Vulnerabilities
CVE-2026-70114: Windows Kernel Heap Overflow Enables Local Privilege Escalation
Microsoft has identified a heap-based buffer overflow in the Windows kernel that allows an authorized local user to gain SYSTEM privileges. The vulnerability affects Windows 10, 11, and Windows Server 2016/2022. Defenders should apply the latest cumulative update and enforce least‑privilege controls.
What happened
Microsoft disclosed a heap-based buffer overflow in the Windows kernel that can be triggered by a local user with sufficient privileges. The flaw allows the attacker to corrupt kernel memory and execute arbitrary code at elevated rights.
Impact
Systems affected include Windows 10, Windows 11, and Windows Server 2016/2022. An attacker who can run code locally can gain SYSTEM privileges, enabling full control over the machine.
What to do
Defenders should:
- Install the latest cumulative update that contains the fix for CVE-2026-70114.
- Apply the patch as soon as it is available; it is included in the regular Windows Update cycle.
- Restrict local user privileges and enforce least‑privilege principles to limit the attack surface.
- Monitor for anomalous kernel activity and use endpoint detection and response (EDR) to detect exploitation attempts.
Related vulnerabilities
CVE-2026-70108: Windows Win32k Heap Overflow Enables Local Privilege Escalation
Microsoft disclosed CVE‑2026‑70108, a heap‑based buffer overflow in the Win32 kernel subsystem that lets an authenticated local user elevate privileges. The flaw is present in all current Windows releases until patched. Defenders should apply the latest cumulative update and monitor for anomalous privilege changes.
Read briefing
CVE-2026-70121: Windows Kernel Heap Overflow Enables Local Privilege Escalation
A heap-based buffer overflow in the Windows kernel can be exploited by an authorized user to gain elevated privileges. The flaw affects all recent Windows releases until patched. Defenders should apply the latest Microsoft security updates and monitor for anomalous privilege changes.
Read briefing
CVE‑2026‑83678: Windows TCP/IP Heap Overflow Enables Local Privilege Escalation
A heap‑based buffer overflow in the Windows TCP/IP stack (CVE‑2026‑83678) allows a local attacker with authorized access to elevate privileges. Microsoft has issued a patch; administrators should apply it immediately and tighten local privilege controls.
Read briefing
CVE-2026-83650: Windows Media Heap Overflow Enables Local Privilege Escalation
A heap‑based buffer overflow in Windows Media components allows an authorized user to elevate privileges on the local machine. The flaw is present in all Windows 10/11 builds that ship with the Media Foundation runtime. Defenders should apply the latest MSRC update and enforce least‑privilege for media services.
Read briefing