CVE-2026-20811CWE-822CWE-843

CVE-2026-20811

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

⚡ A sneaky type confusion in Windows Win32K could let an authorized user elevate their privileges — that's like a hotel guest getting access to the penthouse suite just because they asked nicely! 😱 Picture this: a hotel with a shifty concierge who lets certain guests sneak into VIP areas without a valid room key. This vulnerability works similarly, letting an attacker exploit a resource by misusing data types, bypassing intended access controls. With this vulnerability, an attacker could gain full control over the system, potentially accessing sensitive data, installing malicious software, or even modifying system settings. The consequences could lead to an absolute nightmare for any organization, compromising both security and integrity.

Put simply

Picture this: a hotel with a shifty concierge who lets certain guests sneak into VIP areas without a valid room key. This vulnerability works similarly, letting an attacker exploit a resource by misusing data types, bypassing intended access controls. This type confusion vulnerability in Windows Win32K allows an attacker with local access to elevate their privileges by improperly accessing resources, leading to unauthorized actions and data exposure.

What to do

With this vulnerability, an attacker could gain full control over the system, potentially accessing sensitive data, installing malicious software, or even modifying system settings. The consequences could lead to an absolute nightmare for any organization, compromising both security and integrity. Update your Windows systems to the latest patches as soon as they are released. Regularly review and limit user privileges to ensure that only necessary access is granted. Implement strong monitoring practices to detect any unusual activity on your systems. You've got this! Stay proactive, and let's keep the bad guys out! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00487 · 41.0th percentile
Weaknesses
CWE-822 · Untrusted Pointer Dereference; CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-01-13T23:16Z
Affected products (6)
ProductVersionsFixed in
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Win32k Elevation of Privilege Vulnerability
    cvelistv5