CVE-2026-40377

What it actually does

CVE-2026-40377 is a local privilege escalation vulnerability caused by a heap-based buffer overflow in Windows Cryptographic Services. An attacker who already has local authenticated access can trigger memory corruption in the service and potentially execute code with elevated privileges, likely in the security context of the affected Windows service. Successful exploitation can result in full compromise of confidentiality, integrity, and availability on the local system.

Why it matters to the business

This flaw can allow a low-privileged user or malware that has already gained a foothold on a Windows workstation or server to become highly privileged, enabling credential theft, security tooling tampering, lateral movement, ransomware staging, or persistence. The issue affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so broad enterprise exposure is possible. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low and stable EPSS, and has no reported exploit maturity, but the high local impact makes timely patching important for defense-in-depth.

How an attack unfolds

An attacker first obtains local access to an affected Windows system, typically through stolen credentials, phishing-delivered malware, exploitation of another vulnerability, or interactive access as a standard user. The attacker then runs a local program that sends crafted input to Windows Cryptographic Services in a way that triggers the heap-based buffer overflow. If exploitation succeeds, the attacker gains execution in a more privileged context and can use that access to disable defenses, dump credentials, create persistence, move laterally, or deploy additional payloads. Because this is a local privilege escalation issue, it is most valuable as a post-compromise step rather than an initial remote entry point.

How to fix it

Apply the relevant Microsoft security update or latest cumulative update for all affected Windows versions, including Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2012/2016/2019/2022/2022 23H2/2025. No exact fixed build numbers were provided in the input, so use the Microsoft Security Update Guide and Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch management tooling to identify and deploy the update that remediates CVE-2026-40377. Where immediate patching is not possible, reduce risk by limiting local interactive access, enforcing least privilege, restricting execution from user-writable paths, enabling attack surface reduction rules, monitoring Cryptographic Services crashes, and ensuring endpoint detection controls are active. Do not disable Cryptographic Services as a routine mitigation because it is core Windows functionality and may break certificate, update, and cryptographic operations.

How to confirm the fix worked

Confirm each system has installed the Microsoft security update that supersedes or explicitly remediates this vulnerability for its Windows release. Validate through Windows Update history, installed cumulative update KB inventory, endpoint management compliance reports, vulnerability scanner results, or authenticated checks against OS build and patch level. Confirm affected Windows versions are no longer reported as vulnerable by a current scanner plugin or Microsoft compliance source. After remediation, monitor for abnormal Cryptographic Services crashes or suspicious child processes from svchost.exe to ensure there are no continuing exploitation attempts or instability.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Execute a malicious local binary, script, or exploit component under a low-privileged account.
3. Interact with Windows Cryptographic Services using crafted input that triggers heap memory corruption.
4. Achieve code execution or privilege escalation in the context of the affected service.
5. Use elevated privileges to dump credentials, disable security controls, add persistence, access protected data, or move laterally.

How to detect it

To assess whether this was already exploited, review endpoint and Windows logs for local privilege escalation behavior rather than relying on a single unique network indicator. Relevant sources include Windows Security logs, System logs, Application logs, Windows Error Reporting, Sysmon, EDR process telemetry, service creation logs, scheduled task logs, PowerShell logs, and authentication events. Look for crashes of the Cryptographic Services service or its hosting svchost.exe process followed closely by unexpected SYSTEM-level processes, new local administrator membership, new services, new scheduled tasks, credential dumping tools, security control tampering, or lateral movement attempts. In Windows Security logs, review Event ID 4688 for suspicious process creation, 4672 for special privileges assigned to a new logon, 4624 for unusual local or remote logons, 4697 for service installation, 4698 for scheduled task creation, 4720 for new user creation, and 4732 for additions to privileged groups. In Sysmon, review Event ID 1 for process creation, 7 for unusual DLL loads in svchost.exe, 10 for process access to credential stores, 11 for dropped files, and 13 for registry persistence. There are no public exploit-specific indicators provided, so detections should focus on behavioral correlation: low-privileged execution, CryptSvc instability, and rapid transition to privileged activity.

• CryptSvc
• Cryptographic Services
• svchost.exe -k NetworkService -p -s CryptSvc
• Faulting application name: svchost.exe
• Faulting module name: cryptsvc.dll
• Windows Error Reporting
• Event ID 4688
• Event ID 4672
• Event ID 4697
• Event ID 4698
• Event ID 4720
• Event ID 4732
• Sysmon Event ID 1
• Sysmon Event ID 7
• Sysmon Event ID 10
• Sysmon Event ID 11
• Sysmon Event ID 13
• cmd.exe /c whoami /priv
• net localgroup administrators
• schtasks /create
• sc.exe create

What your security team should do

• Prioritize patching internet-adjacent Windows servers, domain-joined servers, administrator workstations, jump hosts, and systems used by privileged users, even though the flaw requires local access.
• Deploy the relevant Microsoft cumulative/security updates across all affected Windows client and server versions using standard patch management tooling.
• Review endpoint telemetry for signs of recent local privilege escalation, especially Cryptographic Services crashes followed by SYSTEM-level process creation or account changes.
• Ensure EDR, Sysmon, Windows Security logging, and PowerShell logging are enabled on high-value Windows systems to improve post-exploitation visibility.
• Restrict local administrator rights, enforce application control where feasible, and block execution from common user-writable directories to reduce exploit delivery opportunities.
• Monitor Microsoft Security Update Guide, vendor advisories, and threat intelligence for any change in exploit maturity, KEV status, or observed exploitation.