Loading vulnerability…
Windows Kernel Heap-Based Buffer Overflow Privilege Escalation
CVE-2026-35420 is a heap-based buffer overflow in the Windows Kernel that can be exploited by a locally authenticated attacker with low privileges to elevate privileges. The flaw affects kernel heap handling and may permit corruption of adjacent heap metadata or kernel objects. Successful exploitation can result in execution in kernel context and escalation to SYSTEM on the affected host. Microsoft rated the issue as Important and patched it in the May 2026 security updates for supported Windows client and server releases.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged local attacker to obtain SYSTEM privileges on the affected Windows system. Because the flaw is in kernel context, compromise can have high impact on confidentiality, integrity, and availability, including arbitrary code execution in kernel mode, full takeover of the local host, disabling security controls, tampering with protected resources, credential theft, persistence, and broad post-exploitation activity under the highest local privilege level.
If you can’t patch tonight, do this now.
No official workaround or compensating control was documented. Until patches are fully deployed, reduce exposure by tightly restricting local and interactive access, minimizing the number of low-privilege accounts on sensitive systems, enforcing least privilege, limiting code execution opportunities for untrusted users, and prioritizing patch deployment on multi-user and high-value systems where local access is more plausible.
Patch, then assume compromise.
Apply the official Microsoft security updates released on 2026-05-12 for all affected Windows versions. Microsoft distributed fixes through cumulative updates and, for some platforms, hotpatches via standard Microsoft update channels including Windows Update, WSUS, and the Microsoft Update Catalog. Ensure all supported affected client and server systems are updated to the fixed builds provided by Microsoft.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.