OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-70108Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in the Windows Win32 kernel subsystem allows a local user to elevate privileges and execute code with system-level rights. This affects Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2; and Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures.

What this means
What could happen
An authorized local user could execute code with system privileges, allowing them to modify system configurations, access sensitive data, or disrupt normal operations on an affected Windows system.
Who's at risk
Any organization using Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should apply patches immediately. This affects engineering workstations, operator consoles, data historian servers, and administrative terminals used to manage industrial systems.
How it could be exploited
An attacker with local user-level access runs a malicious application that triggers a heap-based buffer overflow in the Win32 kernel subsystem, causing the kernel to execute arbitrary code with elevated (system) privileges. This allows the attacker to gain complete control of the machine.
Prerequisites
  • Local user account access on the Windows system
  • Ability to execute applications on the affected system
Low complexity attackRequires local user accountHigh privilege impact (system-level code execution)Affects many Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/2
Do now
0/2
HOTFIXApply the October 2026 security update for your Windows version immediately
WORKAROUNDIf immediate patching is not possible, restrict local user access to systems requiring elevated privileges until patches can be applied
View full vendor advisory
API: /api/v1/advisories/2ccfca86-03e0-4de1-8c70-7577b77928e9

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.