ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses a Pwn2Own Windows win32kfull use-after-free local privilege escalation flaw (CVE-2026-65775, CVSS 8.8) requiring existing low-privileged code execution.
ZDI advisory ZDI-26-541 describes a use-after-free in Microsoft Windows win32kfull that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute low-privileged code on the target system. The flaw carries a CVSS score of 8.8 and is assigned CVE-2026-65775; it was demonstrated at Pwn2Own.
- Use-after-free in Windows win32kfull enables local privilege escalation
- Requires prior ability to run low-privileged code on target
- CVSS 8.8, assigned CVE-2026-65775, Pwn2Own finding
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-65775 | Use-After-Free Local Privilege Escalation in Microsoft Windows Win32K Microsoft Windows Win32K (win32kfull.sys) contains a use-after-free (CWE-416) that allows an authorized, already-authenticated local attacker to elevate privileges. A low-privileged local process can trigger the flaw by causing the Win32K kernel-mode graphics/driver component to use memory that has been freed, leading to kernel-level corruption and code execution in kernel context. Successful exploitation yields full local privilege escalation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). Users of the listed Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2016, 2019, 2022) builds are affected. There is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; however, the bug was demonstrated at Pwn2Own (ZDI-26-541), and EPSS assigns a 2.6% probability of exploitation within 30 days (84th percentile). Do: Apply Microsoft's cumulative security update that resolves CVE-2026-65775 to every affected Windows 10/11 and Windows Server build and verify the patched win32kfull.sys version. Because exploitation requires local access, prioritize multi-user and shared Windows systems such as RDS/VDI hosts, terminal servers, and shared workstations, and restrict execution of untrusted code by low-privileged users. Until patched, monitor for local privilege-escalation indicators such as unexpected SYSTEM-context processes on affected hosts. | 7.8 | 3% |
| mass≈hundreds of millions of Windows endpoints (the affected builds cover essentially all currently supported Windows 10, Windows 11, and Windows Server releases) |
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-65775.
This source does not provide full text. Read it at zerodayinitiative.com.