OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-62877Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A stack-based buffer overflow in Windows Win32K (kernel graphics component) allows a locally authenticated attacker to escalate privileges. The vulnerability is in kernel-mode code and can be triggered via local API calls, enabling an unprivileged user to gain administrative rights on the affected system.

What this means
What could happen
An attacker with a local user account could exploit this Windows kernel vulnerability to gain administrative privileges, potentially allowing them to modify system settings, install unauthorized software, or interfere with critical industrial control applications running on that workstation or server.
Who's at risk
Organizations running Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 should prioritize this fix. This affects engineering workstations, HMI servers, historian systems, and any other Windows-based industrial control software platforms.
How it could be exploited
The attacker must have a local user account on the Windows system. They trigger the stack-based buffer overflow in the Win32K kernel component through a local API call, causing the kernel to execute arbitrary code with administrative privileges.
Prerequisites
  • Local user account on the Windows system
  • Ability to execute code on the affected Windows machine
Local privilege escalationRequires valid local credentialsLow complexity attackAffects systems with local users
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the August 2026 Windows security update (or later monthly patch) to all affected Windows 10, Windows 11, and Windows Server systems
Long-term hardening
0/1
HARDENINGRestrict local logon privileges to minimize the number of user accounts that can access affected systems
View full vendor advisory
API: /api/v1/advisories/ff039fca-5f17-43a3-bf2c-ec76749c9016

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Win32k Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse