CVE-2026-20857
Published: 13 January 2026
Summary
CVE-2026-20857 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-20857, published on 2026-01-13, is an untrusted pointer dereference vulnerability (CWE-822) in the Windows Cloud Files Mini Filter Driver. This local privilege escalation flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential with low complexity and low privileges required for exploitation.
An authorized attacker with local access and low privileges can exploit the untrusted pointer dereference to elevate privileges on affected Windows systems. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially allowing the attacker full control over the system.
Microsoft's Security Response Center provides details and mitigation guidance in their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20857.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2174
Vulnerability details
Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via untrusted pointer dereference in kernel driver (CWE-822).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the untrusted pointer dereference vulnerability by requiring timely remediation through vendor patches for the affected Windows Cloud Files Mini Filter Driver.
Implements memory protections such as address space randomization and non-executable memory to prevent exploitation of untrusted pointer dereferences leading to privilege escalation.
Enforces least privilege on local low-privilege accounts, limiting the initial attack surface and potential damage prior to successful privilege escalation via the driver vulnerability.