CVE-2026-33839

What it actually does

This is a local privilege escalation vulnerability in the Windows Win32K graphics subsystem caused by improper synchronization of a shared resource during concurrent execution. A low-privileged, authenticated local attacker who can run code on an affected Windows host may be able to win a race condition in kernel-mode graphics handling and elevate execution to a higher privilege level, potentially SYSTEM. Successful exploitation could allow full compromise of confidentiality, integrity, and availability on the affected endpoint or server. The CVSS vector indicates local access, low privileges required, no user interaction, high attack complexity, and high impact across confidentiality, integrity, and availability.

Why it matters to the business

If exploited, an attacker who already has a foothold on a Windows workstation or server could turn limited access into full administrative control of that system. This can enable credential theft, disabling of security tools, lateral movement, persistence, tampering with business applications, and deployment of additional malware. Because the affected products include widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 versions, exposure may be broad in enterprise environments. Current public exploitation signals are low: EPSS is 0.0019 with no 30-day increase, the vulnerability is not listed in CISA KEV, no ransomware association is indicated, and exploit maturity is reported as none; however, local privilege escalation flaws are commonly chained with phishing, drive-by compromise, stolen credentials, or remote code execution vulnerabilities.

How an attack unfolds

An attacker first needs authenticated local code execution on an affected Windows system, such as through a compromised user account, malware execution, an abused remote access session, or a separate initial-access vulnerability. From that foothold, the attacker runs a purpose-built exploit that repeatedly triggers the vulnerable Win32K graphics code path while manipulating timing between concurrent operations. If the race condition is won, improper synchronization of the shared resource can corrupt or confuse kernel-mode state in a way that allows the attacker-controlled process to gain elevated privileges. With elevated privileges, the attacker can create or modify administrator-level accounts, dump credentials, tamper with endpoint security controls, install persistence, access protected files, or use the system as a staging point for lateral movement. Exploitation is expected to be less reliable than simple local privilege escalation due to the high attack complexity associated with the race condition.

How to fix it

Apply the appropriate Microsoft Windows cumulative security update that addresses CVE-2026-33839 for all affected Windows client and server versions, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no exact fixed build numbers were provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or equivalent patch management tooling to deploy the latest cumulative update released on or after the vendor’s advisory date for the affected platform. Prioritize systems where low-privileged users can log on interactively, multi-user servers, remote desktop hosts, developer workstations, VDI images, and systems with elevated credential exposure. If immediate patching is not possible, reduce risk by limiting local logon rights, restricting Remote Desktop access, enforcing least privilege, blocking untrusted executable/script execution with application control, ensuring endpoint detection and response protections are active, and monitoring for local privilege escalation behavior. There is no complete configuration-only mitigation for a kernel-mode race condition; patching is the primary remediation.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows asset has installed the relevant cumulative security update or a later superseding update for its operating system branch. Use centralized patch compliance reporting, Microsoft Update history, WSUS/Configuration Manager compliance state, vulnerability scanners authenticated to the host, or PowerShell inventory of installed hotfixes/build numbers. Validate that gold images, VDI templates, server images, and offline images are also updated before reuse. Re-scan representative systems after patch deployment to ensure the vulnerability is no longer reported. Where patch status is assessed by build number rather than KB, compare the host OS build and UBR against Microsoft’s fixed build guidance for the applicable Windows release. For exposure validation, identify affected Windows versions that remain below the fixed cumulative update level and prioritize those allowing interactive users or remote desktop sessions.

Typical attack path

1. Gain initial authenticated access to an affected Windows workstation or server using stolen credentials, malware execution, social engineering, or another vulnerability.
2. Execute a local exploit from a low-privileged user context on the affected host.
3. Trigger the vulnerable Win32K graphics race condition repeatedly to win the timing window.
4. Abuse the synchronization flaw to obtain elevated privileges, potentially SYSTEM-level execution.
5. Use the elevated context to disable defenses, dump credentials, modify system settings, establish persistence, or move laterally.

How to detect it

Because this is a local kernel-mode privilege escalation issue and no public exploit indicators were provided, detection should focus on signs of exploitation attempts and post-exploitation rather than a unique network signature. Collect and review Windows Security logs, Sysmon or equivalent endpoint telemetry, EDR process lineage, PowerShell logs, Windows Defender logs, service control events, local group membership changes, and crash telemetry. Look for low-privileged user processes spawning elevated or SYSTEM-level child processes without a normal administrative path; unexpected privileged process creation from user-writable directories such as user profiles, Downloads, Temp, ProgramData, or public folders; sudden local administrator membership changes; suspicious service or scheduled task creation; attempts to dump LSASS or access credential stores; tampering with Defender, EDR, audit policy, or security services; and unusual crashes or instability involving win32k components shortly before privilege changes. Useful Windows events include 4688 process creation, 4672 special privileges assigned, 4624 logon events, 4720 user creation, 4728/4732 privileged group membership changes, 4697 service installation, 7045 service creation in the System log, 4698 scheduled task creation, 1102 audit log cleared, and Defender operational events for protection changes. Kernel race-condition exploits may generate little deterministic logging, so correlate suspicious privilege transitions with preceding low-privileged process execution and endpoint memory/crash telemetry. If exploit code later becomes public, add file hashes, command-line patterns, and YARA/Sigma detections for that exploit family.

• Event ID 4688
• Event ID 4672
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Event ID 4697
• Event ID 7045
• Event ID 4698
• Event ID 1102
• Microsoft-Windows-Windows Defender/Operational
• Microsoft-Windows-PowerShell/Operational
• C:\Users\*\AppData\Local\Temp\*.exe
• C:\Users\*\Downloads\*.exe
• C:\ProgramData\*.exe
• C:\Users\Public\*.exe
• lsass.exe
• procdump.exe
• comsvcs.dll
• rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump
• vssadmin.exe delete shadows
• wevtutil.exe cl
• sc.exe create
• schtasks.exe /create
• net localgroup administrators
• Add-LocalGroupMember -Group Administrators
• Set-MpPreference -DisableRealtimeMonitoring $true

What your security team should do

• Patch affected Windows endpoints and servers with the applicable cumulative security update or a later superseding update, prioritizing systems with interactive logon, RDP exposure, shared administrative use, or sensitive credentials.
• Run an authenticated vulnerability scan or patch compliance query across Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets to identify remaining exposure.
• Review local administrator group membership, privileged service accounts, and endpoint privilege assignments to limit the value of successful local escalation.
• Harden execution controls with Microsoft Defender Application Control, AppLocker, attack surface reduction rules, and script control to reduce the ability of low-privileged users or malware to run local exploit code.
• Monitor for post-exploitation behaviors associated with local privilege escalation, including unexpected SYSTEM-level process creation from user-writable paths, new local administrators, credential dumping attempts, security tool tampering, and suspicious service creation.
• Increase scrutiny on hosts that recently showed malware, suspicious logons, web shell activity, phishing execution, or other initial-access indicators, because this flaw requires an existing local foothold.
• Track Microsoft advisory updates for any later exploitability assessment changes, exploit publication, fixed build details, or known exploitation reports.