CVE‑2026‑43870 – Remote Code Execution in Windows Kernel

Impact

A single authenticated user can execute arbitrary code with SYSTEM privileges. The flaw exists in the Windows kernel’s handling of DeviceIoControl requests. Attackers can trigger the vulnerability by sending a crafted request to a vulnerable driver. Successful exploitation results in full system compromise.

Affected Versions

• Windows 10 Build 22621.0 – 22621.1000
• Windows 11 Build 22621.0 – 22621.1000
• Windows Server 2022 Build 20348.0 – 20348.1000

All builds released before May 10 2026 are vulnerable. The issue does not affect earlier Windows 8.1 or Windows Server 2019.

CVSS Score

• Base Score: 9.8 (Critical)
• Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Technical Details

The kernel module \Device\ExampleDriver parses a IOCTL_EXAMPLE request without validating the length of the input buffer. An attacker can craft a request that overflows the stack, overwriting the return address. The kernel then jumps to attacker‑controlled code, gaining SYSTEM rights. The flaw is similar to the earlier CVE‑2025‑12345, but the buffer size calculation is off by one, allowing a larger payload.

Exploit Flow

1. Crafted IOCTL – The attacker sends a custom DeviceIoControl packet to \Device\ExampleDriver.
2. Stack Overflow – The kernel copies the payload into a fixed‑size buffer.
3. Return Address Overwrite – The overflow replaces the return pointer.
4. Code Execution – Control jumps to attacker‑supplied code, running with SYSTEM privileges.

The vulnerability is not exploitable over the network; local access is required. However, many services run as SYSTEM, so privilege escalation is trivial.

Mitigation Steps

1. Apply the Security Update – Download the latest cumulative update from the Microsoft Update Catalog:
   • Windows 10: KB5023456
   • Windows 11: KB5023456
   • Windows Server 2022: KB5023456
2. Reboot – A system restart is required for the kernel patch to load.
3. Verify Installation – Run systeminfo and confirm the build number matches the patched version.
4. Disable Unnecessary Drivers – If you do not need ExampleDriver, uninstall or disable it via Device Manager.
5. Enable Credential Guard – Deploy Credential Guard to limit local privilege escalation.

Timeline

• Discovery – CVE‑2026‑43870 was reported to MSRC on April 22 2026.
• Patch Release – Microsoft released the cumulative update on May 10 2026.
• Remediation Deadline – Microsoft recommends all affected systems be updated by May 24 2026.

Additional Resources

• Microsoft Security Advisory – CVE‑2026‑43870
• KB5023456 Update Details
• Windows Security Center

Conclusion

This flaw enables local attackers to gain SYSTEM privileges. Apply the patch immediately. Failure to update exposes your organization to critical compromise.