CVE-2026-58629: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-58629 Overview

CVE-2026-58629 is a use-after-free vulnerability [CWE-416] in the Windows DirectX graphics subsystem. An authorized local attacker can exploit the flaw to elevate privileges on the affected host. Microsoft published the advisory on 2026-07-14 and updated it on 2026-07-17. The issue impacts a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2012 through 2025. Exploitation requires local access and low privileges, but the attack complexity is high due to a race window that must be won during memory reuse.

Critical Impact
Successful exploitation allows a low-privileged local user to gain SYSTEM-level privileges through DirectX, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-58629 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-58629

Vulnerability Analysis

The vulnerability resides in the DirectX graphics component of Windows, which mediates user-mode graphics calls into kernel-mode graphics drivers. A use-after-free condition occurs when a kernel object is freed while another code path retains a dangling reference to it. When that stale reference is later dereferenced, an attacker who has staged controlled data at the freed allocation can hijack execution flow inside the kernel. Because DirectX kernel components run at SYSTEM, successful reuse of the freed object leads to elevation of privilege from a low-privileged local account to the highest local integrity level.

Root Cause

The root cause is improper lifetime management of a heap-allocated DirectX kernel object [CWE-416]. Reference counting or object teardown logic releases the underlying allocation while an in-flight operation still holds a pointer to it, producing a dangling reference that is later dereferenced.

Attack Vector

Exploitation requires local, authenticated access to the target system. An attacker executes a crafted user-mode process that issues a sequence of DirectX or Direct3D device and resource calls to trigger the free, races to reclaim the freed allocation with attacker-controlled data, and then invokes the code path that reuses the stale pointer. The race requirement is the reason for high attack complexity. No user interaction is required, and the attack does not traverse the network. Refer to the Microsoft CVE-2026-58629 advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-58629

Indicators of Compromise

Unexpected child processes spawned by user-mode applications running with SYSTEM or elevated tokens shortly after graphics-heavy activity.
Kernel crash dumps (MEMORY.DMP, Minidump\*.dmp) referencing dxgkrnl.sys, dxgmms2.sys, or related DirectX kernel modules.
Windows Error Reporting entries under Application or System event logs citing bug checks in the graphics stack from non-administrative user sessions.

Detection Strategies

Hunt for low-privileged processes that suddenly acquire SYSTEM tokens without a legitimate elevation path such as UAC or a service invocation.
Alert on non-graphics workloads (scripts, LOLBins, unsigned binaries) issuing high volumes of Direct3D device creation and resource allocation calls.
Correlate kernel bug checks in DirectX drivers with preceding process creation events from user-writable directories such as %TEMP% or %APPDATA%.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process create) and Event ID 10 (process access) to identify token manipulation following graphics API abuse.
Forward Windows kernel bug check events and DriverFrameworks-UserMode logs to a centralized analytics platform for anomaly detection.
Monitor endpoints that have not received the July 2026 cumulative update and prioritize them for identification coverage.

How to Mitigate CVE-2026-58629

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-58629 to all affected Windows client and server builds.
Prioritize patching multi-user systems such as Remote Desktop Session Hosts, Citrix hosts, and shared workstations where low-privileged users have interactive access.
Restrict local logon rights and remove standard users from systems where interactive access is not required.

Patch Information

Microsoft has released cumulative updates addressing CVE-2026-58629 for all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Administrators should deploy the appropriate update package for each build via Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or a supported patch management platform. Confirm installation by verifying the updated build number of dxgkrnl.sys on affected hosts.

Workarounds

No official vendor workaround is documented; installing the Microsoft security update is the supported remediation.
As a temporary compensating control, limit interactive and Remote Desktop access to trusted administrators until patches are deployed.
Enforce application allowlisting (for example, Windows Defender Application Control) to block execution of untrusted binaries that could stage a local exploit.

bash

# Verify the DirectX kernel driver version after patching (run from an elevated PowerShell)
Get-Item C:\Windows\System32\drivers\dxgkrnl.sys | Select-Object Name, VersionInfo

# List installed security updates to confirm the July 2026 cumulative update is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10