CVE-2026-40369

⚠️ high

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS Score

7.8

High

EPSS Score

4.7

Exploit Probability

Published Date

2026-05-12

First Seen: 2026-05-17

This CVE is Moderate Risk - more severe than 68.5% of all 365,968 vulnerabilities in our database.

#115,144

Above average severity

Severity Percentile

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-06-26

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-822

📦 Affected Products 4

Vendor	Product	Status	Affected Versions
microsoft	windows_11_24h2	Affected	< 10.0.26100.8390
microsoft	windows_server_2025	Affected	< 10.0.26100.32772
microsoft	windows_11_25h2	Affected	< 10.0.26200.8390
microsoft	windows_11_26h1	Affected	< 10.0.28000.2113

Vendor Advisory

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-85921	⚠️ high	8.2	0.4	Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.	2026-09-14
CVE-2026-50349	⚠️ high	7.0	0.2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Functio...	2026-09-08
CVE-2026-56172	⚠️ high	7.8	0.3	Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.	2026-09-08
CVE-2026-56177	⚠️ high	7.8	0.3	Use after free in Windows Server allows an authorized attacker to elevate privileges locally.	2026-09-08
CVE-2026-56198	⚠️ high	7.8	0.3	Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.	2026-09-08
CVE-2026-62694	⚠️ high	7.0	0.3	Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.	2026-09-08

These CVEs affect the same products