Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-70117Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker with local access to elevate privileges. Affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 on 32-bit, x64, and ARM64 platforms. Exploitation is assessed as "More Likely."
What this means
What could happen
A user with local access to a Windows machine could exploit this kernel buffer overflow to gain administrator privileges, potentially allowing them to modify PLC communications, alter HMI settings, or execute unauthorized commands on critical infrastructure systems.
Who's at risk
Any organization running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems in their IT or OT networks should patch. This is particularly important for engineering workstations, historian servers, HMI systems, and any Windows-based remote access points that communicate with PLCs, RTUs, or network switches.
How it could be exploited
An attacker with a local user account on a Windows system triggers a heap buffer overflow in the Win32 kernel subsystem through a crafted operation, which escalates their privileges to administrator level. From there, they could interact with connected OT devices, networking, or data services without additional authentication.
Prerequisites
- Local user account on the Windows system
- Ability to execute code or trigger specific Win32 API calls locally
low complexityrequires local accessprivilege escalationhigh CVSS score (7.8)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the 2026-Oct security update for your Windows version (see fixed build numbers in advisory)
Long-term hardening
0/2HARDENINGRestrict local login access to Windows systems to authorized personnel only; remove unnecessary local user accounts
HARDENINGEnable application allowlisting on Windows systems in critical network zones to prevent unauthorized code execution
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2354ac42-a068-46bd-b575-bad9c0dcc922Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.