsible for managing graphical user interface and system services. The vulnerability requires local access and existing user privileges to trigger. A successful exploit permits privilege escalation to SYSTEM level, compromising system integrity and potentially enabling further attacks. No evidence of active exploitation in the wild has been reported. Microsoft has issued patches through its security update program.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed