Use-After-Free Local Privilege Escalation in Microsoft Windows Win32K
CVSS 3.1
7.8high
EPSS
3%p84
Published
()
Modified
AI analysis
Microsoft Windows Win32K (win32kfull.sys) contains a use-after-free (CWE-416) that allows an authorized, already-authenticated local attacker to elevate privileges. A low-privileged local process can trigger the flaw by causing the Win32K kernel-mode graphics/driver component to use memory that has been freed, leading to kernel-level corruption and code execution in kernel context. Successful exploitation yields full local privilege escalation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). Users of the listed Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2016, 2019, 2022) builds are affected. There is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; however, the bug was demonstrated at Pwn2Own (ZDI-26-541), and EPSS assigns a 2.6% probability of exploitation within 30 days (84th percentile).
What to do: Apply Microsoft's cumulative security update that resolves CVE-2026-65775 to every affected Windows 10/11 and Windows Server build and verify the patched win32kfull.sys version. Because exploitation requires local access, prioritize multi-user and shared Windows systems such as RDS/VDI hosts, terminal servers, and shared workstations, and restrict execution of untrusted code by low-privileged users. Until patched, monitor for local privilege-escalation indicators such as unexpected SYSTEM-context processes on affected hosts.
Affected
microsoft Windows 10
1607
microsoft Windows 10
1809
microsoft Windows 10
21H2
microsoft Windows 10
22H2
microsoft Windows 11
23H2
microsoft Windows 11
24H2
microsoft Windows 11
25H2
microsoft Windows 11
26H1
microsoft Windows Server
2012
microsoft Windows Server
2016
microsoft Windows Server
2019
microsoft Windows Server
2022
Estimated exposure
mass≈hundreds of millions of Windows endpoints (the affected builds cover essentially all currently supported Windows 10, Windows 11, and Windows Server releases) — Windows holds roughly 70% of desktop OS market share and the affected Win32K component ships in every listed desktop and server build, so exposure is effectively the entire supported Windows installed base, even though exploitation…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows 11 24h2, windows 11 25h2, windows 11 26h1, windows server 2012, windows server 2016, windows server 2019, windows server 2022
ZDI discloses a Pwn2Own Windows win32kfull use-after-free local privilege escalation flaw (CVE-2026-65775, CVSS 8.8) requiring existing low-privileged code execution.
ZDI advisory ZDI-26-541 describes a use-after-free in Microsoft Windows win32kfull that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute low-privileged code on the target system. The flaw carries a CVSS score of 8.8 and is assigned CVE-2026-65775; it was demonstrated at Pwn2Own.