CVE-2026-45600: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Synopsis

A type confusion vulnerability in the Windows Kernel-Mode Drivers component allows a locally authenticated attacker to elevate privileges on affected Windows 11 and Windows Server 2025 systems. The flaw is reached locally and requires only a low-privilege account, with no network exposure or victim interaction needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the host. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is involved.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative credentials are required to trigger the vulnerability.

• Victim interactionNot required

  The attacker can execute the exploit entirely on their own without requiring any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker reads protected kernel memory, including credentials, session tokens, and sensitive process data belonging to other users or the OS.
• The attacker writes to kernel memory or modifies privileged system structures, allowing persistent backdoors or tampering with security controls.
• The attacker can crash or destabilize the kernel, causing the host to stop functioning and taking down all workloads running on it.
• Because the elevation reaches kernel level, any container isolation relying solely on OS-level primitives on the same host is at risk of being bypassed.