CVE-2026-24285: Microsoft Office Privilege Escalation Flaw

CVE-2026-24285 Overview

CVE-2026-24285 is a use-after-free vulnerability [CWE-416] in the Windows Win32K kernel-mode subsystem. An authenticated local attacker can exploit the flaw to elevate privileges to SYSTEM. Microsoft published the advisory on March 10, 2026, covering supported Windows client and server releases as well as Microsoft Office for Android. Successful exploitation grants full confidentiality, integrity, and availability impact on the affected host. The attack requires local code execution with low privileges and no user interaction, though Microsoft notes high attack complexity. The vulnerability resides in a kernel component that handles window manager and graphics device interface (GDI) operations, making it a common target for post-compromise privilege escalation chains.

Critical Impact

Local attackers who already hold low-privileged access can trigger a Win32K use-after-free condition to gain SYSTEM-level privileges across all supported Windows versions.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2)
• Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025
• Microsoft Office for Android

Discovery Timeline

• 2026-03-10 - CVE-2026-24285 published to NVD
• 2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-24285

Vulnerability Analysis

The flaw is a use-after-free condition [CWE-416] inside Win32K, the Windows kernel subsystem that implements the window manager (win32k.sys) and GDI primitives. Win32K manages user-mode callbacks during window message processing, and these callbacks have historically introduced object lifetime bugs. When kernel code dereferences a freed object pointer, an attacker who controls the memory layout can substitute a crafted structure and redirect execution or corrupt kernel state.

Successful exploitation results in kernel-mode code execution, which translates directly into SYSTEM privileges. The high attack complexity reflects the need to win a race or carefully shape kernel pool memory before triggering the dangling reference.

Root Cause

The vulnerability stems from improper management of a kernel object lifecycle in Win32K. Code paths release an object while another reference remains reachable, allowing reuse of the freed allocation. Win32K objects such as window structures, menus, and device contexts share pool memory that can be reclaimed by attacker-controlled allocations.

Attack Vector

Exploitation requires local access with valid low-privileged credentials. The attacker runs code that issues specific Win32K system calls or messages to free an object and then reference it. By spraying replacement objects into the same pool slot, the attacker controls the dereferenced data and pivots to arbitrary kernel read or write primitives. No verified public proof-of-concept code is available for CVE-2026-24285, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-24285

Indicators of Compromise

• Unexpected creation of SYSTEM-level processes spawned from medium or low integrity parent processes.
• Kernel bug checks (BSOD) referencing win32k.sys or win32kfull.sys on otherwise stable hosts.
• Suspicious user-mode processes performing large numbers of NtUserCreateWindowEx, NtGdi*, or NtUserMessageCall invocations.

Detection Strategies

• Monitor for token manipulation events where a process token changes to NT AUTHORITY\SYSTEM without a legitimate parent service.
• Hunt for processes loading unusual modules immediately before privilege changes, indicating local exploit staging.
• Correlate Sysmon Event ID 1 (process create) and Event ID 10 (process access) data to identify post-exploitation lateral actions.

Monitoring Recommendations

• Enable Windows Defender Exploit Guard and kernel-mode code integrity logging to capture anomalous kernel behavior.
• Forward kernel crash dumps and WER reports to a central data lake for pattern analysis across endpoints.
• Baseline Win32K syscall usage per process and alert on statistical outliers from non-GUI binaries.

How to Mitigate CVE-2026-24285

Immediate Actions Required

• Apply the March 2026 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows and Windows Server systems.
• Restrict local logon rights on servers and privileged workstations to limit who can stage local exploits.
• Audit endpoints for unpatched legacy builds such as Windows 10 1607 and Server 2012 that may require Extended Security Updates.

Patch Information

Microsoft has released security updates addressing CVE-2026-24285 for Windows 10, Windows 11, Windows Server 2012 through 2025, and Microsoft Office for Android. Patches are distributed through Windows Update, WSUS, and the Microsoft Update Catalog. Administrators should validate update deployment status using Get-HotFix or configuration management tooling and prioritize systems exposed to multi-user or terminal services workloads.

Workarounds

• Apply Win32K system call filtering policies on supported Windows builds to block untrusted processes from invoking Win32K interfaces.
• Enforce application allowlisting with Windows Defender Application Control (WDAC) or AppLocker to prevent execution of unauthorized binaries.
• Reduce the number of standing local administrators and disable interactive logon for service accounts.

# Enable Win32k system call filtering for a process via process mitigation policy (PowerShell)
Set-ProcessMitigation -Name "<ProcessName.exe>" -Enable Win32kSystemCallDisable

# Verify installed updates on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20