Vulnerabilities
CVE-2026-69963: Kernel Streaming Service Driver Local Privilege Escalation
A heap-based buffer overflow in the Windows Kernel Streaming Service driver (ks.sys) allows an authorized local attacker to elevate privileges to SYSTEM. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and verify driver integrity.
What happened
A heap-based buffer overflow was discovered in the Windows Kernel Streaming Service driver (ks.sys). The flaw can be triggered by an authorized local user and results in a local privilege escalation.
Impact
Successful exploitation grants the attacker SYSTEM-level access on the compromised machine, enabling full control over the system. The vulnerability is limited to local attackers with sufficient privileges to load the driver.
What to do
- Apply the latest cumulative update that contains the ks.sys patch.
- Verify that the ks.sys version matches the patched build (e.g., 10.0.22621.XXX).
- Restrict local user privileges and enforce least privilege principles.
- Monitor for anomalous privilege escalation activity using SIEM or endpoint detection.
Microsoft has addressed the issue in the latest cumulative update and recommends applying the update immediately.
Related vulnerabilities
CVE‑2026‑69964: Use‑After‑Free in Windows Kernel Streaming Service Enables Local Privilege Escalation
A use‑after‑free flaw in the Windows Kernel Streaming Service driver allows a local attacker to gain SYSTEM privileges. The vulnerability is rated critical and affects all current Windows releases that include the Streaming Service component. Apply the latest cumulative update or the dedicated patch to eliminate the risk.
Read briefing
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
CVE-2026-83694: Windows Volume Manager Extension Driver Local Privilege Escalation
Microsoft has disclosed a local privilege escalation vulnerability in the Windows Volume Manager Extension Driver (CVE‑2026‑83694). An authenticated attacker can trigger an out‑of‑bounds read, allowing elevation of privileges on the affected system. Defenders should apply the latest security updates and verify driver integrity.
Read briefing