Use‑After‑Free in Microsoft Windows NDIS Driver (CVE‑2026‑24289) Enables Local Privilege Escalation

Use‑After‑Free in Microsoft Windows NDIS Driver (CVE‑2026‑24289) Enables Local Privilege Escalation

What It Is – A use‑after‑free flaw in the ndis.sys network driver allows a low‑privileged attacker to execute arbitrary code in kernel mode, effectively granting full system control. The vulnerability is tracked as CVE‑2026‑24289 and carries a CVSS 7.8 (High) score.

Exploitability – Exploitation requires the attacker to first run code with limited privileges on the target machine. No public exploit has been released, but the vulnerability is fully disclosed and a Microsoft patch is available.

Affected Products – Microsoft Windows operating systems that include the vulnerable ndis.sys driver (all supported Windows 10, Windows Server 2019/2022 releases).

TPRM Impact – Any third‑party that relies on Windows‑based endpoints, servers, or managed services inherits the risk of a local privilege escalation that could be leveraged to compromise internal networks, exfiltrate data, or pivot to other vendors in the supply chain.

Recommended Actions –

1. Deploy Microsoft’s security update for CVE‑2026‑24289 immediately across all Windows assets.
2. Verify patch compliance with automated inventory tools and endpoint detection platforms.
3. Enforce least‑privilege policies; restrict execution of untrusted code and limit user rights where possible.
4. Monitor for anomalous kernel‑mode activity and privilege‑escalation alerts.
5. Review third‑party service contracts to ensure vendors have applied the patch on any Windows systems they manage.

Source: Zero Day Initiative Advisory – ZDI‑26‑184