Local Privilege Escalation in Windows win32kfull Driver (CVE-2026-24285) Risks Enterprise Systems

Local Privilege Escalation in Windows win32kfull Driver (CVE‑2026‑24285) Threatens Enterprise Endpoints

What It Is – A newly disclosed vulnerability (CVE‑2026‑24285) in the Windows win32kfull.sys driver permits a local attacker to manipulate an internal reference‑count, leading to privilege escalation from a low‑privileged account to SYSTEM.

Exploitability – The flaw is rated CVSS 7.8 (High) with a Low attack vector, High complexity, and No user interaction required. No public exploit code has been released, but the vulnerability is fully disclosed and a patch is available from Microsoft.

Affected Products – All supported versions of Microsoft Windows that include the win32kfull.sys driver (e.g., Windows 10, Windows Server 2019/2022).

TPRM Impact –

• Third‑party software that runs on Windows hosts (e.g., ERP, CRM, and SaaS agents) can be compromised if the underlying OS is not patched, creating a supply‑chain foothold.
• Attackers gaining SYSTEM rights can exfiltrate data from downstream services, inject malicious code into trusted applications, and pivot to other network segments.

Recommended Actions –

1. Deploy Microsoft’s security update for CVE‑2026‑24285 immediately across all Windows endpoints.
2. Verify patch compliance with automated inventory tools; prioritize high‑value assets and critical infrastructure.
3. Enforce least‑privilege policies and restrict execution of untrusted code on workstations.
4. Monitor Windows Event Logs for abnormal win32kfull.sys activity and use EDR alerts for privilege‑escalation patterns.
5. Review third‑party vendor contracts to confirm they have applied the patch on any managed Windows environments.

Source: Zero Day Initiative Advisory – ZDI‑26‑182