Cyber Resilience

CVE-2026-41088

HighUpdated

Published: 12 May 2026

Published
12 May 2026
Modified
01 June 2026
KEV Added
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 22.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41088 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

CWE-73 external file/path control in a Windows kernel driver directly enables local privilege escalation via exploitation of the vulnerable component.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-24287Same product: Microsoft Windows 10 21H2
CVE-2026-20931Same product: Microsoft Windows 10 21H2
CVE-2026-26172Same product: Microsoft Windows 10 21H2
CVE-2026-24293Same product: Microsoft Windows 10 21H2
CVE-2026-33841Same product: Microsoft Windows 10 21H2
CVE-2026-26132Same product: Microsoft Windows 10 21H2
CVE-2026-32155Same product: Microsoft Windows 10 21H2
CVE-2026-20817Same product: Microsoft Windows 10 21H2
CVE-2026-20871Same product: Microsoft Windows 10 21H2
CVE-2026-32158Same product: Microsoft Windows 10 21H2

Affected Assets

microsoft
windows 10 21h2
≤ 10.0.19044.7291 · ≤ 10.0.19044.7291 · ≤ 10.0.19044.7291
microsoft
windows 10 22h2
≤ 10.0.19045.7291 · ≤ 10.0.19045.7291 · ≤ 10.0.19045.7291
microsoft
windows 11 23h2
≤ 10.0.22631.7079 · ≤ 10.0.22631.7079
microsoft
windows 11 24h2
≤ 10.0.26100.8390 · ≤ 10.0.26100.8390
microsoft
windows 11 25h2
≤ 10.0.26200.8390 · ≤ 10.0.26200.8390
microsoft
windows 11 26h1
≤ 10.0.28000.2113 · ≤ 10.0.28000.2113
microsoft
windows server 2022
≤ 10.0.20348.5074
microsoft
windows server 2022 23h2
≤ 10.0.25398.2330
microsoft
windows server 2025
≤ 10.0.26100.32772

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-73

Rejects externally supplied file or resource identifiers that fail validity checks.

References