CVE-2026-61927: Windows Bind Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
Other sources
Windows Bind Filter Driver Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33296Fixed in 10.0.26100.33222Patch KB5120228 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2704Patch KB5121000 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9168Fixed in 10.0.26200.9106Patch KB5120994 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9168Fixed in 10.0.26100.9106Patch KB5120994 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9168Fixed in 10.0.26200.9106Patch KB5120994
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61927?
CVE-2026-61927 is classified as a high severity vulnerability with a score of 7.
How do I fix CVE-2026-61927?
To fix CVE-2026-61927, ensure that your Microsoft Windows 11 or Windows Server 2025 is updated to the latest security patches provided by Microsoft.
What types of systems are affected by CVE-2026-61927?
CVE-2026-61927 affects Microsoft Windows 11 and Microsoft Windows Server 2025, including various versions like 24h2, 25h2, and 26h1.
What kind of vulnerability is CVE-2026-61927?
CVE-2026-61927 is classified as an elevation of privilege vulnerability due to a use after free error in the Windows Bind Filter Driver.
Can CVE-2026-61927 be exploited remotely?
CVE-2026-61927 requires local access, meaning an authorized attacker must be physically present on the system to exploit it.