CVE‑2026‑43443: Immediate Action Required

Microsoft Security Response Center (MSRC) has issued a critical update for CVE‑2026‑43443. The flaw resides in the Windows 10 kernel, enabling remote code execution with SYSTEM privileges.

Impact

• Affected Products: Windows 10 Home, Pro, Enterprise, Education, and IoT Core, versions 1909 through 22H2.
• Severity: CVSS v3.1 base score 9.8 (Critical). Exploit code available in public repositories.
• Potential Damage: Full system compromise, data exfiltration, lateral movement, ransomware deployment.

Technical Details

The vulnerability arises from improper validation of the NtCreateFile system call when processing specially crafted file names. An attacker can send a crafted packet to a vulnerable machine, causing the kernel to load a malicious DLL with SYSTEM privileges.

The flaw is triggered by:

1. An attacker-controlled network packet containing a malformed Unicode string.
2. The Windows kernel's path normalization routine fails to detect the overlong sequence.
3. The kernel loads the payload DLL from a temporary directory.
4. The DLL executes arbitrary code with SYSTEM rights.

This bypasses User Account Control (UAC) and all standard privilege checks.

Mitigation Steps

1. Apply the Security Update: Download and install the latest cumulative update from the Microsoft Update Catalog. Ensure the update package KBxxxxxxx is installed.
2. Verify Installation: Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to confirm system integrity.
3. Block Exploit Traffic: If immediate patching is not possible, block inbound traffic on TCP/UDP ports 445 and 139 to prevent SMB-based exploitation.
4. Enable Exploit Protection: Turn on Windows Defender Exploit Guard and set the Attack Surface Reduction rule Block executable files from running unless they are signed and trusted.
5. Monitor for Indicators: Watch for unusual registry changes in HKLM\SYSTEM\CurrentControlSet\Services and abnormal process creation events in the Security log.

Timeline

• 2026‑04‑10: CVE‑2026‑43443 disclosed by MSRC.
• 2026‑04‑12: Public advisory released.
• 2026‑04‑15: Cumulative update published.
• 2026‑04‑20: Exploit code publicly available.
• 2026‑04‑25: Microsoft recommends immediate patching.

Further Resources

• Microsoft Security Update Guide – CVE‑2026‑43443
• KBxxxxxxx – Windows 10 Security Update
• Windows Defender Exploit Guard Documentation

Conclusion

Apply the patch without delay. Failure to do so exposes your environment to a high‑impact, remotely exploitable flaw that grants attackers full control over your systems.