Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-56176Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Windows Win32K graphics subsystem contains an out-of-bounds read vulnerability (CVE-2026-56176) affecting multiple versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. An authorized local user can exploit this to escalate privileges to system level. Exploitation is assessed as less likely. Microsoft has released fixes for all affected product versions.
What this means
What could happen
A user with local access to a Windows workstation or server can exploit this vulnerability to gain system-level privileges, potentially allowing them to modify critical process configurations or interfere with control logic running on that machine.
Who's at risk
Windows IT administrators managing Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 deployments. This is particularly relevant for any Windows system used to manage OT equipment, industrial controllers, or safety systems, as well as any engineering workstations with local network access to critical infrastructure.
How it could be exploited
An attacker with a local user account on the Windows system executes a specially crafted application that triggers an out-of-bounds read in the Win32K graphics subsystem, escalating their privileges from user to system level. This requires the attacker to already have logon access to the machine.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute an application on the system
local access requiredlow complexityaffects workstations managing OT systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the 2026-Jul security update to all affected Windows 10, Windows 11, and Windows Server systems
Long-term hardening
0/2HARDENINGRestrict local logon access to Windows systems to authorized users only; disable unnecessary local accounts
HARDENINGEnsure antivirus and endpoint detection systems are enabled and current to detect exploitation attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/71b209a9-50d6-45a3-a467-d954d40d4531Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.