CVE-2026-40369
HighUpdated
Published: 12 May 2026
Published
12 May 2026
Modified
01 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0002
4.3th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-40369 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29651
Vulnerability details
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?
Kernel pointer dereference vulnerability directly enables local privilege escalation via exploitation.
Confidence: HIGH · MITRE ATT&CK Enterprise v18.1
CVEs Like This One
CVE-2026-32222Same product: Microsoft Windows 11 24H2
CVE-2026-21250Same product: Microsoft Windows 11 24H2
CVE-2026-25167Same product: Microsoft Windows 11 24H2
CVE-2026-33840Same product: Microsoft Windows 11 24H2
CVE-2026-21232Same product: Microsoft Windows 11 24H2
CVE-2026-42896Same product: Microsoft Windows 11 24H2
CVE-2026-32221Same product: Microsoft Windows 11 24H2
CVE-2026-20938Same product: Microsoft Windows 11 24H2
CVE-2026-33101Same product: Microsoft Windows 11 24H2
CVE-2026-24283Same product: Microsoft Windows 11 24H2
Affected Assets
microsoft
windows 11 24h2
≤ 10.0.26100.8390 · ≤ 10.0.26100.8390
microsoft
windows 11 25h2
≤ 10.0.26200.8390 · ≤ 10.0.26200.8390
microsoft
windows 11 26h1
≤ 10.0.28000.2113 · ≤ 10.0.28000.2113
microsoft
windows server 2025
≤ 10.0.26100.32772
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.