CVE-2026-119912: Windows Kernel Elevation of Privilege Vulnerability
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Other sources
Windows Kernel Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33822Fixed in 10.0.26100.33730Patch KB5131077 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7711Patch KB5131087 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9974Fixed in 10.0.26200.9911Patch KB5132043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9974Fixed in 10.0.26300.9911Patch KB5132043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9974Fixed in 10.0.26100.9911Patch KB5132043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5870Patch KB5131090 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.7846Patch KB5131096 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9487Patch KB5131085 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7846Patch KB5131096 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9688Patch KB5131291
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be authorized on the affected system and be able to execute locally. The vulnerability is not described as remotely exploitable and requires no user interaction.
What could a successful exploit allow?
A successful exploit could allow local elevation of privilege. The provided severity vector indicates potential high impact to confidentiality, integrity, and availability.