CVE-2026-21236
Published: 10 February 2026
Summary
CVE-2026-21236 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the heap-based buffer overflow in the Windows Ancillary Function Driver by applying Microsoft patches as specified in the update guide.
Implements memory protections like DEP, ASLR, and heap cookies that prevent exploitation of heap buffer overflows leading to privilege escalation.
Enforces least privilege on local low-privilege accounts, limiting the initial attack surface and potential impact of escalation via the driver vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap buffer overflow in kernel driver directly enables exploitation for privilege escalation to SYSTEM-level access.
NVD Description
Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-21236 is a heap-based buffer overflow vulnerability (CWE-122, CWE-787) in the Windows Ancillary Function Driver for WinSock. Published on 2026-02-10, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects Windows systems where the driver processes certain inputs, potentially leading to memory corruption.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity and no user interaction. Successful exploitation allows privilege escalation, granting high-impact access to confidentiality, integrity, and availability of the system.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21236 provides details on patches and mitigation steps.
Details
- CWE(s)