CVE-2026-45653

What it actually does

This is a local privilege escalation vulnerability in the Windows Kernel caused by use-after-free memory corruption. An attacker who already has low-privileged local code execution can trigger a kernel object lifetime error so that freed memory is reused in a controlled way, potentially allowing execution of attacker-controlled logic in kernel context. Successful exploitation can grant SYSTEM-level privileges, disable or tamper with security controls, read or modify protected data, and take full control of the affected Windows host. The CVSS vector indicates local access is required, user interaction is not required, privileges are required, and exploitation complexity is high.

Why it matters to the business

If exploited, this flaw can turn an initial low-privilege foothold into full administrative control of a Windows workstation or server. That can enable credential theft, security tool tampering, lateral movement, data access, persistence, and ransomware deployment. Although EPSS is currently low and there is no known KEV listing or reported exploit maturity, the affected product range includes broadly deployed Windows client and server versions, so organizations should treat patching as important defense-in-depth, especially on internet-facing management hosts, shared servers, domain-joined endpoints, and systems used by privileged administrators.

How an attack unfolds

An attacker must first obtain local execution as an authenticated, low-privileged user or through another vulnerability, phishing payload, stolen credentials, exposed remote access service, or malicious insider access. They then run a local exploit that interacts with the vulnerable Windows kernel component and attempts to trigger a use-after-free condition. Because the attack complexity is high, reliable exploitation likely depends on precise kernel memory layout manipulation, timing, and OS build-specific behavior. If successful, the exploit gains kernel-level execution or modifies security-relevant kernel structures, allowing the attacker to spawn a process as SYSTEM, inject into privileged processes, disable endpoint defenses, dump credentials, install persistence, or move laterally using elevated privileges.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 where applicable. Because no fixed version details were provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the relevant cumulative security update released for this CVE or later. Prioritize systems where local compromise has high consequence: domain controllers, management servers, jump hosts, virtualization hosts, RDS/session hosts, developer workstations, and endpoints used by privileged administrators. Until patched, reduce exposure by enforcing least privilege, removing unnecessary local administrator rights, restricting interactive logon to servers, enabling attack surface reduction rules, blocking untrusted executables, using application control, and monitoring for suspicious local privilege escalation behavior.

How to confirm the fix worked

Confirm the installed Windows cumulative update level includes the vendor fix for this vulnerability. Validate through centralized patch management reporting, Windows Update history, the Microsoft Update compliance tools in use, or host-level commands such as checking installed hotfixes and OS build information. For representative systems, verify the OS version and build are at or above the fixed build documented by Microsoft for that product branch. Run authenticated vulnerability scans after patch deployment and ensure the scanner plugin or detection content specifically recognizes remediation for this CVE. Confirm mitigation coverage by testing that standard users do not have unnecessary local administrator rights and that endpoint controls alert on suspicious privilege escalation patterns. For servers, confirm there are no unpatched legacy or out-of-support Windows installations remaining in scope.

Typical attack path

1. Gain initial local code execution on an affected Windows client or server using credentials, malware, remote access, or a separate vulnerability.
2. Confirm the host OS build is vulnerable and suitable for the exploit technique.
3. Run a local privilege escalation exploit that triggers the Windows Kernel use-after-free condition.
4. Manipulate freed kernel memory to achieve arbitrary kernel-mode execution or alter privilege-related kernel state.
5. Create or hijack a privileged process, commonly resulting in SYSTEM-level execution.
6. Disable security controls, access protected files or credentials, establish persistence, and use the elevated foothold for lateral movement or further compromise.

How to detect it

There are no public, CVE-specific indicators provided for this vulnerability, and kernel use-after-free exploitation often leaves limited direct evidence. Focus detection on post-exploitation behaviors that follow local privilege escalation. Review EDR telemetry, Windows Security logs, Sysmon logs, Microsoft Defender logs, PowerShell logs, service control manager events, driver load events, crash dumps, and endpoint tamper-protection alerts. Hunt for low-privileged user processes that unexpectedly spawn SYSTEM-level shells or administrative tools, unusual parent-child relationships leading to cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, schtasks.exe, sc.exe, net.exe, or whoami.exe /priv, and service creation shortly after execution from user-writable paths. Look for exploitation attempts that coincide with kernel crashes, bugchecks, abnormal application crashes, or repeated failed exploit attempts. Also review for follow-on actions such as LSASS access, credential dumping, local group modification, scheduled task creation, new services, suspicious driver loads, security tool disablement, firewall changes, and lateral movement from hosts that were unpatched during the exposure window.

What your security team should do

• Prioritize patching Windows servers and privileged-user workstations first, then complete broad endpoint deployment through normal emergency or accelerated patch channels.
• Use authenticated vulnerability scanning and patch compliance reporting to identify all affected Windows 10, Windows 11, and Windows Server assets that have not received the relevant cumulative update.
• Review local administrator group membership, privileged access assignments, and interactive logon permissions to reduce the number of accounts that can benefit from local privilege escalation.
• Increase monitoring for low-privileged processes spawning SYSTEM shells, unexpected service creation, suspicious driver loads, credential dumping behavior, and endpoint security tampering.
• Harden endpoints with application control, Microsoft Defender Attack Surface Reduction rules, credential protection, tamper protection, and EDR behavioral detections for local privilege escalation.
• Investigate any recent endpoint alerts involving privilege escalation, kernel exploit behavior, LSASS access, security tool disablement, or abnormal parent-child process chains on unpatched systems.
• Track Microsoft advisories for updated exploitability guidance, fixed build information, or evidence of in-the-wild exploitation, and raise urgency if exploit code becomes public or the issue is added to KEV.