Loading vulnerability…
Use-After-Free Elevation of Privilege in Windows Kernel Mode Driver
CVE-2026-58602 is a use-after-free vulnerability in the Windows Kernel Mode Driver. The flaw allows an authorized attacker to trigger memory corruption in kernel context after a previously freed object is reused, resulting in a local elevation of privilege condition. The issue affects the Windows kernel-mode driver attack surface and is classified as an Important elevation of privilege vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local authorized attacker to elevate privileges on the affected Windows system. Because the flaw is in a kernel-mode driver, exploitation can enable execution with elevated or system-level privileges, undermining operating system security boundaries and enabling full compromise of the local host.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting local access to trusted users only, minimizing the ability for untrusted users or code to execute on affected systems, and enforcing least-privilege controls to restrict opportunities for post-compromise privilege escalation. Prioritize patching on systems where local user access, application execution, or multi-user workloads increase the likelihood of exploitation.
Patch, then assume compromise.
Apply the vendor-provided July 2026 security update from Microsoft for the affected Windows Kernel Mode Driver vulnerability. Administrators should deploy the relevant Windows security updates through their normal patch management process, including Windows Update, WSUS, or equivalent enterprise update tooling, and verify installation across affected client and server systems.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.