Loading story…
Google Project Zero published records for two Windows privilege-escalation issues affecting core operating system behavior. One issue describes a Windows kernel flaw in which a registry security descriptor reference count can overflow when it is referenced by too many transacted operations, a condition that could enable elevation of privilege in the kernel. A separate Project Zero bug record identifies a Windows issue involving system drive replacement during impersonation, also categorized as an elevation-of-privilege flaw.
The available references provide only limited technical and remediation detail, but they indicate that both findings were tracked through Project Zero's vulnerability disclosure process and affect Microsoft Windows security boundaries. For defenders, the disclosures highlight risk around low-level Windows components tied to the registry, transaction handling, and impersonation logic, and they warrant validation that relevant Microsoft fixes for the associated Project Zero-reported issues have been applied across supported Windows systems.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A Project Zero issue record was published for a Windows kernel vulnerability described as "registry security descriptor refcount may overflow when referenced by too many transacted operations." The visible metadata indicates a vulnerability record exists, but the excerpt does not expose the CVE, vendor, fix status, or full technical details.
Google Project Zero published issue 2451 titled "Windows: System Drive Replacement During Impersonation EoP" in its bug tracker. The provided reference does not include further technical details or remediation information.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
project-zero.issues.chromium.org
Open sourcebugs.chromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a series of **Windows elevation-of-privilege** vulnerabilities affecting the **Windows Kernel**, **File Explorer**, **Windows Management Service**, **Windows UI XAML Phone DatePickerFlyout**, **Windows Graphics Component**, **Windows Storage**, and the **DirectX Graphics Kernel**. The referenced flaws include `CVE-2026-26132`, `CVE-2025-62565`, `CVE-2025-54103`, `CVE-2025-54111`, `CVE-2025-55693`, `CVE-2024-38249`, `CVE-2025-62573`, `CVE-2024-38248`, and `CVE-2025-55678`. The disclosures indicate a broad patching effort spanning core operating system subsystems and user-facing Windows components, with repeated exposure in privileged areas such as the kernel and graphics stack. For defenders, the concentration of elevation-of-privilege issues across these components raises the risk that attackers could chain local access or code execution with privilege escalation to gain **SYSTEM-level** or otherwise expanded rights on affected Windows systems, making prompt validation and deployment of Microsoft updates a priority.
Jun 29, 2026
Google Project Zero disclosed **CVE-2026-66804**, a Windows local privilege-escalation flaw caused by a dangling system-wide COM registration for the `CrossDevice` class. The registration referenced a missing DLL in a user-writable `ProgramData` location, allowing a local attacker to place a malicious DLL where it could be loaded by a privileged process. Exploitation uses custom COM marshaling to make a SYSTEM-level Shell Create Object Handler COM server unmarshal the dangling CLSID and load the attacker-controlled DLL, potentially granting SYSTEM-level execution. The vulnerability was an incomplete remediation of **CVE-2026-50343** (Dark Elevator); Microsoft has issued a fix, and Project Zero reported that a working exploit was supplied with the original report.
Sep 22, 2026
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 12, 2026