OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-65678Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in the Windows Win32k graphics subsystem allows a user with local access to elevate their privileges to administrator level. The vulnerability requires the attacker to have local login access or the ability to execute code with standard user permissions. Microsoft has released fixes in the August 2026 security update.

What this means
What could happen
A user with local login access could execute a malicious program that exploits a memory flaw in the Windows graphics subsystem to gain administrative privileges on the machine. This could allow the attacker to modify system settings, install software, or manipulate data on the affected computer.
Who's at risk
This affects Windows Server systems (2016, 2019, 2022, 2025) and Windows 10/11 desktop systems across all supported versions and architectures. It impacts any organization running Windows-based engineering workstations, human-machine interfaces (HMIs), data historians, or server infrastructure that depends on Windows for supervisory control functions.
How it could be exploited
An attacker with a local user account must log into the Windows machine or have the ability to run code with user privileges. They would execute a specially crafted program that triggers a use-after-free flaw in the Win32k kernel driver to elevate their privileges to administrator level.
Prerequisites
  • Local user account or ability to execute code with standard user privileges
  • User interaction not required once code is executed
Requires local access or user-level code executionLow complexity to exploit once local access is gainedAffects large installed base of Windows systems
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the August 2026 Microsoft security update to all affected Windows systems
Long-term hardening
0/2
HARDENINGImplement local account restrictions and minimize the number of user accounts with local login access to critical systems
HARDENINGEnable and enforce code signing policies (Windows Defender Application Control) to prevent execution of unsigned or untrusted applications
View full vendor advisory
API: /api/v1/advisories/78aa8c1f-efd3-4732-ac13-bffd8d025801

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Win32k Elevation of Privilege Vulnerability | CVSS 7 - OTPulse