windows kernel

Microsoft’s advisory identifies CVE-2026-20809 as a time-of-check/time-of-use (TOCTOU) race condition in Windows kernel memory that can be abused by an authorized local user to gain SYSTEM privileges — in short, a local elevation-of-privilege (EoP) vulnerability rooted in kernel memory...

Microsoft’s own engineers have announced an audacious, company-wide plan: use AI and large-scale automated tooling to translate Microsoft’s C and C++ codebases to Rust — with an explicit target of eliminating “every line of C and C++ from Microsoft by 2030.” Background Microsoft’s shift toward...

CISA’s decision to add three fresh entries to its Known Exploited Vulnerabilities (KEV) Catalog marks another urgent reminder that attackers are continuing to weaponize both edge devices and enterprise software against unpatched targets — and that federal agencies and private organizations alike...

Microsoft confirmed a Windows kernel elevation‑of‑privilege vulnerability tracked as CVE‑2025‑59194, describing it as a use of uninitialized resource in kernel code that an authorized local attacker can exploit to gain elevated privileges; Microsoft published the advisory and security update...

Microsoft’s October security rollup includes a newly cataloged Windows Kernel elevation‑of‑privilege tracked as CVE‑2025‑59187, a confirmed local flaw that Microsoft classifies as improper input validation and that carries a CVSS v3.1 base score of 7.8 (High) — administrators should treat this...

Microsoft has recorded CVE-2025-55699 as a Windows Kernel information‑disclosure vulnerability and published a security update on October 14, 2025 that Microsoft says fixes an issue where an authorized local actor can disclose sensitive kernel memory under certain conditions — administrators...

Microsoft has published an advisory and a security update for CVE-2025-55679, a Windows Kernel information‑disclosure vulnerability that permits a local actor to obtain sensitive system memory under certain conditions — and administrators should treat it as a high-priority remediation for...

Microsoft has published a terse but important advisory for CVE-2025-55334 — a Windows kernel vulnerability that Microsoft classifies as a Security Feature Bypass caused by cleartext storage of sensitive information in the Windows kernel, and which the community currently rates at CVSS 3.1 base...

Note: below is a long-form, technically focused feature article about CVE-2025-53804. I drew on Microsoft’s official entry for this CVE and on Microsoft documentation and guidance about kernel-mode drivers and driver blocklists to explain the risk, likely exploitation paths, detection and...

Microsoft’s advisory identifies CVE-2025-53803 as a Windows Kernel memory information disclosure vulnerability: an error message generated by kernel code can contain sensitive kernel memory contents, allowing an authenticated local actor to read data that should remain protected. Background The...

Microsoft has published an advisory for CVE-2025-54110, a Windows Kernel vulnerability caused by an integer overflow or wraparound that can be triggered by a locally authorized attacker to achieve elevation of privilege to SYSTEM on affected machines; administrators should treat this as a...

Microsoft's effort to let device-driver developers use Rust has moved from research and experiments into tangible tooling and samples, but the path to production-ready Windows drivers written in Rust remains long and cautious — working prototypes and Microsoft-backed crates exist, CodeQL now...

Microsoft’s Security Update Guide entry for CVE-2025-53718 describes a use‑after‑free (UAF) flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys) that can be triggered by a locally authorized user to obtain elevated privileges on affected Windows hosts — a kernel‑level...

Microsoft’s Security Response Guide flags a null-pointer dereference in the Windows Ancillary Function Driver for WinSock (AFD.sys) that, when reached by a local, authorized user, can be weaponized into an elevation‑of‑privilege to SYSTEM — a high‑impact kernel vulnerability that demands...

Microsoft’s Security Update Guide lists CVE‑2025‑53151 as a use‑after‑free vulnerability in the Windows kernel that can be abused by an authorized local user to elevate privileges on an affected system, and Microsoft’s published advisory directs administrators to install the supplied security...

Microsoft’s Security Response Center has published an advisory for CVE‑2025‑53140, a use‑after‑free vulnerability in the Windows Kernel Transaction Manager (KTM) that Microsoft says can be exploited by an authorized local attacker to elevate privileges on an affected system. Background /...

Microsoft's Security Update Guide lists CVE-2025-53136 as a Windows NT OS Kernel information disclosure vulnerability that can allow an authorized local attacker to read sensitive kernel-resident data after certain processor optimizations remove or modify security‑critical code paths. The...

Microsoft has assigned CVE-2025-50168 to a Windows kernel vulnerability in the Win32K ICOMP component described as "Access of resource using incompatible type ('type confusion')" that can allow an authorized local user to elevate privileges; Microsoft’s advisory is published in the Security...

A use‑after‑free bug in the Windows kernel has been reported under the identifier CVE‑2025‑49761 and is described by Microsoft as an elevation‑of‑privilege vulnerability that can allow a local, authorized attacker to gain SYSTEM privileges; administrators should treat the advisory as urgent and...

For months, a lingering roadblock stood between countless gamers and the latest innovations in Windows 11, sparking worry corners of the PC community haven’t seen since the days of Windows driver woes past. Microsoft’s decision to pause the Windows 11 24H2 update roll-out for a specific set of...