Microsoft Windows win32kfull Vulnerability Allows Local Privilege Escalation
A use-after-free vulnerability in Microsoft Windows win32kfull, CVE-2026-65775, allows local attackers to escalate privileges to SYSTEM.
A critical use-after-free vulnerability has been identified in the win32kfull driver within Microsoft Windows, allowing local attackers to escalate privileges to the highest level, SYSTEM. This vulnerability, tracked as CVE-2026-65775, requires an attacker to first gain the ability to execute low-privileged code on the target system before exploitation is possible.
The core of the issue lies in the win32kfull driver's failure to properly validate the existence of an object before performing operations on it. This oversight creates a window where a use-after-free condition can be triggered, leading to memory corruption. Successful exploitation allows an attacker to gain SYSTEM privileges and execute arbitrary code, effectively taking full control of the affected machine.
The vulnerability was discovered by Kentaro Kawane from GMO Cybersecurity by Ierae and was reported to Microsoft on May 21, 2026. The Zero Day Initiative (ZDI) coordinated the public release of the advisory on August 11, 2026, alongside Microsoft's patch.
Microsoft has acknowledged the vulnerability and released a security update to address it as part of its regular patching cycle. Users are strongly advised to apply the available update to protect their systems from potential exploitation. The CVSS score for this vulnerability is rated at 8.8, indicating a high severity.
While the vulnerability requires prior local code execution, its ability to grant SYSTEM privileges makes it a significant threat. Attackers could chain this vulnerability with other exploits that allow initial low-privilege access to achieve complete system compromise.
This disclosure highlights the ongoing challenges in securing complex operating system components like the Windows kernel. Even with extensive security measures, subtle memory management flaws can persist and be discovered, posing risks to users worldwide.
Organizations and individuals running affected versions of Microsoft Windows should prioritize applying the security update provided by Microsoft. Further technical details and the specific update guidance can be found on the Microsoft Security Update Guide.
This vulnerability was presented as part of the Pwn2Own competition, underscoring the importance of bug bounty programs and coordinated vulnerability disclosure in identifying and mitigating such critical security flaws before they can be widely exploited by malicious actors.
This advisory details ZDI-26-542, which is assigned CVE-2026-62712, a distinct local privilege escalation vulnerability within Microsoft Windows' win32kfull driver. While the existing story covers CVE-2026-65775, this new vulnerability stems from improper management of user-mode driver surface objects and also allows attackers with low-privilege code execution to gain SYSTEM privileges.