CVE-2026-70289

CVE-2026-70289 is a heap-based buffer overflow (CWE-122) in the Win32 Kernel Subsystem of Microsoft Windows, the kernel component that services Win32/GUI-related system calls. An authorized local user could trigger the flaw by exercising the affected kernel code path, corrupting heap memory with no user interaction required (AV:L/PR:L/UI:N per the CVSS vector). Successful exploitation would let the attacker elevate from a limited local account to kernel-level privileges, with high impact on the confidentiality, integrity, and availability of the host. All Windows editions containing the vulnerable Win32 Kernel Subsystem code are plausibly exposed; exact affected version ranges are defined by Microsoft's advisory and were not provided in the source data. No exploitation is confirmed so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Install Microsoft's Windows security update addressing CVE-2026-70289 via Windows Update or your patch-management channel once released, and confirm against Microsoft's advisory which builds are affected. Until patched, prioritize systems where low-privileged or untrusted users can run code — shared workstations, terminal/RDS servers, and VDI hosts — and restrict local logon rights on sensitive machines.