Loading vulnerability…
Local Privilege Escalation in Windows Secure Kernel Mode
CVE-2026-85921 is a double-free vulnerability in Windows Secure Kernel Mode affecting Windows 11 version 26H1 on ARM64 and x64 systems. An authorized local attacker with high privileges can exploit the flaw to elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires no user interaction and can have high impacts on confidentiality, integrity, and availability. The specific vulnerable function and triggering input are not publicly detailed in the available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crosses a security boundary to obtain VTL1 privileges, potentially compromising the confidentiality and integrity of protected data and the availability of the affected system. The CVSS v3.1 vector is AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, with a score of 8.2.
If you can’t patch tonight, do this now.
No separate workaround is specified. Apply the applicable Microsoft security update.
Patch, then assume compromise.
Apply Microsoft security update KB5129194 to affected Windows 11 version 26H1 ARM64 and x64 systems, updating them to OS build 10.0.28000.2956, or install a later cumulative update containing the fix. The update is available through Windows Update, Microsoft Update Catalog, and managed enterprise update channels.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.