CVE-2026-70290: Windows Win32 Kernel Information Disclosure

CVE-2026-70290 Overview

CVE-2026-70290 is an information disclosure vulnerability in the Windows Win32 Kernel Subsystem. The flaw stems from the use of an uninitialized resource ([CWE-908]), which allows an authorized local attacker to read kernel memory contents that should remain protected. Successful exploitation exposes sensitive kernel data, including memory addresses useful for bypassing Kernel Address Space Layout Randomization (KASLR) and staging follow-on privilege escalation attacks.

The issue affects the Win32k subsystem, a long-standing target for local attackers due to its exposure of kernel APIs to user-mode callers. Microsoft has published guidance through the Microsoft Security Response Center.

Critical Impact
An authorized local attacker can disclose kernel memory contents, undermining kernel isolation and enabling reliable exploit primitives for chained attacks.

Affected Products

Microsoft Windows (Win32 Kernel Subsystem component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Systems where local, authenticated code execution is possible

Discovery Timeline

2026-09-08 - CVE-2026-70290 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-70290

Vulnerability Analysis

The vulnerability is classified under [CWE-908]: Use of Uninitialized Resource. A kernel code path in the Win32k subsystem allocates a resource, typically a memory buffer or structure, and returns its contents to a user-mode caller without fully initializing every field. The uninitialized bytes carry residual data from previous kernel allocations.

An authenticated local attacker invokes the affected syscall or API from user mode. The kernel populates the response buffer, leaving specific offsets untouched. When the buffer is copied back across the user-kernel boundary, the attacker reads previously allocated kernel data. This data can include pointers, handles, credential fragments, or other structures useful for defeating exploit mitigations.

Exploitation requires only low privileges and no user interaction, but the attacker must already have code execution on the target host.

Root Cause

The root cause is missing zero-initialization of a kernel-allocated buffer before it is copied to user mode. The affected function does not call RtlZeroMemory or equivalent on the full structure, and the write path only populates a subset of fields. Padding bytes and unused union members retain data from prior heap or pool allocations.

Attack Vector

The attack vector is local. An attacker with a standard user account or a low-integrity process invokes the vulnerable Win32k routine, captures the returned buffer, and parses the residual bytes to extract kernel memory contents. Refer to the Microsoft Security Update Guide for component-specific details.

Because no verified proof-of-concept has been published, exploitation specifics are described in prose only. The disclosed bytes are commonly used to break KASLR, locate kernel objects, or chain with a memory corruption bug for elevation of privilege.

Detection Methods for CVE-2026-70290

Indicators of Compromise

Unexpected user-mode processes issuing high-frequency Win32k syscalls associated with the affected routine
Presence of known local privilege escalation toolkits or kernel information-leak utilities on disk
Anomalous loading of debugging or memory-inspection libraries by non-administrative users

Detection Strategies

Monitor for unsigned or low-reputation binaries making repeated calls into Win32k APIs from standard user contexts
Correlate kernel information-leak activity with subsequent token manipulation or process injection attempts
Track process ancestry to identify local exploit chains that follow initial access

Monitoring Recommendations

Enable Windows Event Log auditing for process creation with command-line capture (Event ID 4688)
Ingest EDR telemetry covering syscall usage and kernel object access into a centralized data lake
Alert on execution of newly introduced binaries in user-writable directories on servers and privileged workstations

How to Mitigate CVE-2026-70290

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as patches are validated
Prioritize patch deployment on multi-user systems, terminal servers, and jump hosts where untrusted local code is more likely
Audit local account access and remove unnecessary interactive login rights

Patch Information

Microsoft has issued a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update Guide for the specific KB articles applicable to their Windows builds and deploy them through Windows Update, WSUS, or an equivalent patch management channel.

Workarounds

Restrict local logon rights and enforce the principle of least privilege on endpoints
Apply application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block untrusted binaries
Enable Hypervisor-Protected Code Integrity (HVCI) and Virtualization-Based Security (VBS) to increase the cost of kernel exploitation

bash

# Example: enforce AppLocker default rules via PowerShell to limit unsigned binaries
Set-AppLockerPolicy -XmlPolicy .\AppLockerDefaultPolicy.xml -Merge
Get-Service AppIDSvc | Set-Service -StartupType Automatic
Start-Service AppIDSvc