CVE-2026-61929 Overview
CVE-2026-61929 is a use-after-free vulnerability in the Windows Kernel that enables local privilege escalation. An authenticated attacker with low privileges can exploit the flaw to gain higher privileges on affected systems. The issue is tracked under CWE-416: Use After Free and affects multiple current Windows 11 releases and Windows Server 2025. Microsoft has published guidance in the Microsoft Security Advisory.
Critical Impact
Successful exploitation grants SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 hosts, allowing attackers to bypass kernel protections, install rootkits, and disable endpoint security controls.
Affected Products
- Microsoft Windows 11 23H2 (x64, ARM64)
- Microsoft Windows 11 24H2 and 25H2 (x64, ARM64)
- Microsoft Windows 11 26H1 and Windows Server 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61929 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61929
Vulnerability Analysis
The vulnerability is a use-after-free condition (CWE-416) in the Windows Kernel. The kernel references a memory object after it has been freed, allowing an attacker to control the contents of the reclaimed allocation. When the kernel later dereferences the stale pointer, execution can be redirected to attacker-controlled data.
Exploitation requires local authenticated access and involves winning a race condition, which raises attack complexity. However, a successful attacker gains full confidentiality, integrity, and availability impact by executing code in kernel mode. This class of flaw is commonly chained with remote code execution or phishing payloads to achieve full system compromise.
The EPSS score is 1.39% at the 69th percentile as of 2026-08-13. No public proof-of-concept or in-the-wild exploitation has been confirmed at the time of publication.
Root Cause
The kernel fails to synchronize object lifetime with concurrent references. A thread frees a kernel object while another code path retains a pointer to it. Subsequent use of the dangling pointer operates on attacker-controlled memory reallocated to the same address, corrupting kernel state.
Attack Vector
An attacker must already have code execution as a low-privileged local user. The attacker triggers the race condition that frees the object, reclaims the freed allocation with crafted data, and forces the kernel to dereference the stale pointer. The result is arbitrary read, write, or execute primitives in kernel mode, which the attacker uses to elevate to SYSTEM.
No verified exploit code is publicly available. Refer to the Microsoft Security Advisory for vendor technical details.
Detection Methods for CVE-2026-61929
Indicators of Compromise
- Unexpected creation of SYSTEM-level processes spawned from medium or low integrity parent processes.
- Kernel bugchecks (BSOD) with stop codes such as KERNEL_MODE_HEAP_CORRUPTION or DRIVER_VERIFIER_DETECTED_VIOLATION following user-mode workload spikes.
- Loading of unsigned or newly-observed drivers immediately after a local user session begins.
- Modification of SeDebugPrivilege or token-swapping activity on lsass.exe and services.exe.
Detection Strategies
- Deploy behavioral endpoint detection rules that flag token manipulation and parent-child process integrity mismatches.
- Enable Windows Defender Exploit Guard and kernel-mode code integrity (HVCI) audit logs to capture attempted kernel object misuse.
- Correlate Sysmon Event ID 1 and 10 with sudden privilege changes on non-administrative accounts.
- Use MITRE ATT&CK mappings for T1068: Exploitation for Privilege Escalation to build hunting queries.
Monitoring Recommendations
- Ingest Windows Security, System, and Sysmon logs into a centralized SIEM for correlation across hosts.
- Alert on repeated kernel crashes on the same endpoint within short time windows.
- Track driver load events (Event ID 6) and validate signatures against a known baseline.
How to Mitigate CVE-2026-61929
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory to all affected Windows 11 and Windows Server 2025 hosts.
- Prioritize patching for multi-user systems, jump hosts, and terminal servers where low-privileged users execute code.
- Restrict local logon rights and remove unnecessary interactive users from sensitive systems.
- Enable Hypervisor-Protected Code Integrity (HVCI) and Credential Guard where hardware supports them.
Patch Information
Microsoft has released patches through the standard Windows Update channels. Consult the Microsoft Security Advisory for CVE-2026-61929 for the specific KB articles corresponding to each affected build (23H2, 24H2, 25H2, 26H1, and Windows Server 2025).
Workarounds
- No official workaround eliminates the vulnerability; patching is the only complete remediation.
- Enforce application allowlisting with Windows Defender Application Control (WDAC) to limit which binaries a low-privileged attacker can execute.
- Enable attack surface reduction (ASR) rules that block untrusted processes from launching child processes.
- Restrict local administrator group membership and enforce Local Administrator Password Solution (LAPS) rotation.
# Verify installed KB and pending updates on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Force Windows Update scan and install
UsoClient StartInteractiveScan
UsoClient StartInstall
# Enable HVCI via registry (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
