CVE-2026-21232
Published: 10 February 2026
Summary
CVE-2026-21232 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the untrusted pointer dereference vulnerability in Windows HTTP.sys by requiring timely installation of Microsoft patches.
Employs memory protection mechanisms such as ASLR and DEP to mitigate exploitation of the pointer dereference in the kernel-mode HTTP.sys driver.
Enforces least privilege on local low-privilege accounts, limiting the scope and impact of privilege escalation attempts via this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local untrusted pointer dereference in kernel driver directly enables exploitation for privilege escalation to SYSTEM-level access.
NVD Description
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-21232 is an untrusted pointer dereference vulnerability, classified under CWE-822, affecting the Windows HTTP.sys kernel-mode driver. This component handles HTTP requests in Windows operating systems. Published on 2026-02-10, the vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges (PR:L) can exploit this vulnerability through low-complexity actions requiring no user interaction. Exploitation enables privilege escalation, granting the attacker high-level impacts on confidentiality, integrity, and availability, potentially allowing full system compromise from an initial low-privilege position.
Microsoft's advisory provides mitigation guidance, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21232. Security practitioners should consult this update guide for patching instructions and recommended actions.
Details
- CWE(s)