CVE-2026-34336
HighUpdated
Published: 12 May 2026
Published
12 May 2026
Modified
01 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0005
15.7th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-34336 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29595
Vulnerability details
Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?
Local buffer over-read enables unauthorized local data access/disclosure from system memory.
Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1
CVEs Like This One
CVE-2026-34329Same product: Microsoft Windows 10 1607
CVE-2026-26180Same product: Microsoft Windows 10 1607
CVE-2026-40398Same product: Microsoft Windows 10 1607
CVE-2026-25188Same product: Microsoft Windows 10 1607
CVE-2026-33837Same product: Microsoft Windows 10 1607
CVE-2026-40407Same product: Microsoft Windows 10 1607
CVE-2026-40377Same product: Microsoft Windows 10 1607
CVE-2026-34343Same product: Microsoft Windows 10 1607
CVE-2026-35421Same product: Microsoft Windows 10 1607
CVE-2026-40403Same product: Microsoft Windows 10 1607
Affected Assets
microsoft
windows 10 1607
≤ 10.0.14393.9140 · ≤ 10.0.14393.9140
microsoft
windows 10 1809
≤ 10.0.17763.8755 · ≤ 10.0.17763.8755
microsoft
windows 10 21h2
≤ 10.0.19044.7291 · ≤ 10.0.19044.7291 · ≤ 10.0.19044.7291
microsoft
windows 10 22h2
≤ 10.0.19045.7291 · ≤ 10.0.19045.7291 · ≤ 10.0.19045.7291
microsoft
windows 11 23h2
≤ 10.0.22631.7079 · ≤ 10.0.22631.7079
microsoft
windows 11 24h2
≤ 10.0.26100.8390 · ≤ 10.0.26100.8390
microsoft
windows 11 25h2
≤ 10.0.26200.8390 · ≤ 10.0.26200.8390
microsoft
windows 11 26h1
≤ 10.0.28000.2113 · ≤ 10.0.28000.2113
microsoft
windows server 2016
≤ 10.0.14393.9140
microsoft
windows server 2019
≤ 10.0.17763.8755
+3 more product configuration(s) — see NVD for full list
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.