Vulnerabilities
CVE-2026-70253: Local Privilege Escalation via Win32k Use‑After‑Free
Microsoft has identified CVE-2026-70253, a use‑after‑free flaw in the Windows Win32 kernel subsystem that allows local attackers to elevate privileges. The vulnerability requires local access and can be exploited by an authorized user to gain higher privileges. Defenders should apply the latest patches and monitor for suspicious activity.
The Microsoft Security Response Center (MSRC) has disclosed CVE-2026-70253, a use‑after‑free bug in the Win32 kernel subsystem (Win32k). The flaw allows a local attacker with sufficient privileges to trigger an invalid memory reference and gain elevated rights on the affected machine.
What happened
During normal operation, the Win32k subsystem can free a memory object that is still referenced by another component. An attacker can manipulate the order of operations to cause the subsystem to use the freed memory, enabling arbitrary code execution with higher privileges.
Impact
• Local privilege escalation on Windows 10/11 systems.
• Requires local access and an authorized user context to trigger.
• Once exploited, the attacker can install malware, modify system settings, or access protected data.
What to do
- Apply the latest cumulative update that addresses CVE-2026-70253 as soon as possible.
- Verify that the update has been successfully installed on all endpoints.
- Monitor for anomalous privilege changes or unexpected system behavior.
- Consider restricting local user privileges and enforcing least‑privilege principles.
Microsoft recommends that administrators keep their systems fully patched and enable Windows Defender Exploit Guard to provide additional protection against memory corruption exploits.
Related vulnerabilities
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
CVE-2026-70076: Windows Win32k Kernel Use-After-Free Elevates Local Privileges
A use‑after‑free flaw in the Windows Win32k kernel subsystem (CVE‑2026‑70076) lets an authorized local attacker gain SYSTEM privileges. The vulnerability is exploitable on all Windows versions that ship the affected Win32k code. Defenders should apply the latest cumulative update and monitor for anomalous privilege escalation.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-70274: Windows Bind Filter Driver Local Privilege Escalation
A use‑after‑free flaw in the Windows Bind Filter Driver allows an authenticated local user to elevate privileges. Microsoft has released a patch; defenders should apply it immediately and verify driver integrity.
Read briefing