CVE-2026-25184: Windows 11 23h2 Privilege Escalation Flaw

CVE-2026-25184 Overview

CVE-2026-25184 is a race condition vulnerability in the Microsoft AppLocker Filter Driver (applockerfltr.sys). The flaw stems from concurrent execution using a shared resource without proper synchronization [CWE-362]. An authenticated local attacker can exploit the timing window to elevate privileges on affected Windows systems. Microsoft published the advisory on April 14, 2026, and updated it on April 24, 2026. The vulnerability affects multiple supported releases of Windows 11 and Windows Server.

Critical Impact
Successful exploitation grants SYSTEM-level privileges from a low-privileged user context, enabling full compromise of the local host through a kernel driver race condition.

Affected Products

Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2026-04-14 - CVE-2026-25184 published to NVD
2026-04-14 - Microsoft releases security update via MSRC advisory
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-25184

Vulnerability Analysis

The AppLocker Filter Driver (applockerfltr.sys) enforces application control policies in the Windows kernel. The driver accesses a shared resource from multiple concurrent execution paths without enforcing proper synchronization primitives. An attacker who can trigger the affected code paths in parallel creates a Time-of-Check Time-of-Use (TOCTOU) condition. Winning the race allows the attacker to substitute or modify the shared resource between validation and use. The outcome is execution with kernel privileges, which Windows treats as SYSTEM in user-mode terms.

Root Cause

The root cause is improper synchronization of access to a kernel-mode shared resource within applockerfltr.sys. Missing or insufficient locking, such as the absence of an acquired spinlock or executive resource around the affected structure, permits a second thread to mutate state during a critical section. This category of defect is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Attack Vector

Exploitation requires local access and valid credentials with low privileges. The attack complexity is high because the attacker must reliably hit a narrow timing window, often by spawning multiple threads pinned to different cores and repeatedly triggering the vulnerable driver path. No user interaction is required. The scope remains unchanged, but the confidentiality, integrity, and availability of the host are fully compromised on success. No public proof-of-concept code is listed in the NVD references, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list.

Technical details for the vulnerable code paths have not been publicly disclosed by Microsoft. Refer to the Microsoft CVE-2026-25184 Update for vendor-provided information.

Detection Methods for CVE-2026-25184

Indicators of Compromise

Unexpected loading, unloading, or crashes of applockerfltr.sys recorded in the System event log or WER reports.
Creation of new SYSTEM-level processes spawned from a parent running under a standard user token.
Kernel bugchecks (BSOD) referencing applockerfltr.sys during high-concurrency user activity, which can indicate failed exploitation attempts.

Detection Strategies

Monitor for processes that rapidly invoke AppLocker-related APIs or repeatedly trigger application control evaluations in tight loops.
Alert on token elevation events where a non-administrative user context obtains a SYSTEM or High integrity token without a corresponding legitimate elevation path (e.g., UAC consent prompt).
Correlate Windows Security event ID 4672 (special privileges assigned to new logon) with the originating process lineage to detect anomalous privilege grants.

Monitoring Recommendations

Enable Windows Defender Application Control and AppLocker auditing to track policy evaluation activity sourced from applockerfltr.sys.
Forward Sysmon driver load (event ID 6) and process creation (event ID 1) telemetry to a SIEM for centralized correlation.
Track patch state across the fleet to confirm the April 2026 cumulative updates are installed on every affected Windows 11 and Windows Server build.

How to Mitigate CVE-2026-25184

Immediate Actions Required

Apply the April 2026 Microsoft security updates referenced in the MSRC advisory for CVE-2026-25184 to all affected Windows 11 and Windows Server hosts.
Inventory endpoints to identify systems still running unpatched 23H2, 24H2, 25H2, or 26H1 builds and prioritize them for remediation.
Restrict interactive and remote logon rights on sensitive systems to limit which accounts can stage a local exploit.

Patch Information

Microsoft has released cumulative security updates that remediate the synchronization defect in applockerfltr.sys. Administrators should consult the Microsoft CVE-2026-25184 Update for the specific KB articles tied to each Windows build and deploy them through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

No vendor-supplied workaround is documented. Patching is the only supported remediation.
As a defense-in-depth measure, enforce least-privilege policies and remove local administrator rights from standard users to reduce post-exploitation impact.
Where AppLocker is not required, evaluate whether the filter driver can be limited via service configuration, while recognizing this may reduce application control coverage.

bash

# Verify patch deployment status on Windows hosts via PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm the AppLocker filter driver version on a target system
Get-Item C:\Windows\System32\drivers\applockerfltr.sys |
    Select-Object Name, VersionInfo