CVE-2026-69275: Windows Kernel Streaming Use After Free

CVE-2026-69275 Overview

CVE-2026-69275 is a use-after-free vulnerability [CWE-416] in the Windows Kernel Streaming WOW Thunk Service Driver. An authenticated local attacker can exploit the flaw to elevate privileges on an affected system. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

The vulnerability requires local access and low privileges but no user interaction. Successful exploitation compromises the confidentiality, integrity, and availability of the target host. Attack complexity is high, indicating that reliable exploitation depends on winning a race or meeting specific runtime conditions.

Critical Impact
Successful exploitation grants SYSTEM-level privileges on Windows hosts, enabling attackers to disable security tooling, install persistence, and pivot deeper into the environment.

Affected Products

Microsoft Windows (Kernel Streaming WOW Thunk Service Driver component)
Refer to the Microsoft Security Update Guide for the specific list of affected Windows versions and builds
Systems running the 32-bit compatibility subsystem on 64-bit Windows are the primary concern given the WOW thunking scope

Discovery Timeline

2026-09-08 - CVE-2026-69275 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69275

Vulnerability Analysis

The flaw resides in the Kernel Streaming WOW Thunk Service Driver, a Windows kernel component that bridges 32-bit user-mode requests to 64-bit kernel-mode Kernel Streaming interfaces. A use-after-free condition occurs when the driver references a kernel object after it has been released. An attacker who can trigger the race window can reclaim the freed allocation and control subsequent dereferences.

Because the vulnerable code path executes in kernel mode, controlled memory reuse leads to arbitrary kernel read, write, or code execution. This transforms a low-privileged user context into SYSTEM. The high attack complexity reflects the need to reliably win the race and shape the kernel pool.

Root Cause

The root cause is improper object lifetime management within the WOW thunking layer. The driver frees a shared object while another code path retains a dangling pointer to it. When the second path dereferences the pointer, the memory may already be occupied by attacker-controlled data.

Attack Vector

Exploitation requires local, authenticated access. An attacker executes a crafted user-mode program that issues IOCTLs or system calls into the Kernel Streaming WOW thunk interfaces. By racing free and reuse operations, the attacker corrupts kernel memory and hijacks execution flow inside the kernel. No user interaction is required beyond running the exploit.

No public proof-of-concept code has been published for CVE-2026-69275 at the time of writing. Technical specifics are described in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-69275

Indicators of Compromise

Unexpected child processes spawned from low-privileged user sessions running with NT AUTHORITY\SYSTEM context
Kernel bugchecks referencing ksthunk.sys or related Kernel Streaming components
Loading of unsigned or unusual drivers shortly after suspicious user-mode activity

Detection Strategies

Monitor for user-mode processes issuing atypical IOCTL sequences against Kernel Streaming device objects
Alert on privilege token escalation events where a standard user process suddenly acquires SYSTEM integrity
Correlate crash dumps mentioning use-after-free patterns in ksthunk.sys with preceding user activity

Monitoring Recommendations

Enable kernel telemetry and Sysmon Event ID 1 and 10 to track process creation and access patterns to lsass.exe after suspicious binary execution
Forward Windows Error Reporting and kernel crash telemetry to a centralized SIEM for pattern analysis
Track installation of new services or scheduled tasks following unexplained integrity-level changes

How to Mitigate CVE-2026-69275

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows build
Prioritize patching multi-user systems, jump hosts, and endpoints where untrusted code may execute
Restrict local logon rights and enforce application allowlisting to limit which binaries can invoke kernel interfaces

Patch Information

Microsoft has issued patches through its regular Security Update Guide process. Administrators should identify the specific KB article that matches their Windows version and deploy it through Windows Update, WSUS, Microsoft Intune, or Configuration Manager. Verify installation by confirming the updated ksthunk.sys version on affected systems.

Workarounds

No official workaround eliminates the vulnerability; patching is the required remediation
Reduce exposure by removing local administrative rights from standard users and enforcing least privilege
Deploy exploit protection policies and Hypervisor-protected Code Integrity (HVCI) where supported to raise the cost of kernel exploitation

bash

# Verify the installed ksthunk.sys version on a Windows host
Get-Item C:\Windows\System32\drivers\ksthunk.sys | Select-Object VersionInfo

# List pending and installed security updates
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20