CVE-2026-96913 – Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-96913 is a critical elevation of privilege vulnerability affecting the Windows Kernel. The vulnerability exists because of improper handling of objects in memory, potentially allowing a locally authenticated attacker to execute malicious code with elevated permissions. By exploiting this weakness, an attacker with limited access could gain SYSTEM privileges, giving them extensive control over the affected computer. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server. Microsoft has released a security update to address the issue.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk because it allows attackers with limited privileges to escalate their access to the highest permission level in Windows.

An attacker who successfully exploits this vulnerability could gain SYSTEM privileges, potentially allowing them to install malicious software, modify security configurations, access sensitive information, or disrupt critical system operations.

The attack requires local access and low-level privileges, but no user interaction is necessary.

With low attack complexity and potentially severe consequences for confidentiality, integrity, and availability, this vulnerability represents a serious threat to organizations operating affected Windows systems.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely, indicating that successful exploitation is considered less probable at the time of publication.

The vulnerability has not been publicly disclosed, and there are no reported instances of active exploitation.

The exploit code maturity is classified as Unproven, meaning reliable exploit code has not been established.

The existence of publicly available proof-of-concept (PoC) exploit code cannot be confirmed.

Although this vulnerability is not currently identified as an actively exploited zero-day, its potential to provide SYSTEM-level privileges makes it a serious security concern.

Technical Summary

CVE-2026-96913 is a critical elevation of privilege vulnerability caused by a heap-based buffer overflow (CWE-122) in the Windows Kernel.

The vulnerability occurs because the Windows Kernel does not properly handle certain objects in memory.

A heap-based buffer overflow occurs when an application or system component writes more data into a memory buffer than the allocated space can safely accommodate. This can corrupt adjacent memory and potentially allow an attacker to manipulate system behavior.

In this case, a locally authenticated attacker could exploit the vulnerability by running a specially crafted application designed to trigger the improper memory handling.

Successful exploitation could allow the attacker to execute code with elevated permissions and potentially obtain SYSTEM-level access, which represents one of the highest privilege levels within Windows.

With SYSTEM privileges, attackers could potentially:

• Install malware or other malicious applications.
• Access or modify sensitive system information.
• Disable or interfere with security controls.
• Modify critical operating system configurations.
• Disrupt services or compromise system availability.

The vulnerability has a CVSS v3.1 base score of 8.8, reflecting its significant security impact.

Its attack complexity is rated Low, and exploitation requires only Low privileges. No user interaction is required.

The vulnerability also carries High impact ratings for confidentiality, integrity, and availability.

Microsoft addresses this issue through a security update that ensures the Windows Kernel properly handles objects in memory, preventing the conditions that could lead to privilege escalation.

Exploitability

The vulnerability affects multiple Microsoft products, including:

• Windows 10: Versions 1809, 21H2, and 22H2.
• Windows 11: Versions 23H2, 24H2, 25H2, and 26H1.
• Windows Server: 2019, 2022, and 2025, including Server Core installations.
• Microsoft Visual Studio: 2026 version 18.10.

Affected architectures vary by product and include 32-bit, x64, and ARM64 systems.

Exploitation requires a locally authenticated attacker with low-level privileges.

An attacker could run a specially crafted application to exploit the kernel memory-handling weakness and potentially gain SYSTEM privileges.

The attack has Low complexity and requires no user interaction, making it particularly concerning when an attacker has already established limited access to a vulnerable system.

Business Impact

This vulnerability creates a serious risk for organizations because it could allow attackers to turn a low-privileged account into complete control over an affected Windows system.

“When attackers gain SYSTEM privileges, they are no longer just accessing a computer — they may be able to control its security, data, and operations.”

Successful exploitation could lead to several business consequences.

Complete System Compromise: Attackers could gain SYSTEM privileges, allowing them to make unauthorized changes to operating system settings, execute malicious applications, and interfere with security protections.

Sensitive Data Exposure: Elevated access could allow attackers to access confidential business information, potentially exposing customer records, internal documents, and other sensitive data.

Malware and Ransomware Risks: Attackers could use elevated privileges to install malicious software, potentially increasing the impact of ransomware or other malware infections.

Operational Disruption: Attackers could interfere with essential Windows services, modify system configurations, or cause system instability, potentially affecting business operations.

Increased Risk to Critical Servers: Since Windows Server 2019, 2022, and 2025 are affected, successful exploitation on critical infrastructure could have significant consequences for business applications and services.

Security Control Manipulation: SYSTEM-level access could allow attackers to interfere with endpoint protection, monitoring tools, and other defensive mechanisms.

Although exploitation requires an attacker to have local access, the vulnerability could become particularly dangerous when combined with another security weakness that provides initial access.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

If the security update cannot be immediately deployed, organizations should consider the following temporary risk-reduction measures:

• Restrict local access to affected Windows systems.
• Limit unnecessary user privileges and administrative permissions.
• Apply application control policies to restrict unauthorized executable files.
• Monitor endpoints for unusual privilege escalation attempts.
• Prioritize patching critical servers and high-value systems.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Installing the official Microsoft security update remains the recommended solution.

Urgency

Critical – Prioritize Security Update Deployment

CVE-2026-96913 requires urgent patching because of its Critical severity, CVSS score of 8.8, and potential to allow attackers to gain SYSTEM-level privileges.

Although Microsoft currently assesses exploitation as less likely, the vulnerability has several characteristics that increase its security significance.

Exploitation requires only low-level privileges, has low attack complexity, and does not require user interaction.

Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems.

Organizations should prioritize deployment across affected Windows workstations, servers, and other critical infrastructure.

Microsoft has released security updates for the affected products, including:

• Windows 10 Version 1809 / Server 2019: KB5126651
• Windows 10 Versions 21H2 and 22H2: KB5126657
• Windows 11 Version 23H2: KB5126653
• Windows 11 Versions 24H2 and 25H2: KB5127648
• Windows 11 Version 26H1: KB5127646
• Windows Server 2022: KB5126655
• Windows Server 2025: KB5126646
• Microsoft Visual Studio 2026 version 18.10: KB5127648

A system restart is required after installing the security updates.

No known issues are identified for the listed updates.

Organizations should deploy these patches through their established emergency or priority patch management processes, beginning with critical infrastructure and systems exposed to greater operational risk.

“Even without active exploitation, a critical Windows vulnerability that can grant SYSTEM access is too dangerous to leave unpatched.”