Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-70285Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow vulnerability exists in the Windows Win32 Kernel Subsystem that allows an authorized local attacker to elevate their privileges to system level. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016, 2019, 2022, and 2025 across multiple architectures (32-bit, x64, ARM64). Microsoft has released patches for all affected versions.
What this means
What could happen
An attacker with local access to a Windows workstation or server running vulnerable versions could exploit a buffer overflow in the Win32 kernel to gain system-level privileges, allowing them to take full control of the device and modify any processes or data.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 across 32-bit, x64, or ARM64 architectures should prioritize patching. This affects any Windows-based workstations or servers that run industrial applications, HMIs, engineering workstations, or IT infrastructure supporting OT environments.
How it could be exploited
An attacker with an existing user account on the system could run a specially crafted program that triggers a heap-based buffer overflow in the Win32 kernel subsystem, bypassing privilege restrictions to escalate from user-level to system-level access.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute code (applications) on the system
Requires local access to exploitNo authentication bypass involvedLow exploitation complexityAffects all current Windows versionsNot actively exploited (KEV: No)Patches available from vendor
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1HARDENINGRestrict local login access to trusted users and administrators only
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft's October 2026 security updates to all affected Windows systems
Long-term hardening
0/1HARDENINGReview and revoke unnecessary local user accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2ea37f95-de4b-4ae6-a846-a7decd7fd36eGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.