CVE-2026-32162
Published: 14 April 2026
Summary
CVE-2026-32162 is a high-severity Acceptance of Extraneous Untrusted Data With Trusted Data (CWE-349) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates CVE-2026-32162 by applying Microsoft patches to fix the extraneous untrusted data acceptance in Windows COM.
Information input validation prevents acceptance of extraneous untrusted data with trusted data in Windows COM, blocking the privilege escalation vector.
Least privilege limits the impact of successful local privilege escalation from unprivileged attackers exploiting the COM vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation vulnerability in Windows COM directly enables T1068 (Exploitation for Privilege Escalation) with no privileges or user interaction required.
NVD Description
Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-32162 is a high-severity vulnerability (CVSS 8.4, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) involving the acceptance of extraneous untrusted data alongside trusted data in Windows COM, mapped to CWE-349 (Acceptance of Extraneous Untrusted Data with Trusted Data). It affects the Windows Component Object Model (COM), enabling local privilege escalation for unauthorized attackers. The vulnerability was published on 2026-04-14.
An unauthorized local attacker requires only local access to the system with no privileges (PR:N), low attack complexity (AC:L), and no user interaction (UI:N). Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), specifically elevating privileges on the affected Windows system.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32162 provides details on patches and mitigation recommendations for this vulnerability.
Details
- CWE(s)