ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI discloses a Windows dxgkrnl time-of-check time-of-use bug enabling local privilege escalation.
The Zero Day Initiative published ZDI-26-751, a time-of-check time-of-use local privilege escalation in Microsoft Windows dxgkrnl, assigned CVE-2026-50375. A local attacker who can already run low-privileged code can escalate privileges. ZDI rates it CVSS 8.8. The advisory does not report observed exploitation.
- Tracked as ZDI-26-751 and CVE-2026-50375.
- Time-of-check time-of-use bug in the Windows dxgkrnl driver.
- Exploitation requires existing low-privileged local code execution.
- ZDI assigns CVSS 8.8; no in-the-wild exploitation is stated.
- CVEs
- CVE-2026-50375
- Vendors
- Microsoft
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50375 | Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.