Introduction
A race condition in the Windows Win32k graphics subsystem lets any authenticated local user escalate privileges to SYSTEM, with no user interaction at all. Microsoft patched CVE-2026-33839 in its May 2026 Patch Tuesday release. The flaw is a textbook example of why kernel-mode synchronization bugs remain one of the most impactful classes of local privilege escalation vulnerabilities on Windows.
Technical Information
The vulnerability is in the Win32k GRFX subsystem, the kernel-mode component that handles graphics rendering and window management in Windows. The root cause is classified under CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization. Concurrent execution paths access a shared resource within the Win32k graphics subsystem without adequate locking or synchronization primitives. That creates a window in which an attacker can corrupt internal kernel state.
CVSS Vector Analysis
The official CVSS 3.1 vector provided by Microsoft is:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
This yields a base score of 7.0 and a temporal score of 6.1. The key metrics break down as follows:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Local | Attacker must have a session on the target machine |
| Attack Complexity | High | Exploitation requires winning a race condition |
| Privileges Required | Low | Any authenticated local user can attempt exploitation |
| User Interaction | None | No social engineering or user action is required |
| Scope | Unchanged | Impact is confined to the vulnerable system |
| Confidentiality | High | Full data access on successful exploitation |
| Integrity | High | Full system modification is possible |
| Availability | High | System stability can be completely compromised |
Exploitation Flow
Based on the advisory details, exploitation would proceed like this:
- The attacker establishes a local session on the target Windows system using any low-privilege account.
- The attacker triggers concurrent operations against the vulnerable shared resource within the Win32k GRFX subsystem.
- The attacker times these operations carefully to try to win the race condition and corrupt internal kernel state.
- After winning the race, the attacker uses the corrupted state to elevate their execution context to SYSTEM and gain full control over the machine.
The High attack complexity rating comes from the race itself. Race conditions are probabilistic by nature, so exploitation may require multiple attempts and careful timing. Still, the low privilege requirement and the absence of any user interaction make this a practical post-compromise escalation vector. Once an attacker has any foothold on a multi-user Windows system, this vulnerability becomes a viable path to full system control.
Patch Information
Microsoft released an official fix for CVE-2026-33839 on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The fix corrects the improper synchronization of a shared resource during concurrent execution within the Win32k graphics subsystem. That closes the window in which an attacker could win the race, corrupt state, and elevate privileges.
Microsoft distributed the patch across multiple cumulative updates for different Windows versions:
| Product(s) | KB Article | Patched Build |
|---|---|---|
| Windows 10 v1809 / Server 2019 | KB5087538 | 10.0.17763.8755 |
| Windows 10 v21H2 / v22H2 | KB5087544 | 10.0.19044.7291 / 10.0.19045.7291 |
| Windows 11 v23H2 | KB5087420 | 10.0.22631.7079 |
| Windows 11 v24H2 / v25H2 | KB5089549 (plus Hotpatch KB5089466) | 10.0.26100.8457 / 10.0.26200.8457 |
| Windows 11 v26H1 | KB5089548 | 10.0.28000.2113 |
| Windows Server 2022 | KB5087545 (plus Hotpatch KB5087424) | 10.0.20348.5139 |
| Windows Server 2022, 23H2 Edition | KB5087541 | 10.0.25398.2330 |
| Windows Server 2025 | KB5087539 (plus Hotpatch KB5087423) | 10.0.26100.32860 |
For newer platforms (Windows 11 24H2/25H2, Server 2022, and Server 2025), Microsoft also shipped Security Hotpatch Updates, which are the secondary KB numbers in the table above. Hotpatching applies the fix to the running kernel without a full system reboot. That is particularly useful in server environments where uptime is critical.
Because this is a closed-source kernel-mode fix within the Win32k driver, no source-level diffs or commits are publicly available. The MSRC advisory confirms the Remediation Level as "Official Fix" and marks customer action as Required across all 23 listed product entries. All updates are available through Windows Update and the Microsoft Update Catalog.
Affected Systems and Versions
Based on the patch matrix, the following Windows versions are confirmed affected:
- Windows 10 version 1809
- Windows 10 version 21H2
- Windows 10 version 22H2
- Windows 11 version 23H2
- Windows 11 version 24H2
- Windows 11 version 25H2
- Windows 11 version 26H1
- Windows Server 2019
- Windows Server 2022
- Windows Server 2022, 23H2 Edition
- Windows Server 2025
All builds before the patched build numbers in the Patch Information section are vulnerable. The MSRC advisory lists 23 distinct product entries that require the update.
Vendor Security History
Win32k has a long, well-documented history as a target for local privilege escalation vulnerabilities on Windows. The kernel-mode graphics subsystem has been the subject of numerous CVEs over the years, and they appear frequently in Patch Tuesday releases. Microsoft addressed 137 vulnerabilities in the May 2026 cycle alone, which gives a sense of the scale of the Windows attack surface. Microsoft's structured monthly patch cadence and its role as CNA for its own products point to a mature vulnerability management program. The recurring Win32k issues still show how complex it is to secure legacy kernel-mode components.
