CVE-2026-45657: Windows Kernel Remote Code Execution Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Kernel allows an unauthenticated remote attacker to execute arbitrary code on affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is reachable over the network, requires no credentials, no user interaction, and succeeds reliably without special conditions. Successful exploitation gives the attacker full control over the affected system, including read and write access to kernel memory and the ability to disrupt service availability. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows builds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected service over a standard network connection; no local or physical access is required.

• AuthenticationNot required

  No credentials or account of any kind are needed; the vulnerability is exploitable by an anonymous attacker.

• Victim interactionNot required

  No user action is required; exploitation occurs without any interaction from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker executes arbitrary code at kernel privilege level, gaining complete control over the operating system.
• The attacker reads any data accessible to the kernel, including secrets, credentials, and memory belonging to other processes.
• The attacker modifies kernel data structures, persisted files, and any resource the operating system can write.
• The attacker crashes or destabilizes the kernel, causing a full system outage for all workloads running on the host.