ZDI-26-539: (Pwn2Own) Microsoft Windows ipt.sys Incorrect Permission Assignment Local Privilege Escalation Vulnerability
ZDI advisory discloses Windows ipt.sys local privilege escalation (CVE-2026-65773, CVSS 7.8) demonstrated at Pwn2Own.
35
CVE-2026-65773
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p15
- Published
- ·
- Modified
Description · NVD
Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
- Vendors
- microsoft
- Products
- windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows 11 24h2, windows 11 25h2, windows 11 26h1, windows server 2019, windows server 2022, windows server 2025
- Weakness
- CWE-284
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H