CVE-2026-20859CWE-416

CVE-2026-20859

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

⚡ A clever twist in Windows Kernel-Mode Drivers could let an authorized attacker elevate their privileges with just the right timing! Think of this flaw like a construction worker who accidentally leaves behind a ladder that allows others to reach a restricted area on a job site — it’s a slip that can lead to unauthorized access! An attacker could gain elevated privileges on the system, enabling them to perform actions normally restricted to higher-level accounts, like installing malicious software or accessing sensitive data. This could lead to an absolute nightmare for users and administrators alike!

Put simply

Think of this flaw like a construction worker who accidentally leaves behind a ladder that allows others to reach a restricted area on a job site — it’s a slip that can lead to unauthorized access! This vulnerability arises from a use-after-free error in Windows Kernel-Mode Drivers, which allows an attacker with local access to exploit the flaw and escalate their privileges on the system.

What to do

An attacker could gain elevated privileges on the system, enabling them to perform actions normally restricted to higher-level accounts, like installing malicious software or accessing sensitive data. This could lead to an absolute nightmare for users and administrators alike! To mitigate this issue, ensure all systems are updated with the latest security patches from Microsoft. Regularly audit user permissions and limit access to trusted personnel only. It’s crucial to stay proactive in monitoring unusual activities on your systems! You've got this! With these steps, you'll be protecting your systems in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-13T23:16Z
Affected products (3)
ProductVersionsFixed in
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
    cvelistv5