Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-62733Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in Windows Win32K allows a user with local access to elevate privileges to administrative level. The flaw is in the Win32K kernel driver and affects Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, and 2025 across 32-bit, 64-bit, and ARM64 architectures.
What this means
What could happen
A user with standard access to a Windows workstation or server can exploit this flaw to gain administrative privileges, potentially allowing unauthorized changes to system configuration, access to sensitive files, or deployment of malware across your IT infrastructure.
Who's at risk
Windows IT administrators managing Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 across all architectures. This affects any organization using these operating systems for workstations, file servers, or domain controllers.
How it could be exploited
An attacker with a local user account on a Windows system exploits an out-of-bounds read in the Win32K kernel driver to escalate to administrative privileges. This requires the attacker to already have interactive logon access to the machine (e.g., via a compromised user account or RDP session).
Prerequisites
- Local user account on the Windows system
- Interactive logon access (interactive session or remote desktop)
- Ability to execute code in user context
Low complexity exploitationNo authentication required for user who already has local accessHigh CVSS score (7.8)
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the 2026-Aug Windows security updates to all affected systems
Long-term hardening
0/2HARDENINGRestrict local logon rights on domain-joined systems to minimize the number of user accounts with interactive access
HARDENINGEnable Credential Guard on Windows 10 and later systems to prevent credential theft that could lead to lateral movement after privilege escalation
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/5ff754e4-b0ec-4855-9bb7-77e253fe0f44Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.