CVE-2026-45653: Windows Kernel Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Kernel allows a local attacker with a low-privilege account to elevate their privileges on affected Windows 10 and Windows 11 systems. The flaw is reached locally, meaning the attacker must already have an existing shell or process on the host, and exploitation requires navigating a race condition or favorable memory layout. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the system. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows-based container images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative credentials are needed to attempt exploitation.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability entirely through their own process.

• Attack complexityDetail

  Exploitation is not straightforward and depends on winning a race condition or achieving a specific memory layout, making reliable exploitation harder.

Blast Radius

• Reads protected kernel memory, including credentials, tokens, and sensitive process data belonging to other users or the system.
• Modifies kernel data structures or other processes' memory, enabling persistent changes to system state or privilege grants.
• Crashes the affected system or kernel components, causing a denial of service for all users and workloads on the host.
• Breaks out of lower-privilege process boundaries, allowing full control over the underlying Windows host.