CVE-2026-65775 Overview
CVE-2026-65775 is a use-after-free vulnerability in the Windows Win32K subsystem. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. The issue is tracked as CWE-416: Use After Free and carries a CVSS 3.1 score of 7.8. Successful exploitation grants attackers SYSTEM-level access from a low-privileged user context. Microsoft has published guidance through the Microsoft Security Update Guide. The vulnerability affects a broad set of Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025.
Critical Impact
Local privilege escalation to SYSTEM via a Win32K use-after-free condition, enabling full compromise of confidentiality, integrity, and availability on unpatched Windows hosts.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-65775 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65775
Vulnerability Analysis
The vulnerability resides in Win32K, the kernel-mode component that services window management and graphics device interface calls. A use-after-free condition occurs when kernel code continues to reference a memory object after it has been freed. An attacker with local authenticated access can trigger the dangling reference through crafted user-mode calls into Win32K. The reclaimed allocation can then be shaped to contain attacker-controlled data, yielding kernel-mode code execution. Because Win32K runs in the kernel, successful exploitation results in privilege elevation to SYSTEM. The exploitation prediction score currently sits at 2.314%, placing this CVE in the 81st percentile of likelihood for observed exploitation activity.
Root Cause
The root cause is improper object lifetime management within Win32K, classified as CWE-416. A kernel object is released while another code path still holds a pointer to it. Subsequent operations on that pointer dereference freed memory, opening a window for controlled reuse.
Attack Vector
The attack vector is local. An attacker must first obtain authenticated access to the target, typically through a compromised standard user account, malicious insider activity, or a chained remote foothold. No user interaction is required beyond the attacker's own execution of the exploit. Once triggered, the vulnerability provides a reliable path from low-privileged user to kernel-mode SYSTEM.
Microsoft has not published exploitation code, and no public proof-of-concept is currently linked to this CVE. See the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-65775
Indicators of Compromise
- Unexpected token manipulation or process privilege changes for services.exe, csrss.exe, or other SYSTEM processes originating from low-privileged user sessions.
- Kernel crash dumps referencing win32k.sys or win32kfull.sys with bug check codes consistent with pool corruption or use-after-free faults.
- Unusual GUI subsystem API call sequences from processes that do not typically interact with window management (for example, background services or scripting hosts).
Detection Strategies
- Monitor for standard user processes spawning children with elevated tokens or SYSTEM integrity levels.
- Correlate Win32K error events with process creation telemetry to identify exploitation attempts followed by privileged activity.
- Apply behavioral rules that flag anomalous handle inheritance, token duplication, or driver load events immediately after user-mode process crashes.
Monitoring Recommendations
- Ingest Windows Security, Sysmon, and kernel event logs into a centralized analytics platform for correlation across endpoints.
- Track patch state across all affected Windows client and server SKUs and alert on hosts running outdated cumulative updates.
- Baseline expected privileged process ancestry and alert on deviations, especially SYSTEM-level children of user-launched applications.
How to Mitigate CVE-2026-65775
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows client and server systems.
- Prioritize patching for multi-user systems, terminal servers, virtual desktop infrastructure, and jump hosts where local access is most likely.
- Audit local account provisioning and remove unneeded standard user accounts on sensitive hosts to reduce the attacker population.
Patch Information
Microsoft has released updates for all affected versions of Windows 10, Windows 11, and Windows Server 2012 through 2025. Consult the Microsoft Security Update Guide for the specific KB article and build numbers that address CVE-2026-65775 on each supported release.
Workarounds
- No official vendor workaround has been published; applying the security update is the required remediation path.
- Restrict interactive and remote logon rights to trusted administrators until patches are deployed.
- Enforce application allowlisting and least-privilege policies to limit which binaries a local user can execute against the Win32K interface.
# Verify patch state on Windows hosts using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# List installed cumulative updates to confirm CVE-2026-65775 remediation KB is present
wmic qfe list brief /format:table
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
