CVE-2026-45600: Windows 11 24H2 Privilege Escalation Flaw

CVE-2026-45600 Overview

CVE-2026-45600 is a type confusion vulnerability in Windows Kernel-Mode Drivers that allows an authorized local attacker to elevate privileges. The flaw is tracked under CWE-843 (Access of Resource Using Incompatible Type). Microsoft published the advisory on June 9, 2026, and rates the issue HIGH with a CVSS 3.1 score of 7.8. Successful exploitation grants attackers SYSTEM-level access on affected hosts, enabling full compromise of the operating system kernel. The vulnerability affects current Windows 11 client builds and Windows Server 2025.

Critical Impact
A local, authenticated attacker can trigger kernel-mode type confusion to escalate from a standard user context to SYSTEM, gaining complete control of the host.

Affected Products

Microsoft Windows 11 24H2 (x64 and ARM64)
Microsoft Windows 11 25H2 (x64 and ARM64)
Microsoft Windows 11 26H1 (x64 and ARM64)
Microsoft Windows Server 2025 (x64)

Discovery Timeline

2026-06-09 - CVE-2026-45600 published to NVD and Microsoft releases security update
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45600

Vulnerability Analysis

The vulnerability resides within Windows Kernel-Mode Drivers, where a kernel object is accessed using an incompatible type. Type confusion occurs when code allocates or interprets memory as one type, then later operates on it as a different, incompatible type. In kernel context, this allows attackers to manipulate object fields the original type does not expose, including function pointers and access tokens.

The issue is exploitable only by attackers who already possess a local foothold with low privileges. No user interaction is required after the attacker executes their payload. The scope remains unchanged, but confidentiality, integrity, and availability are all fully impacted because successful exploitation yields kernel-mode execution.

Root Cause

The root cause is improper validation of an object's underlying type before performing type-specific operations inside a kernel-mode driver. The driver casts or reinterprets a structure without verifying its tag, dispatch table, or class identifier. When attacker-controlled input drives the cast, the kernel reads or writes fields at offsets defined by the wrong type definition, corrupting kernel state.

Attack Vector

Exploitation requires local code execution as an authenticated user. The attacker opens a handle to the vulnerable driver interface and issues crafted IOCTLs or system calls that cause the driver to treat one object as another type. By controlling the contents of the confused object, the attacker can pivot to arbitrary kernel read/write primitives, then overwrite the current process token with a SYSTEM token or hijack a kernel callback. Microsoft documents the specific affected components in the Microsoft Security Update CVE-2026-45600 advisory. No public proof-of-concept code is available at the time of publication, and the EPSS score is 0.149%.

Detection Methods for CVE-2026-45600

Indicators of Compromise

Unexpected processes spawning with SYSTEM or elevated integrity from a parent owned by a standard user session.
Loading of unsigned or unusual drivers, or repeated DeviceIoControl calls to kernel-mode driver interfaces from non-administrative processes.
Kernel-mode crashes (BSOD with bug checks such as SYSTEM_SERVICE_EXCEPTION or KERNEL_MODE_HEAP_CORRUPTION) preceded by user-mode activity from a low-privileged account.

Detection Strategies

Hunt for token manipulation patterns: processes whose TokenUser SID changes during runtime, or child processes inheriting tokens that do not match the parent's user context.
Correlate driver load events (Sysmon Event ID 6) with subsequent privilege transitions and process creations (Event ID 4688) on the same host.
Apply behavioral analytics to identify exploitation chains where a standard user process opens a kernel device handle and is followed by SYSTEM-level command execution.

Monitoring Recommendations

Enable kernel-mode driver block rules and Windows Defender Application Control (WDAC) to limit which drivers can be loaded.
Forward Windows Security, Sysmon, and Microsoft-Windows-Kernel-General logs to a centralized analytics platform for correlation.
Track patch deployment status across all Windows 11 and Windows Server 2025 hosts and alert on systems missing the June 2026 cumulative update.

How to Mitigate CVE-2026-45600

Immediate Actions Required

Deploy the Microsoft June 2026 security update to all affected Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 systems as referenced in the Microsoft Security Update CVE-2026-45600 advisory.
Audit local administrator and standard user accounts on critical assets and remove unnecessary local logon rights.
Enforce least-privilege execution for service accounts and scheduled tasks that run on affected hosts.

Patch Information

Microsoft addressed CVE-2026-45600 in the June 2026 security update cycle. Administrators should review the Microsoft Security Update CVE-2026-45600 advisory for the exact KB articles applicable to each supported Windows build and install the relevant cumulative update through Windows Update, WSUS, Microsoft Update Catalog, or Intune.

Workarounds

No vendor-supplied workaround exists; applying the security update is the only complete remediation.
Reduce attack surface by enabling Hypervisor-Protected Code Integrity (HVCI) and the Microsoft vulnerable driver blocklist to limit loading of known-bad kernel drivers.
Restrict interactive and remote logon to affected hosts using Group Policy until patches are deployed.

bash

# Verify the cumulative update is installed on a Windows host
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Enable the Microsoft vulnerable driver blocklist via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f