Critical Use‑After‑Free in Windows win32kfull Driver (CVE‑2026‑65775) Enables Local Privilege Escalation
What It Is — A use‑after‑free flaw in the win32kfull.sys driver allows a low‑privileged process to execute arbitrary code as SYSTEM. The vulnerability stems from the driver not validating an object’s existence before operating on it.
Exploitability — Publicly disclosed via the Pwn2Own competition; proof‑of‑concept demonstrated. No known wild‑type exploits yet, but the CVSS 8.8 rating (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates high ease of exploitation once code execution is achieved locally.
Affected Products — Microsoft Windows (all supported versions that include the vulnerable win32kfull.sys driver).
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Controls – The flaw bypasses OS‑level isolation, highlighting the need for strict least‑privilege policies and continuous verification that privileged accounts are protected.
- Patch Management Evidence – Demonstrates the importance of timely patch deployment and retaining verifiable records of remediation to satisfy the Security and Availability criteria of SOC 2.
- Continuous Monitoring – Real‑time detection of unpatched endpoints becomes a critical control to prove due diligence during audits.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2026‑65775 immediately across all Windows endpoints.
- Verify patch rollout via automated inventory tools and retain logs as audit evidence.
- Review and tighten local admin privileges; enforce “least‑privilege” configurations on workstations.
- Incorporate the patch status into your continuous compliance dashboard to demonstrate ongoing control effectiveness.