CVE-2026-65775: Microsoft Patches win32kfull UAF Discovered at Pwn2Own

Microsoft released a fix on 2026-08-11 for CVE-2026-65775, a Use-After-Free vulnerability in the Windows win32kfull driver discovered by Kentaro Kawane of GMO Cybersecurity by Ierae during the Pwn2Own competition. The flaw allows local privilege escalation to SYSTEM with a CVSS 3.1 score of 8.8, and Microsoft assessed exploitability as "More Likely" despite the absence of a documented public exploit at the time of coordinated disclosure.

The Technical Mechanism: UAF in the win32kfull Kernel Graphics Driver

The flaw resides specifically in the win32kfull driver, a component of the Win32 subsystem that handles graphics primitives and user session interaction in kernel mode. According to advisory ZDI-26-541, "The specific flaw exists within the win32kfull driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object." The missing pointer validity check allows operations on an already deallocated object, corrupting the kernel heap memory state.

The vulnerability is classified as Use-After-Free: a process running with standard user privileges manipulates the allocation and deallocation sequence of graphics objects, forcing a reference to already-freed memory. Through controlled reuse of that block, the attacker achieves arbitrary write in kernel space and, consequently, code execution in the SYSTEM context. The chain is purely local: it requires no user interaction (UI:N) but assumes prior compromise of the user process, typically via malware or unauthorized code execution.

Severity Score and Microsoft's Exploitability Assessment

Microsoft MSRC publishes the full CVSS 3.1 vector for CVE-2026-65775: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The base score of 8.8 places the vulnerability in the High band. The impact metrics C:H/I:H/A:H indicate total exposure of confidentiality, integrity, and availability post-exploitation. The attack vector is strictly local (AV:L), with low initial privileges (PR:L) and no user interaction required (UI:N): a profile that makes the flaw particularly dangerous in an already-compromised scenario.

"Exploitation More Likely" — Microsoft MSRC, exploitability assessment for CVE-2026-65775

The E:U flag (Exploit Code: Unproven) indicates Microsoft had no documented public exploit at the time of the advisory. However, the vendor judges the likelihood of exploitation as "More Likely." This assessment, combined with the Pwn2Own origin of the discovery — where the vulnerability was demonstrated working in a controlled environment — signals that the technical barrier to a functional exploit is relatively low for skilled operators.

The Pwn2Own-to-Patch Chain: 82 Days of Coordination

Kentaro Kawane reported the vulnerability to Microsoft on 2026-05-21. Coordinated disclosure occurred on 2026-08-11, 82 days later. The timeline aligns with standard responsible disclosure practices managed by Trend Micro's Zero Day Initiative: the researcher delivers the proof-of-concept, the vendor develops and tests the fix, and synchronized publication occurs with the patch release.

The Pwn2Own context is not merely anecdotal. The competition imposes strict exploitability constraints: the flaw must work against up-to-date targets under realistic conditions without user interaction. The fact that CVE-2026-65775 was selected and demonstrated in that arena confirms the practical reproducibility of the exploit chain, unlike theoretical vulnerabilities or unrealistically tight race windows.

What to Do Now

• Apply the security update released by Microsoft on 2026-08-11 for CVE-2026-65775: RL:O (Remediation Level: Official Fix) confirms an authoritative patch is available.
• Verify patching status on Windows workstations and servers exposed to user-code execution risk: the AV:L/PR:L/UI:N combination makes the flaw exploitable in an initial compromise scenario with minimal footprint.
• Assess patching priority in light of Microsoft's "More Likely" exploitability assessment, which overrides the caution implied by E:U alone.
• Check for unauthorized processes or user accounts on Windows systems: the vulnerability requires a precondition of low-privileged code execution, so containing initial access reduces the exploitation surface.

The Real Risk for Enterprises

The operational reading is unambiguous: CVE-2026-65775 is not an initial access vector, but a compromise amplifier. An attacker who has already breached the perimeter — via phishing, malware delivery, supply chain compromise, or weak user account — can escalate privileges to full system control. Escalation to SYSTEM enables EDR bypass, rootkit installation, kernel-level persistence, and exfiltration without user-level traces.

The combination of CVSS 8.8, "More Likely" exploitability, and Pwn2Own provenance makes this vulnerability a natural candidate for inclusion in post-exploitation toolkits. Organizations with extended patching cycles or exceptions for critical systems must treat this fix as high priority, not standard.

Frequently Asked Questions

Can this vulnerability be exploited remotely?

No. The attack vector is local (AV:L) per the Microsoft CVSS vector. The attacker must already execute code on the target system.

Is a public exploit available?

As of the coordinated disclosure on 2026-08-11, Microsoft assigns E:U (Unproven) to exploit code. No evidence of in-the-wild exploitation emerges from verified sources.

Which Windows versions are affected?

The brief does not specify exact versions. Microsoft MSRC lists CVE-2026-65775 with a fix available; details on affected builds require consulting the Microsoft Update Guide directly.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-541/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-65775
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65775
• https://www.trendmicro.com/

Information verified against cited sources and current as of publication.

Sources