CVE-2026-83939 – Windows Secure Kernel Mode Elevation of Privilege Vulnerability

CVE-2026-83939 is a Critical elevation-of-privilege vulnerability in Windows Secure Kernel Mode caused by an untrusted pointer dereference. An authorized attacker who already has kernel-level access can submit a specially crafted Code Integrity policy to an affected system. Successful exploitation can allow code execution in Virtual Trust Level 1 (VTL1), with high potential impact to confidentiality, integrity, and availability.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability creates a path for an attacker with existing kernel-level access to cross into VTL1. Attack complexity is low, although exploitation requires local access and high privileges. No user interaction is required.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in Windows Secure Kernel Mode. An attacker who already has kernel-level access could submit a specially crafted Code Integrity policy to the affected system. Successful exploitation allows the attacker to execute code in Virtual Trust Level 1 (VTL1). The vulnerability has a changed scope and can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Windows 11 Version 26H1 for ARM64-based systems and Windows 11 Version 26H1 for x64-based systems. Exploitation requires local access, low attack complexity, and high privileges, with no user interaction. An attacker with kernel-level access could exploit the flaw using a specially crafted Code Integrity policy.

BUSINESS IMPACT: Successful exploitation could give an attacker VTL1 privileges, increasing the impact of an already privileged compromise. This could expose sensitive information, undermine system integrity, and affect system availability. The ability to cross this security boundary makes the vulnerability particularly significant on compromised Windows endpoints.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and can result in VTL1 privilege elevation with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix to affected Windows 11 Version 26H1 systems, particularly where protection against privilege escalation is important.