CVE-2026-35417 Overview
CVE-2026-35417 is a type confusion vulnerability in the Windows Win32K ICOMP component. The flaw allows an authorized local attacker to elevate privileges on affected Windows desktop and server systems. Microsoft classifies the issue under CWE-843, access of a resource using an incompatible type. Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability of the target host. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases, including the latest Windows Server 2025 builds. Microsoft published the advisory on May 12, 2026.
Critical Impact
A low-privileged local user can escalate to SYSTEM-level privileges on unpatched Windows hosts, enabling full host compromise.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2019, Server 2022, Server 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2026-05-12 - CVE-2026-35417 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-35417
Vulnerability Analysis
The vulnerability resides in the Win32K kernel-mode subsystem, specifically within the ICOMP code path. Win32K handles window management, graphics device interface (GDI), and user input processing in kernel mode. A type confusion condition occurs when the kernel accesses an object assuming one type while the underlying memory holds an incompatible type. An authenticated local attacker who triggers the vulnerable code path can manipulate kernel object handling. This leads to controlled memory corruption inside the kernel address space. The attacker can convert the corruption primitive into arbitrary kernel read/write access. The end result is full elevation from a standard user context to SYSTEM.
Root Cause
The root cause is a missing or insufficient type check before dereferencing an object reference inside the ICOMP handler in Win32K. The kernel treats the object as a different structure than what was actually allocated. This mismatch lets attacker-controlled fields overlap with security-sensitive kernel fields such as function pointers or object headers. CWE-843 captures this class of defect.
Attack Vector
Exploitation requires local code execution and a valid set of low-privilege credentials. No user interaction is required, and the attack scope remains unchanged. An attacker delivers an unprivileged process to the host through phishing, a compromised application, or a prior foothold. The process then issues crafted Win32K calls that reach the ICOMP code path with mismatched object types. Kernel memory corruption follows, which the exploit chains into token replacement or arbitrary code execution at ring 0. The EPSS score reported on May 17, 2026 is low, and no public proof-of-concept code is currently linked in NVD.
No verified public exploit code is available at this time. Refer to the Microsoft Security Update CVE-2026-35417 advisory for vendor technical details.
Detection Methods for CVE-2026-35417
Indicators of Compromise
- Unexpected SYSTEM-level processes spawned from standard user sessions shortly after suspicious Win32K activity.
- Kernel bug checks (BSODs) referencing win32k.sys or win32kfull.sys on hosts running unpatched builds.
- New service installations, scheduled tasks, or local administrator account creation following local logon by a non-admin user.
Detection Strategies
- Monitor for processes that escalate token integrity level from Medium to System without a documented elevation path.
- Hunt for unsigned or non-Microsoft binaries calling rare Win32K syscalls, particularly those tied to GDI compositing.
- Correlate Sysmon Event ID 1 (process create) and Event ID 10 (process access) against lsass.exe and csrss.exe from low-privilege users.
Monitoring Recommendations
- Forward Windows Security, Sysmon, and kernel crash telemetry into a centralized analytics platform for behavioral baselining.
- Track patch compliance for the May 2026 Windows cumulative updates across all affected SKUs.
- Alert on anomalous child processes of user-launched applications that obtain SeDebugPrivilege or SeTcbPrivilege.
How to Mitigate CVE-2026-35417
Immediate Actions Required
- Apply the May 2026 Microsoft security update referenced in the Microsoft Security Update CVE-2026-35417 advisory to all affected Windows 10, Windows 11, and Windows Server hosts.
- Prioritize patching of multi-user systems such as Remote Desktop Session Hosts, VDI pools, and shared developer workstations where local privilege escalation has the highest impact.
- Restrict local logon rights and remove unnecessary interactive accounts on servers.
Patch Information
Microsoft released fixes for CVE-2026-35417 in the May 2026 security update cycle. Administrators should consult the Microsoft Security Update CVE-2026-35417 advisory for build-specific KB numbers covering Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through Windows Server 2025.
Workarounds
- No official workaround replaces patching; reduce exposure by enforcing least privilege and blocking untrusted binary execution via AppLocker or Windows Defender Application Control.
- Enable Hypervisor-Protected Code Integrity (HVCI) and Credential Guard to raise the cost of kernel exploitation on supported hardware.
- Limit which users can run code interactively on servers, and disable unused Win32K subsystem features where supported.
# Verify the May 2026 cumulative update is installed on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Confirm HVCI is enabled
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
