CVE-2026-85850
7.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-763
Impact
Local authenticated users can gain SYSTEM-level execution on the machine. They require prior local code execution with basic user privileges.
Root cause
The Windows Kernel improperly releases an invalid pointer or reference during memory management.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for your Windows version once released. No interim workaround or configuration change is currently documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.