Windows Kernel Flaw Lets Attackers Escalate Privileges Through Memory Counter Bug

A Windows Kernel elevation of privilege vulnerability can let a local attacker gain higher privileges by abusing how the kernel handles a specific system information request. The flaw is tracked as CVE-2026-40369 and has a public proof-of-concept exploit, which increases the urgency for patching.

The NVD entry for CVE-2026-40369 describes the issue as an untrusted pointer dereference in the Windows Kernel that allows an authorized attacker to elevate privileges locally. Microsoft rates it High with a CVSS 3.1 score of 7.8.

Microsoft released fixes for the vulnerability in its May 12, 2026 security updates. Administrators should use the Microsoft Security Response Center advisory to confirm the required update for each affected Windows version.

What CVE-2026-40369 Affects

The vulnerability affects Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, and Windows Server 2025 builds before the fixed versions listed by NVD. The flaw sits in the Windows Kernel, specifically in behavior tied to the `NtQuerySystemInformation` syscall and the `ExpGetProcessInformation` function.

Public technical research says the bug can be reached by calling `NtQuerySystemInformation` with information class 253, also known as `SystemProcessInformationExtension`, and a zero-length buffer. That can create a mismatch in validation and allow controlled changes to kernel memory counters.

Positive Technologies’ vulnerability summary says the bug can allow an unprivileged process to increment arbitrary kernel memory addresses and that the issue is reachable from browser renderer sandboxes because the syscall is not blocked by Win32k lockdown.

Why the Public Exploit Raises the Risk

Security researcher Ori Nimron published technical details and exploit code for CVE-2026-40369. The research describes the issue as an arbitrary kernel address increment primitive that can be used as part of a local privilege escalation chain.

The public GitHub repository says the bug can work from Chrome, Edge, and Firefox renderer sandboxes because the call is a core NT syscall rather than a Win32k syscall. That makes the vulnerability valuable for attackers who already have code execution inside a browser sandbox and want to escape to the system level.

The vulnerability does not provide remote code execution by itself. An attacker still needs local code execution first, such as through malware already running on the device or a separate browser exploit. Once that first foothold exists, CVE-2026-40369 can become a privilege escalation step.

CVE-2026-40369 at a Glance

Detail	Current information
CVE	CVE-2026-40369
Component	Windows Kernel
Weakness	Untrusted pointer dereference
Severity	High, CVSS 3.1 score 7.8
Attack type	Local privilege escalation
User interaction	None after local code execution
Public exploit	Yes
Patch status	Fixed in Microsoft’s May 2026 security updates

How the Kernel Memory Counter Bug Works

The issue centers on a kernel path that continues processing after a length check fails. In the vulnerable flow, the kernel can continue iterating through process information and perform writes tied to process counters even when the supplied buffer length is zero.

That creates a controlled increment behavior rather than a traditional full arbitrary write. Even so, a reliable increment primitive in kernel memory can still be dangerous when paired with knowledge of kernel structures and additional techniques.

The public exploit write-up says values at an attacker-chosen address can be incremented during process iteration. In practical exploitation, attackers would need to combine this primitive with other steps to locate useful kernel objects and gain stronger control.

Why Browser Sandboxes Are Mentioned

The browser sandbox angle matters because modern browsers try to isolate renderer processes from the rest of the operating system. If an attacker compromises a renderer, the sandbox should limit what that code can do next.

CVE-2026-40369 weakens that boundary because the vulnerable syscall can still be reached from restricted browser renderer contexts. This does not mean visiting a website automatically gives an attacker SYSTEM access. It means the kernel bug could be chained after a separate renderer compromise.

Positive Technologies summarizes the issue as reachable from Chrome, Edge, and Firefox renderer sandboxes and recommends updating Windows versions affected by the May 2026 patch cycle.

Affected Versions and Fixed Builds

The NVD affected configuration list identifies vulnerable Windows 11 24H2, 25H2, and 26H1 builds, as well as Windows Server 2025 builds before the relevant fixed versions. This makes the issue relevant to both endpoint fleets and server environments.

Product	Affected builds according to NVD	Action
Windows 11 24H2	Versions before 10.0.26100.8390	Install the May 2026 or later security update
Windows 11 25H2	Versions before 10.0.26200.8390	Install the May 2026 or later security update
Windows 11 26H1	Versions before 10.0.28000.2113	Install the May 2026 or later security update
Windows Server 2025	Versions before 10.0.26100.32772	Install the May 2026 or later security update

What Security Teams Should Do Now

The main mitigation is patching. Since Microsoft already released security updates, organizations should prioritize systems that run browsers, handle untrusted content, or host workloads where attackers may gain low-privilege code execution.

• Install the latest Windows security updates on affected Windows 11 and Windows Server 2025 systems.
• Confirm build numbers after patching, not only update installation status.
• Prioritize endpoints used for browsing, email, document handling, and development.
• Review EDR alerts for unusual local privilege escalation behavior.
• Monitor suspicious calls to `NtQuerySystemInformation` when paired with exploit-like process behavior.
• Reduce local admin exposure and block unnecessary executable content.
• Keep browsers fully updated to reduce the chance of exploit chaining from a renderer bug.

The Microsoft advisory remains the official reference for affected products and update guidance. Organizations should also make sure cumulative updates have not failed on systems that appear compliant in inventory tools.

Why This Vulnerability Matters

Kernel privilege escalation flaws remain valuable because they help attackers move from limited execution to full control. Even when a bug requires local access, it can still become dangerous when chained with phishing, malware delivery, browser exploitation, or document-based attacks.

CVE-2026-40369 is also notable because public exploit details are available. That shortens the time defenders have to patch before attackers can adapt the technique for real-world malware or red-team tooling.

The broader lesson is simple: browser sandboxes and user privilege boundaries help, but they do not replace kernel patching. When a kernel bug can be reached from restricted code, fast update deployment becomes the strongest defense.

FAQ