CVE-2026-70114: Windows Kernel Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized on the affected Windows system and must be able to execute an exploit locally. The supplied vector is local, so this is not described as remotely exploitable over the network.

Q: What is the likely impact of successful exploitation?

Successful exploitation allows elevation of privilege on the local system. The provided severity vector indicates high impacts to confidentiality, integrity, and availability.

Q: Which systems are identified as affected?

The listed affected software includes Microsoft Windows 11, Microsoft Windows Server 2025, Microsoft Windows Server 2022, and Microsoft Windows Kernel.

Q: Is user interaction required?

No. The supplied severity vector specifies UI:N, indicating that user interaction is not required once an authorized attacker has local access.

Published Oct 13, 2026

Updated

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Other sources

Windows Kernel Elevation of Privilege Vulnerability

— Microsoft

Affected Software

15 affected componentsFixes available

Microsoft Windows Kernel

Microsoft Windows 11=26H1

10.0.28000.3231

Microsoft Windows 11=26H1

10.0.28000.3231

Microsoft Windows 11=24H2

10.0.26100.9711

Microsoft Windows 11=25H2

10.0.26200.9711

Microsoft Windows 11=24H2

10.0.26100.9711

Microsoft Windows Server 2025<10.0.26100.33650

10.0.26100.33650

Microsoft Windows 11=23H2

10.0.22631.7652

Microsoft Windows 11=23H2

10.0.22631.7652

Microsoft Windows Server 2025<10.0.26100.33650

10.0.26100.33650

Microsoft Windows 11=25H2

10.0.26200.9711

Microsoft Windows Server 2022<10.0.20348.5761

10.0.20348.5761

Microsoft Windows 11=26H2

10.0.26300.9711

Microsoft Windows 11=26H2

10.0.26300.9711

Microsoft Windows Server 2022<10.0.20348.5761

10.0.20348.5761

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648

Event History

Oct 13, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:59 PM

Data Sourced

via MITRE·06:59 PM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized on the affected Windows system and must be able to execute an exploit locally. The supplied vector is local, so this is not described as remotely exploitable over the network.

What is the likely impact of successful exploitation?

Successful exploitation allows elevation of privilege on the local system. The provided severity vector indicates high impacts to confidentiality, integrity, and availability.

Which systems are identified as affected?

The listed affected software includes Microsoft Windows 11, Microsoft Windows Server 2025, Microsoft Windows Server 2022, and Microsoft Windows Kernel.

Is user interaction required?

No. The supplied severity vector specifies UI:N, indicating that user interaction is not required once an authorized attacker has local access.

CVE-2026-70114: Windows Kernel Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which systems are identified as affected?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which systems are identified as affected?

Is user interaction required?