Windows Secure Kernel Double-Free Flaw Enables Privilege Escalation
Microsoft disclosed and patched CVE-2026-26179, a Windows Secure Kernel elevation-of-privilege vulnerability caused by a double-free condition. The flaw, also tracked as ZDI-26-276, stems from improper validation of an object’s existence before additional free operations occur, creating a path for a local attacker to escalate privileges on affected Windows systems.
According to Zero Day Initiative, successful exploitation requires an attacker to already be able to execute high-privileged code on the target, after which arbitrary code execution may be possible in the context of the VTL1 Secure Kernel. The issue was assigned a CVSS 7.5 score, credited to researcher fastfail, reported to Microsoft in December 2025, and addressed through a Microsoft security update.
Timeline
Apr 15, 2026
CVE-2026-26179 is publicly disclosed
Zero Day Initiative publicly disclosed CVE-2026-26179 / ZDI-26-276, describing it as a Microsoft Windows Secure Kernel double free vulnerability that could allow local privilege escalation to VTL1 Secure Kernel context.
Apr 14, 2026
Microsoft releases fix for CVE-2026-26179
Microsoft published a Security Update Guide entry for CVE-2026-26179, a Windows Kernel Elevation of Privilege vulnerability, indicating an update was made available to remediate the issue.
Dec 9, 2025
Researcher reports Windows Secure Kernel flaw to Microsoft
Security researcher fastfail reported a Microsoft Windows Secure Kernel double free vulnerability, later tracked as CVE-2026-26179 and ZDI-26-276, to Microsoft through coordinated disclosure.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Sources
Related Stories
Active Exploitation of Windows Kernel Privilege Escalation Vulnerability CVE-2025-62215
Microsoft has disclosed a critical elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2025-62215, which is being actively exploited in the wild. The flaw arises from a race condition and improper memory management, specifically a double-free scenario, allowing local attackers to escalate privileges to SYSTEM level. Exploitation requires an attacker to already have access to the system, but no user interaction is needed, and the attack can be automated. Microsoft has rated the vulnerability as Important, with a CVSS score of 7.0, and notes that all supported Windows 10 editions are affected, including those under Extended Security Updates (ESU). No workaround is available other than applying the official update, and immediate patching is strongly recommended. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-415 (Double Free), making it a classic post-compromise privilege escalation vector. Attackers can exploit the timing-sensitive memory corruption path in the kernel to gain elevated access, disable security defenses, and move laterally within networks. The attack surface is particularly concerning in enterprise environments where multiple users share access, as any authenticated user can potentially trigger the exploit. Security experts warn that both targeted threat actors and ransomware operators may leverage this flaw to deepen their foothold after initial access, emphasizing the urgency of deploying the security update across all affected systems.
1 months ago
Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-26132)
Microsoft published details for **CVE-2026-26132**, an **Important** severity **Windows Kernel** *elevation of privilege* vulnerability caused by **CWE-416 (use-after-free)**. The issue is scored **CVSS 3.1: 7.8** with vector `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating exploitation requires **local access** and **low complexity**, with **low privileges required** and **no user interaction**, and could result in high impact to confidentiality, integrity, and availability. Microsoft’s Security Update Guide entry provides standard machine-consumable references (e.g., *PowerShell*, *API*, and *CSAF* links) for tracking and patch management. No additional exploitation details, in-the-wild exploitation confirmation, or public proof-of-concept information is included in the provided material beyond the vulnerability classification and scoring.
1 months ago
Microsoft Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-24289)
Microsoft published guidance for **CVE-2026-24289**, an **Important** severity **Windows Kernel elevation of privilege** vulnerability caused by **CWE-416 (use-after-free)**. Microsoft scored the issue with **CVSS 3.1: 7.8** (vector `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`), indicating exploitation requires **local** access with **low** attack complexity and **low privileges**, and could result in high impact to confidentiality, integrity, and availability if successfully exploited. The Security Update Guide entry provides standard Microsoft consumption options (e.g., *PowerShell*, API, CSAF) for tracking and integrating the advisory into vulnerability management workflows. The two provided references are effectively duplicate MSRC pages for the same CVE (one localized under `/en-US/`) and do not add distinct technical details beyond the vulnerability classification and scoring.
1 months ago