Skip to content
Auto-CTI
Back to today
NEW MEDIUM B2

ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability

B ZDI: Published Advisories · · CVE-2026-65775

Admiralty grading (A–F · 1–6)

Source reliability

  • A Completely reliable
  • B Usually reliable
  • C Fairly reliable
  • D Not usually reliable
  • E Unreliable
  • F Cannot be judged

Information credibility

  • 1 Confirmed
  • 2 Probably true
  • 3 Possibly true
  • 4 Doubtful
  • 5 Improbable
  • 6 Cannot be judged

NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.

Key metrics

CVSS
7.8
EPSS
3%

Affected versions

windows 10 1607 windows 10 1809 windows 10 21h2

Key insight

This is a kernel LPE in win32kfull demonstrated at Pwn2Own, with no patch status communicated yet, which combined with an initial-access vector enables full system compromise.

Description

The vulnerability affects win32kfull in the Windows kernel and is a use-after-free flaw that allows a locally logged-on attacker with low privileges to escalate to SYSTEM context. Exploitation requires the ability to execute low-privileged code on the target system, for example via a previously exploited application or a phishing vector. ZDI rates the vulnerability at CVSS 8.8 and assigns CVE-2026-65775; disclosure occurred as part of the Pwn2Own competition. There are no indications of active exploitation in the wild or inclusion in the CISA KEV list. Affected are Windows installations, including server and desktop variants, where the kernel patch has not been applied.

Risk score

56
cvss base
78.00
kev bonus
0.00
epss bonus
0.00
poc bonus
15.00
raw before weight
93.00
industry weight
1.21
freshness factor
0.50
exploitability factor
1.00
days old
31.00
vendor mismatch penalty
0.00

Path: operational

MITRE ATT&CK mapping

1 TTP
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv. Escal.
T1068 Exploitation for Privilege Escalation
Def. Evasion
Cred. Access
Discovery
Lateral Mov.
Collection
C2
Exfiltration
Impact
Conf.: high medium low

Procedure details

Technique Tactic Procedure Conf. Source
T1068
Exploitation for Privilege Escalation
 Privilege Escalation A local attacker with low-privileged code execution exploits a use-after-free vulnerability in the win32kfull component of Microsoft Windows to escalate privileges on the affected system. high llm
ESC

…