CVE‑2026‑46114: Remote Code Execution in Microsoft Loading

Impact

A flaw in Microsoft’s loading subsystem permits attackers to execute arbitrary code with SYSTEM privileges. The vulnerability can be triggered by a crafted file processed during system startup or by a malicious installer. Exploitation could lead to full system compromise.

Affected Products

• Windows 11: Versions 22H2 and earlier.
• Windows Server 2022: All released builds.
• Windows 10: Versions 21H2 and earlier.

CVSS Score

• Base Score: 9.8 (Critical)
• Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Technical Details

The vulnerability resides in the LoadLibraryExW routine, which fails to validate the Unicode string length of the module name. An attacker can supply a string containing a sequence of null characters that bypasses the length check, causing the loader to interpret the following bytes as executable code. The loader then executes this code with elevated privileges, granting the attacker full control over the system.

Exploit Flow

1. Crafted DLL: The attacker creates a DLL with a malicious payload and embeds it in a file that the loader will process.
2. Trigger: The file is placed in a directory monitored by the loader during boot or by a privileged process.
3. Execution: The loader misinterprets the null‑terminated string, loads the DLL, and runs the payload.
4. Privilege Escalation: The payload runs with SYSTEM rights, enabling any subsequent malicious activity.

Mitigation Steps

1. Apply the Security Update:
   • Download the latest cumulative update from the Microsoft Update Catalog.
   • Install the update on all affected Windows 11 and Windows Server 2022 machines.
2. Disable Unnecessary Services:
   • Temporarily stop services that load third‑party DLLs during startup.
3. Restrict Write Access:
   • Ensure that only administrators can write to the system directories used by the loader.
4. Enable Code Integrity:
   • Configure Windows Defender Exploit Guard to enforce mandatory code integrity policies.
5. Monitor for Indicators:
   • Watch for unusual DLL loads in the event logs (Event ID 4688).

Timeline

• Discovery: 2026‑04‑15
• MSRC Advisory Published: 2026‑04‑20
• Update Release: 2026‑04‑25
• Patch Deadline: 2026‑05‑15 (recommended to apply immediately)

Further Resources

• Microsoft Security Advisory – CVE‑2026‑46114
• Windows Security Documentation – LoadLibraryExW
• Microsoft Defender Exploit Guard Configuration

Act now. Apply the update, enforce strict directory permissions, and monitor for suspicious DLL activity. Failure to patch exposes systems to immediate compromise.