local privilege escalation

On May 17, 2026, a researcher using the handles Chaotic Eclipse and Nightmare-Eclipse released MiniPlasma, a public Windows proof-of-concept exploit that reportedly grants SYSTEM privileges on fully patched Windows 11 machines by abusing a Cloud Filter driver flaw Microsoft had associated with...

CVE-2026-43494 is a newly published Linux kernel vulnerability, disclosed through NVD on May 21, 2026, in the Reliable Datagram Sockets networking code, where a failed zero-copy page-pin operation can leave stale accounting state and trigger a later double free. The bug is narrow in the way only...

Microsoft’s May 12, 2026 Windows 11 security update KB5089549 is now under scrutiny after a public proof-of-concept called MiniPlasma claimed to revive CVE-2020-17103, a Windows Cloud Files Mini Filter Driver privilege-escalation flaw first addressed in December 2020. The uncomfortable part is...

Microsoft disclosed CVE-2026-34341 on May 12, 2026, as an Important Windows Link-Layer Discovery Protocol elevation-of-privilege flaw in which a low-privileged local attacker could exploit a double-free condition, win a race condition, and gain SYSTEM privileges on affected Windows clients and...

Microsoft disclosed CVE-2026-41088 on May 12, 2026, as an Important-rated Windows Ancillary Function Driver for WinSock elevation-of-privilege vulnerability that allows a locally authorized attacker to gain SYSTEM privileges after exploiting external control of a file name or path. That dry...

Microsoft disclosed CVE-2026-40419 on May 12, 2026, as an Important-rated Microsoft Office Click-To-Run elevation-of-privilege vulnerability that stems from a use-after-free flaw and can allow a locally authorized attacker to gain SYSTEM privileges after applying a successful exploit. The...

Microsoft published CVE-2026-40410 on May 12, 2026, identifying it as an Important-rated Windows SMB Client elevation-of-privilege flaw caused by use-after-free behavior, with an official fix available across supported Windows client and server releases and no public disclosure or exploitation...

Microsoft disclosed CVE-2026-40407 on May 12, 2026 as an Important Windows Common Log File System Driver elevation-of-privilege vulnerability, caused by a heap-based buffer overflow and affecting supported Windows client and server releases with updates available through the May Patch Tuesday...

Microsoft published CVE-2026-40399 on May 12, 2026, as an Important-rated Windows TCP/IP elevation-of-privilege vulnerability caused by a stack-based buffer overflow that lets a locally authorized attacker gain SYSTEM privileges after applying pressure to the vulnerable component. The phrase...

Microsoft published CVE-2026-34351 on May 12, 2026, describing an Important-rated Windows TCP/IP elevation-of-privilege flaw caused by a race condition that can let an authenticated local attacker gain SYSTEM privileges after applying the right exploit path. The vulnerability is not described as...

Microsoft disclosed CVE-2026-34345 on May 12, 2026, as an Important Windows Ancillary Function Driver for WinSock elevation-of-privilege flaw that lets a low-privileged local attacker potentially win a race condition and gain SYSTEM privileges across supported Windows client and server releases...

Microsoft disclosed CVE-2026-34330 on May 12, 2026, as an Important-rated Windows Win32k elevation-of-privilege flaw in the GRFX component that can let a locally authenticated attacker gain SYSTEM privileges after exploiting an integer overflow or wraparound weakness. The advisory is not...

Microsoft published CVE-2026-33841 on May 12, 2026, as an Important Windows Kernel elevation-of-privilege vulnerability caused by a heap-based buffer overflow that lets an authorized local attacker raise privileges on affected Windows client and server systems. The bug is not described as...

Microsoft disclosed CVE-2026-33840 on May 12, 2026 as an Important Win32k elevation-of-privilege flaw in Windows 11 and Windows Server 2025 that lets a locally authorized attacker exploit a use-after-free bug and gain SYSTEM privileges. The uncomfortable part is not the label “Important,” which...

CVE-2026-43500 is a high-severity Linux kernel vulnerability disclosed in May 2026 in the rxrpc networking subsystem, where certain fragmented socket buffers can reach in-place decryption paths without being copied away from externally owned memory, creating a local privilege-escalation risk on...

CVE-2026-43321 is a newly published Linux kernel vulnerability in the BPF verifier, disclosed through kernel.org and surfaced in Microsoft’s Security Update Guide on May 8, 2026, with a high CVSS 3.1 score of 7.8 and local, low-complexity exploitation characteristics. The bug is small in code...

Microsoft disclosed on May 8, 2026, that “Dirty Frag,” a Linux local privilege escalation vulnerability chain involving esp4, esp6, and rxrpc kernel components, is being investigated in limited active attacks that can turn low-privileged local execution into root control. The unpleasant part is...

CVE-2026-7997 is a Google Chrome for macOS vulnerability, published May 6, 2026, in which insufficient input validation in Chrome’s Updater before version 148.0.7778.96 could let a local attacker escalate privileges through a malicious file. The uncomfortable part is not that Chrome had another...

CISA added CVE-2026-31431, a Linux kernel local privilege escalation flaw known as “Copy Fail,” to its Known Exploited Vulnerabilities Catalog on May 1, 2026, after evidence of active exploitation, triggering mandatory remediation for U.S. federal civilian agencies under BOD 22-01. The move...

Windows Defender has become the center of a serious local privilege escalation story, and the uncomfortable twist is that the trusted security product is the one doing the dangerous write. According to CloudSEK’s RedSun research, a standard user can race Defender’s remediation workflow and trick...