CVE-2026-40377: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-40377 Overview

CVE-2026-40377 is a heap-based buffer overflow vulnerability in Windows Cryptographic Services that allows an authorized local attacker to elevate privileges. The flaw affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Successful exploitation provides high impact to confidentiality, integrity, and availability on the affected host. Microsoft addressed the issue through its Security Update Guide and assigned the vulnerability to weakness class [CWE-122].

Critical Impact

A local authenticated user can corrupt heap memory inside Windows Cryptographic Services to gain SYSTEM-level privileges on affected Windows and Windows Server installations.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-05-12 - CVE-2026-40377 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-40377

Vulnerability Analysis

The vulnerability resides in Windows Cryptographic Services, the system component (CryptSvc) that brokers cryptographic operations such as certificate validation, catalog file verification, and key storage. A heap-based buffer overflow [CWE-122] occurs when the service processes attacker-controlled input without enforcing proper size constraints on a heap-allocated buffer. Writing beyond the bounds of that buffer corrupts adjacent heap structures used by the service, which runs in a privileged context.

Because Cryptographic Services operates with higher privileges than a standard interactive user, controlled corruption of its heap can be steered toward arbitrary code execution within the service. The result is a local elevation of privilege from a standard authorized account to SYSTEM.

Root Cause

The root cause is improper validation of a length or size field before copying data into a fixed heap allocation inside Windows Cryptographic Services. The component fails to ensure that the destination buffer can hold the incoming data, allowing adjacent heap metadata or function pointers to be overwritten. Microsoft has not published low-level internals for this issue beyond the advisory.

Attack Vector

The attack vector is local and requires the attacker to be authenticated on the target system with low privileges. No user interaction is required. An attacker typically delivers a crafted request or input artifact to the Cryptographic Services interface, triggers the overflow, and uses the resulting memory corruption to execute code as SYSTEM. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been observed.

For implementation specifics, refer to the Microsoft Security Update Guide for CVE-2026-40377.

Detection Methods for CVE-2026-40377

Indicators of Compromise

• Unexpected crashes, restarts, or Windows Error Reporting events tied to the CryptSvc service or the hosting svchost.exe instance.
• Creation of new SYSTEM-level processes spawned from a user context shortly after interaction with Cryptographic Services.
• Anomalous loading of unsigned or unexpected modules into the CryptSvc service host.

Detection Strategies

• Hunt for child processes of svchost.exe -k NetworkService or the Cryptographic Services group that drop binaries or launch shells (cmd.exe, powershell.exe) with SYSTEM tokens.
• Correlate local logon events with subsequent privilege escalation indicators such as token elevation, service modification, or new local administrator accounts.
• Monitor for repeated access failures or malformed requests against cryptographic APIs from a single low-privilege user.

Monitoring Recommendations

• Forward Windows Application, System, and Sysmon logs to a centralized analytics platform and alert on crashes within CryptSvc.
• Track process lineage and integrity-level transitions on endpoints to surface user-to-SYSTEM escalation patterns.
• Maintain a current inventory of patch state across Windows 10, Windows 11, and Windows Server hosts to identify unpatched systems at risk.

How to Mitigate CVE-2026-40377

Immediate Actions Required

• Apply the Microsoft security updates referenced in the MSRC advisory for CVE-2026-40377 to all affected Windows and Windows Server systems.
• Prioritize patching on multi-user systems, jump hosts, terminal servers, and any host where untrusted users have local logon rights.
• Audit local accounts and remove unnecessary interactive logon permissions to reduce the population of users who can trigger the flaw.

Patch Information

Microsoft has released security updates for all listed Windows 10, Windows 11, and Windows Server versions through the standard Patch Tuesday channel. Administrators should consult the Microsoft Security Update Guide for CVE-2026-40377 for the exact KB articles applicable to each build and architecture, and deploy them via Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

• No vendor-supplied workaround replaces the security update; applying the patch is the only complete remediation.
• Restrict local logon rights through Group Policy so only trusted administrative users can authenticate to sensitive servers.
• Enforce application control policies (such as Windows Defender Application Control or AppLocker) to limit execution of unauthorized binaries that could deliver the exploit.

# Verify patch deployment status for CVE-2026-40377 on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Confirm Cryptographic Services configuration and state
Get-Service -Name CryptSvc | Format-List Name, Status, StartType