Loading vulnerability…
Windows Win32K GRFX Use-After-Free Privilege Escalation
CVE-2026-34347 is a local elevation-of-privilege vulnerability in the Windows Win32K GRFX kernel graphics component. The flaw is a use-after-free condition in which a kernel-mode graphics object continues to be referenced after its backing memory has been freed, creating a dangling pointer. Under successful exploitation, this stale reference can be leveraged to corrupt kernel memory. The vulnerability is exploitable by an authenticated local attacker with low privileges and does not require user interaction. Microsoft assessed exploitation as less likely because reliable exploitation requires winning a race condition. Successful exploitation can result in escalation from a standard user context to SYSTEM.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged local attacker to obtain SYSTEM privileges. Because the flaw enables arbitrary kernel memory corruption in the Win32K graphics subsystem, compromise can result in full control of the affected host, including high-impact effects on confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
No vendor workaround is documented. Risk reduction therefore depends on prompt deployment of the official Microsoft fixes. Until patching is completed, limiting local access, minimizing the number of low-privileged interactive users, and monitoring for suspicious local privilege-escalation activity may reduce exposure, but these measures do not remediate the underlying flaw.
Patch, then assume compromise.
Apply the official Microsoft security updates released on 2026-05-12 for affected Windows client and server platforms. Microsoft indicates the vulnerability is fixed through its standard security update channels, including cumulative updates and hotpatches for some supported platforms. The fix corrects object lifetime management in Win32K GRFX to prevent stale references after memory is freed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.