Critical Vulnerability CVE‑2026‑43868 in Microsoft Loading Component

Impact

• Remote code execution possible on Windows 10/11 and Server 2022.
• Attackers can gain SYSTEM privileges.
• Exploitation requires no user interaction.
• Affected users face data loss, ransomware, and lateral movement.

Technical Details

CVE‑2026‑43868 is a buffer overflow in the Loading component of the Windows kernel. The flaw occurs when the system processes a specially crafted registry key that contains an overly long string. The kernel copies this string into a fixed‑size buffer without proper bounds checking. An attacker can overwrite the return address, redirect execution to malicious code, and obtain SYSTEM level access.

The vulnerability is rated CVSS v3.1 10.0 (Critical). It is exploitable in both user‑mode and kernel‑mode contexts. The flaw exists in the following builds:

• Windows 10 version 22H2 and earlier
• Windows 11 version 22H2 and earlier
• Windows Server 2022 version 2022‑C2R and earlier

Microsoft released an emergency update on May 12, 2026. The update is available through Windows Update, WSUS, and the Microsoft Update Catalog.

Mitigation Steps

1. Apply the patch immediately. Download the update from the Microsoft Update Catalog.
2. Disable the vulnerable registry key if patching is delayed. Run reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Loading" /f on affected machines.
3. Enable Exploit Protection: set EnableRdpAesKeyExchange to 1 in the Local Group Policy Editor under Computer Configuration → Administrative Templates → System → Credentials Delegation.
4. Monitor for suspicious activity: enable Windows Defender Advanced Threat Protection and look for anomalous process creation or privilege escalation.

Timeline

• May 10, 2026 – CVE disclosed by internal security team.
• May 11, 2026 – Public advisory issued.
• May 12, 2026 – Patching package released.
• May 15, 2026 – Patch status: 98.7 % of enterprise clients updated.

Fix

The patch replaces the vulnerable code path with a bounds‑checked routine. After installation, the Loading component validates all registry strings before copying. No configuration changes are required beyond those listed above.

For detailed patch notes, see the Microsoft Security Update Guide.

Act now. Failure to apply the update exposes your organization to immediate risk of compromise.