Vulnerabilities
CVE-2026-70063: Local Windows Kernel Information Disclosure Vulnerability
Microsoft has identified CVE-2026-70063, an out‑of‑bounds read in the Windows kernel that permits a local, authorized attacker to read sensitive memory. The flaw is fixed in the latest cumulative update for Windows 10, Windows 11, and Windows Server 2022. Defenders should verify that the update is installed and monitor for any anomalous local privilege activity.
Windows kernel code performed an out‑of‑bounds read that can expose arbitrary memory contents to a local user with sufficient privileges.
What happened
The vulnerability, identified as CVE‑2026‑70063, originates from an unchecked pointer dereference in the kernel's memory handling routines. An attacker who can execute code on the local machine can trigger the read and capture data that may include secrets, configuration details, or other sensitive information.
Impact
All supported Windows 10, Windows 11, and Windows Server 2022 installations are affected. The flaw does not allow remote exploitation or privilege escalation on its own, but it can aid in building a larger attack chain.
Mitigation
- Apply the latest cumulative update released by Microsoft (KBxxxxxx) for the affected OS.
- Verify that the update is installed via Windows Update or WSUS.
- Restart the system if the update requires a reboot.
What to do
Defenders should immediately check the update status on all endpoints, enforce the patch, and monitor for anomalous local privilege activity. If the update cannot be applied, isolate the affected systems until remediation is possible.
Related vulnerabilities
CVE-2026-108462: Windows Kernel Information Disclosure Vulnerability
Microsoft has identified a Windows kernel information disclosure flaw (CVE‑2026‑108462) that permits local attackers with elevated privileges to read sensitive system data. The issue is fixed in the latest security update; administrators should apply the patch immediately and verify that kernel memory is protected.
Read briefing
CVE-2026-69971: Windows Kernel-Mode Driver Information Disclosure Vulnerability
A flaw in Windows kernel‑mode drivers permits an authenticated local user to read protected data. Microsoft has issued a patch; defenders should update systems and monitor for suspicious activity.
Read briefing
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
CVE-2026-70077: Windows Kernel Use‑After‑Free Information Disclosure
Microsoft released a patch for CVE-2026-70077, a kernel‑level use‑after‑free flaw that lets local attackers read arbitrary memory. Affected Windows systems can expose sensitive data if an attacker gains local privileges. Defenders should apply the update immediately, audit local admin accounts, and monitor for anomalous memory access.
Read briefing