Vulnerabilities
CVE-2026-70076: Windows Win32k Kernel Use-After-Free Elevates Local Privileges
A use‑after‑free flaw in the Windows Win32k kernel subsystem (CVE‑2026‑70076) lets an authorized local attacker gain SYSTEM privileges. The vulnerability is exploitable on all Windows versions that ship the affected Win32k code. Defenders should apply the latest cumulative update and monitor for anomalous privilege escalation.
What happened
A use‑after‑free bug in the Windows Win32k kernel subsystem (CVE‑2026‑70076) allows an attacker with local access to a privileged account to execute code with SYSTEM rights. The flaw is triggered by manipulating internal Win32k data structures that are freed prematurely.
Impact
Any Windows machine running the affected Win32k code can be compromised by a local user who can then install malware, exfiltrate data, or pivot to other systems. The vulnerability is not exploitable remotely.
What to do
- Apply the latest cumulative security update for Windows that contains the Win32k fix (available via Windows Update or WSUS).
- Verify that the update has been installed on all endpoints.
- Restrict local user privileges; enforce least‑privilege and separate administrative accounts.
- Monitor for abnormal privilege‑escalation events (e.g., unexpected SYSTEM processes).
Mitigation
Until the patch is applied, disable any software that triggers Win32k rendering for non‑trusted processes, if feasible. However, the primary defense is the update.
Related vulnerabilities
CVE-2026-70253: Local Privilege Escalation via Win32k Use‑After‑Free
Microsoft has identified CVE-2026-70253, a use‑after‑free flaw in the Windows Win32 kernel subsystem that allows local attackers to elevate privileges. The vulnerability requires local access and can be exploited by an authorized user to gain higher privileges. Defenders should apply the latest patches and monitor for suspicious activity.
Read briefing
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
CVE-2026-70077: Windows Kernel Use‑After‑Free Information Disclosure
Microsoft released a patch for CVE-2026-70077, a kernel‑level use‑after‑free flaw that lets local attackers read arbitrary memory. Affected Windows systems can expose sensitive data if an attacker gains local privileges. Defenders should apply the update immediately, audit local admin accounts, and monitor for anomalous memory access.
Read briefing
CVE-2026-70026: Windows Secure Kernel Use‑After‑Free Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Secure Kernel allows an authenticated local user to gain SYSTEM privileges. The vulnerability affects Windows 10, 11 and Server 2016‑2022. Microsoft has issued a patch; defenders should apply updates immediately and monitor for suspicious activity.
Read briefing