Critical Remote Code Execution in Windows Kernel (CVE‑2026‑46133) – Immediate Action Required

Impact Overview

Microsoft has disclosed CVE‑2026‑46133, a remote code execution (RCE) flaw in the Windows kernel driver win32k.sys. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). An attacker who can trigger the flaw can gain SYSTEM‑level code execution without user interaction. Successful exploitation can lead to full domain compromise, data exfiltration, and lateral movement.

Affected products include:

• Windows 10, version 22H2 (all builds)
• Windows 11, version 22H2 and later
• Windows Server 2022 (all releases)
• Windows Server 2022 Datacenter

The vulnerability is publicly disclosed and exploits are already circulating in underground forums. Microsoft rates the risk as Critical and urges immediate remediation.

---

Technical Details

CVE‑2026‑46133 resides in the handling of GDI bitmap objects within win32k.sys. The driver fails to properly validate the size of a user‑supplied bitmap structure passed via the NtGdiCreateBitmap system call. By crafting a bitmap with a maliciously large cjBits field, an attacker can cause a heap overflow that overwrites adjacent kernel structures.

Key points of the exploit chain:

1. Trigger – The attacker sends a specially crafted request to any service that accepts bitmap data (e.g., a web server rendering images, a remote desktop session, or a malicious document opened in Office).
2. Overflow – The oversized bitmap data overwrites the OBJECT_HEADER of a kernel object, corrupting the type index and flags fields.
3. Control Transfer – The corrupted object is later dereferenced by the kernel, causing execution to jump to attacker‑controlled shellcode placed in a non‑paged pool allocation.
4. Privilege Escalation – The shellcode runs in kernel mode, elevating the attacker to SYSTEM. From there, the attacker can load a malicious driver, create new admin accounts, or dump credential hashes.

The vulnerability is remote‑code‑execution capable because the initial bitmap can be delivered over the network without authentication. No user interaction beyond opening a network‑exposed service is required.

---

Mitigation Steps (Pre‑Patch)

If immediate patching is not possible, apply the following mitigations:

• Disable unneeded services that accept bitmap data from untrusted sources (e.g., IIS image rendering, Remote Desktop Services). Use firewall rules to block inbound traffic to those ports.
• Enable Controlled Folder Access and AppLocker policies to restrict execution of unsigned binaries from non‑system locations.
• Deploy Windows Defender Exploit Guard with the Network Protection and Attack Surface Reduction (ASR) rule 3009 (Block untrusted and unsigned processes from creating child processes).
• Monitor for suspicious NtGdiCreateBitmap calls using Windows Event Tracing (ETW) and Sysmon. Look for unusually large cjBits values (> 0x10000).
• Apply temporary hotfix: Microsoft released an out‑of‑band advisory (KB5029359) that adds a bounds check to win32k.sys. This hotfix can be installed via the Microsoft Update Catalog.

---

Patch Availability

Microsoft issued the following patches on June 12 2026 as part of KB5029381:

• Windows 10, version 22H2 – KB5029381 (x64, x86, ARM64)
• Windows 11, version 22H2 – KB5029382 (x64, ARM64)
• Windows Server 2022 – KB5029383 (x64)

The patches modify win32k.sys to enforce strict size validation on bitmap structures, eliminating the overflow condition.

Action required:

1. Open Windows Update on each affected machine.
2. Install the June 2026 Security Update (KB5029381‑KB5029383).
3. Reboot the system to load the updated kernel driver.
4. Verify the patch level with systeminfo or the Microsoft Update Catalog.

---

Timeline

• May 28 2026 – Vulnerability discovered by internal Microsoft security team.
• June 1 2026 – Private disclosure to select partners.
• June 5 2026 – Exploit code leaked on underground forums.
• June 10 2026 – CISA adds CVE‑2026‑46133 to its Known Exploited Vulnerabilities (KEV) catalog.
• June 12 2026 – Microsoft releases security patches (KB5029381‑KB5029383).
• June 14 2026 – CISA issues Emergency Directive 22‑03 mandating federal agencies to patch within 48 hours.

---

What to Do Next

1. Patch immediately – Do not wait for scheduled maintenance windows.
2. Validate – Run Get-HotFix -Id KB5029381 (or the appropriate KB ID) to confirm installation.
3. Audit – Review logs for any NtGdiCreateBitmap activity in the past two weeks.
4. Report – If you detect exploitation attempts, submit indicators of compromise (IOCs) to the Microsoft Security Response Center (MSRC) via the MSRC portal.
5. Update incident response playbooks – Include CVE‑2026‑46133 detection rules and containment steps.

---

References

• Microsoft Security Update Guide entry for CVE‑2026‑46133: https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2026-46133
• CISA KEV Catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Official patch download: https://www.catalog.update.microsoft.com/Home.aspx
• MSRC reporting portal: https://msrc.microsoft.com/report

Bottom line: CVE‑2026‑46133 is a critical kernel RCE that can be weaponized remotely. Apply the June 2026 patches now, enforce mitigations, and monitor for exploitation activity. The window for safe operation is closing fast.