CVE-2026-65775

Windows Win32k Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which affected Windows versions you run (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019/2022/2025).
Check your installed Windows update/build level and compare it to the fixed versions listed below for your specific edition.
Install the Microsoft fix for CVE-2026-65775 from the Microsoft Update Guide for your system as soon as possible.
Reboot after installing updates and verify the system is on (or above) the fixed build for your version.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

This is a Windows security flaw that can let someone with local access gain higher privileges; most small businesses should patch it quickly because it affects many Windows 10/11 and Windows Server versions.

CVE-2026-65775 is a Windows Win32k elevation-of-privilege issue (CWE-416, use-after-free) that can be triggered by an authorized local attacker to gain higher privileges on affected Windows 10/11 and Windows Server systems; it is not listed in CISA KEV and has no public exploit code on record.

If you're affected

Local privilege escalation
Full system takeover risk
Malware persistence
Service disruption

What is it

Think of Windows as a building and Win32k as a shared set of “controls” used by many apps. This flaw is like leaving a key in the wrong drawer and then reusing that drawer—an attacker who already has a foothold locally can potentially turn that mistake into higher permissions.

Who is affected

This matters if your business runs Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025. Because this is a local privilege escalation (an attacker needs authorization/access on the machine), it’s primarily a risk for systems where an attacker already has some level of access (for example, a compromised user account or malware already running).

How urgent is it

This is RED because the flaw can directly lead to local privilege escalation on many widely used Windows versions, and the latest reporting indicates a new patch event. Even though there’s no public exploit code on record and it is not listed in CISA KEV, you should patch promptly to reduce the chance of a foothold turning into full control.

What to do — in detail

Confirm exposure

Identify every device in your environment running one of the affected products: Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025.
For each device, determine the OS version/build number (what you have installed) using your normal IT inventory method (e.g., your systems management tool, or the Windows “About” page).

Determine the fixed build you need

Patch to a version at or above the fixed builds below (Microsoft provides details per edition):

Windows 10:
- fixed in 10.0.14393.9418
- fixed in 10.0.17763.9121
- fixed in 10.0.19044.7663
- fixed in 10.0.19045.7663
Windows 11:
- fixed in 10.0.22631.7517
- fixed in 10.0.26100.9168
- fixed in 10.0.26200.9168
- fixed in 10.0.28000.2704
Windows Server 2012:
- fixed in 6.2.9200.26280
Windows Server 2012 R2:
- fixed in 6.3.9600.23338
Windows Server 2016:
- fixed in 10.0.14393.9418
Windows Server 2019:
- fixed in 10.0.17763.9121

Apply the patch

Install the Microsoft remediation update for CVE-2026-65775 using the Microsoft Update Guide recommended for your OS version.
Reboot each machine after patching to ensure the update is fully applied.

Temporary workaround (if patching is delayed)

Reduce the chance of a local attacker getting access: restrict local logons where possible, tighten endpoint access controls, and ensure devices are not running with unnecessary admin privileges.
Watch for suspicious local activity that could indicate a system is already compromised, since this issue requires an attacker with local/authorized access.

What to monitor after patching

Confirm your endpoint inventory shows the fixed build for each OS version.
Review logs for unusual privilege changes or suspicious process activity around the time of any account compromise.

CISA due date

Not applicable here: this CVE is not listed in CISA KEV.

Technical context

Severity and impact

Classified as HIGH with a focus on local privilege escalation (CWE-416: Use-After-Free).

Mechanism

The issue is a Win32k use-after-free condition in Windows GUI/kernel components. The practical effect is that an authorized local attacker can use the flaw to elevate privileges.

Exploitation status

Not listed in CISA KEV.
No public exploit code on record.
Reported “press attention” indicates a new patch and mentions the Lazarus group, but this finding set does not confirm public exploitation.

Attack vector / prerequisites

Local-only: exploitation requires the attacker to already have authorized access on the target system (no “remote drive-by” indicator in the findings).

Fix availability

Microsoft has published fixes with specific fixed build numbers for multiple Windows 10/11 and Windows Server branches (see what_to_do).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable