Improper Release in Windows win32kfull Driver (CVE‑2026‑24285) Enables Local Privilege Escalation
What It Is — A local privilege escalation (LPE) flaw in the Windows win32kfull driver caused by improper reference‑count handling. Successful exploitation grants attackers SYSTEM‑level code execution on the compromised host.
Exploitability — The attacker must first run low‑privileged code on the target. No public exploit or malware‑as‑a‑service observed, but the vulnerability carries a CVSS 7.8 (High) score and a vendor‑issued patch is already available.
Affected Products — Microsoft Windows operating systems (all supported editions that include the win32kfull driver).
TPRM Impact — Suppliers and service providers that rely on Windows for endpoint or server workloads may face unauthorized system control, potentially compromising downstream customers’ data, integrity of services, and overall supply‑chain security.
Recommended Actions — Deploy Microsoft’s security update for CVE‑2026‑24285 immediately, verify patch compliance across all Windows assets, enforce least‑privilege execution policies, and monitor for anomalous SYSTEM‑level activity. Source: Zero Day Initiative Advisory