CVE-2026-25165
Published: 10 March 2026
Summary
CVE-2026-25165 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-25165 is a null pointer dereference vulnerability (CWE-476) in Windows Performance Counters, affecting Microsoft Windows systems. Published on 2026-03-10, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges (PR:L) can exploit this vulnerability through local access (AV:L) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows privilege escalation, granting high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U).
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25165 details available patches and mitigation recommendations for addressing this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10628
Vulnerability details
Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null pointer dereference in Windows Performance Counters enables local low-privileged attacker to achieve privilege escalation with high impact on C/I/A, directly mapping to T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the null pointer dereference vulnerability by requiring timely identification, reporting, prioritization, and correction of flaws like CVE-2026-25165 through patching.
Limits the impact of local privilege escalation by enforcing least privilege for users and processes interacting with Windows Performance Counters.
Provides memory protection mechanisms such as guard pages that defend against exploitation of null pointer dereferences in system components.