Brief Summary: CVE-2026-34330 — Windows Win32k Integer Overflow to Use After Free Privilege Escalation

Introduction

An integer overflow in the Windows Win32k graphics subsystem gives any authenticated local user a path to SYSTEM privileges on nearly every supported Windows build. CVE-2026-34330 was discovered by wenqunwang with the China Telecom Research Institute and patched during Microsoft's May 2026 Patch Tuesday cycle. It carries a CVSS 7.8 score and affects a long list of Windows client and server editions. There are no workarounds, so the only option is to apply the official fix.

Technical Information

The vulnerability is in the Windows Win32K GRFX component, the graphics handling portion of the Win32k kernel-mode driver (win32kfull.sys). It is classified under two CWE entries: CWE-190 (Integer Overflow or Wraparound) and CWE-416 (Use After Free). The dual classification points to a chained exploitation primitive. The integer overflow is the initial trigger, and the use after free is the exploitable condition that results.

CVSS Vector Breakdown

The CVSS 3.1 vector string is:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The attack vector is Local, so the attacker must already have code execution on the target system. Attack complexity is Low, which means no special conditions or race windows are required. The attacker needs Low privileges (any authenticated user), and no user interaction is necessary. The scope is Unchanged, meaning the vulnerability affects only the Win32k security context. Because Win32k runs in kernel mode, though, code execution there effectively grants SYSTEM privileges. Confidentiality, integrity, and availability impact are all rated High.

Exploitation Chain

Based on the CWE classification, the exploitation chain works as follows:

1. An authorized local attacker triggers an integer overflow in a size or count field within the GRFX subsystem.
2. The overflow causes an undersized memory allocation.
3. Because of the incorrect size calculation, later operations write beyond the allocated buffer or reference memory that has been freed, producing a use-after-free condition.
4. The attacker controls the contents of the freed memory through heap manipulation techniques common in Windows kernel exploitation. From there, the attacker can redirect execution flow or corrupt kernel data structures to elevate privileges to SYSTEM.

Win32k is a closed-source, kernel-mode driver, so Microsoft has not published a source code diff. Based on the dual CWE classification, the fix almost certainly adds proper integer overflow checks (for example, safe arithmetic on size or count fields) so that the use after free can no longer be reached. This is a well-established remediation pattern for chains that run from an integer overflow to a UAF in kernel graphics subsystems.

Patch Information

Microsoft released an official fix for CVE-2026-34330 on May 12, 2026, as part of the May 2026 Patch Tuesday cumulative security update cycle. The patch addresses both root-cause weaknesses in the Windows Win32K GRFX component. Microsoft explicitly states that there are no mitigations and no workarounds. Patching is the sole remediation.

The CVSS v3.1 vector includes the temporal qualifier RL:O (Remediation Level: Official Fix), which confirms this is a permanent, vendor-supplied resolution.

Consolidated Patch Matrix

All standard security updates require a system restart. Organizations must coordinate change controls with business owners to avoid unplanned outages.

Hotpatch Options

Microsoft also released Security Hotpatch updates for environments that support hotpatching (Azure Edition VMs and certain Server 2025 configurations):

These hotpatch updates apply the fix without a reboot, which helps most in production server environments.

Affected Systems and Versions

The vulnerability affects a broad range of Windows client and server operating systems across multiple architectures:

Windows Client:

• Windows 10 Version 1607 (32 bit and x64 based)
• Windows 10 Version 1809 (32 bit and x64 based)
• Windows 10 Version 21H2 (32 bit, x64 based, ARM64 based)
• Windows 10 Version 22H2 (32 bit, x64 based, ARM64 based)
• Windows 11 Version 23H2 (x64 based and ARM64 based)
• Windows 11 Version 24H2 (x64 based and ARM64 based)
• Windows 11 Version 25H2
• Windows 11 Version 26H1

Windows Server:

• Windows Server 2012 (Standard and Server Core)
• Windows Server 2012 R2 (Standard and Server Core)
• Windows Server 2016 (Standard and Server Core)
• Windows Server 2019 (Standard and Server Core)
• Windows Server 2022 (Standard and Server Core)
• Windows Server 2022 23H2
• Windows Server 2025 (Standard and Server Core)

Any system running a build number lower than the fixed builds in the patch matrix above is vulnerable.

Vendor Security History

Win32k has a history of memory safety issues, and this vulnerability fits it. In the same May 2026 update cycle, Microsoft also patched CVE-2026-34331 and CVE-2026-34333, both Win32k Elevation of Privilege vulnerabilities. The Win32k subsystem has been a recurring source of local privilege escalation flaws because of its large kernel-mode attack surface and complex legacy codebase.

The May 2026 Patch Tuesday cycle addressed 120 flaws in total, and no zero-days were reported. CVE-2026-34330 was credited to wenqunwang with the China Telecom Research Institute through coordinated vulnerability disclosure.

References

• NVD Entry for CVE-2026-34330
• CVE.org Record for CVE-2026-34330
• Microsoft Security Update Guide: CVE-2026-34330
• Microsoft CVRF Advisory Data, May 2026
• Tenable CVE-2026-34330 Summary
• Bleeping Computer: Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No Zero Days
• Bleeping Computer: Microsoft Patch Tuesday May 2026 Report
• CISA Known Exploited Vulnerabilities Catalog Update, May 2026