CVE-2026-33840 Overview
CVE-2026-33840 is a use-after-free vulnerability [CWE-416] in the Windows Win32K ICOMP component. An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows 11 and Windows Server 2025 systems. Successful exploitation yields high impact to confidentiality, integrity, and availability, typically resulting in SYSTEM-level code execution from a standard user context.
Microsoft published the advisory in its May 2026 security update guide. The vulnerability requires local access and low privileges, but no user interaction. EPSS data places the exploit probability at 0.059% with a percentile of 18.45, reflecting low predicted near-term exploitation activity at disclosure.
Critical Impact
A local authenticated attacker can leverage the use-after-free in Win32k ICOMP to gain SYSTEM privileges on unpatched Windows 11 and Windows Server 2025 hosts.
Affected Products
- Microsoft Windows 11 24H2 (x64, ARM64)
- Microsoft Windows 11 25H2 (x64, ARM64)
- Microsoft Windows 11 26H1 (x64, ARM64)
- Microsoft Windows Server 2025
Discovery Timeline
- 2026-05-12 - CVE-2026-33840 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-33840
Vulnerability Analysis
The vulnerability resides in the Windows kernel-mode Win32k subsystem, specifically the ICOMP code path. Win32k.sys handles window manager and GDI operations on behalf of user-mode callers through system call interfaces such as NtUserCall* and NtGdi*. A use-after-free occurs when kernel code references a memory object after it has been released back to the pool.
An attacker who controls the timing and reallocation of that freed object can place attacker-influenced data at the same address. Subsequent kernel dereferences then operate on attacker-controlled structures. In Win32k, such primitives frequently lead to arbitrary kernel read/write, which attackers convert into a token replacement attack to obtain SYSTEM.
Root Cause
The root cause is improper lifetime management of a kernel object within the Win32k ICOMP code path. The component releases an object reference while another code path retains a usable pointer to the same allocation. When the dangling pointer is later dereferenced, the kernel acts on memory that may have been reallocated to a different object type, violating type and state invariants.
Attack Vector
Exploitation requires local code execution as an authenticated user. The attacker invokes specific Win32k system calls in a sequence that triggers premature object teardown, races the allocator to reclaim the freed slot with a controlled object, then issues a follow-up call that operates on the stale pointer. No user interaction is required. The attack vector is local, attack complexity is low, and the scope is unchanged.
Verified exploitation code is not publicly available at the time of writing. For authoritative technical details, refer to the Microsoft Security Update CVE-2026-33840 advisory.
Detection Methods for CVE-2026-33840
Indicators of Compromise
- Unexpected win32k.sys or win32kfull.sys bug checks (BSODs with codes such as 0x3B SYSTEM_SERVICE_EXCEPTION or 0x50 PAGE_FAULT_IN_NONPAGED_AREA) on otherwise stable hosts.
- Standard user processes spawning child processes under the NT AUTHORITY\SYSTEM security context without a legitimate elevation path.
- Unsigned or unusual binaries performing rapid sequences of GDI or window manager syscalls prior to a privilege change event.
Detection Strategies
- Hunt for token-swap behavior: process access tokens changing mid-process lifetime, or processes whose parent runs as a low-integrity user while the child runs as SYSTEM.
- Monitor Windows Error Reporting and crash dumps for repeated faults inside win32kfull!*ICOMP* or related Win32k routines, which can indicate failed exploit attempts.
- Correlate Sysmon Event ID 1 (process create) and Event ID 10 (process access) with integrity-level transitions to surface local elevation chains.
Monitoring Recommendations
- Forward kernel crash telemetry and Sysmon logs to a centralized analytics platform and alert on Win32k-related faults.
- Track use of NtUserCallHwnd*, NtGdiDdDDI*, and related syscalls from non-standard or newly observed binaries.
- Baseline normal elevation paths on each host (UAC, scheduled tasks, services) and alert on out-of-band SYSTEM token acquisition.
How to Mitigate CVE-2026-33840
Immediate Actions Required
- Apply the Microsoft May 2026 security update addressing CVE-2026-33840 to all Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 systems.
- Prioritize patching multi-user systems, terminal servers, and developer workstations where local low-privilege code routinely runs.
- Restrict local logon rights and remove unnecessary local accounts to reduce the population of users who can stage the exploit.
Patch Information
Microsoft has released security updates through the May 2026 Patch Tuesday cycle. Refer to the Microsoft Security Update CVE-2026-33840 advisory for the per-product KB articles and applicable cumulative updates. Install the update via Windows Update, WSUS, Microsoft Update Catalog, or your enterprise patch management tool.
Workarounds
- No vendor-supplied workaround is documented; patching is the supported remediation.
- Enforce least privilege and application allowlisting (for example, Windows Defender Application Control) to limit which binaries unprivileged users can run.
- Enable attack surface reduction rules and exploit protection settings to make kernel exploitation primitives less reliable.
# Verify the May 2026 cumulative update is installed on Windows hosts
wmic qfe list brief /format:table
# Or, in PowerShell:
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
