CVE-2026-45592: Windows Internet (wininet.dll) Elevation of Privilege Vulnerability

Synopsis

An integer overflow in Windows Internet (wininet.dll) allows a local attacker with a low-privilege account to elevate their privileges on affected Windows 10 and Windows 11 systems. The vulnerability is reached locally, requires no user interaction, and exploits an arithmetic wraparound condition in the library to gain full control over the affected process or system. Successful exploitation gives the attacker high-impact read, write, and execution capabilities. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No user action is needed; the attacker can trigger the overflow without involving another account.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory-layout prerequisites.

Blast Radius

• Reads sensitive data accessible to the elevated process, including credentials, session tokens, and protected files.
• Modifies or overwrites files and registry keys that would normally be restricted to privileged accounts.
• Executes arbitrary code at an elevated privilege level, enabling installation of persistent payloads or backdoors.
• Crashes or destabilizes system components if the attacker chooses denial-of-service as an outcome.