Quick Look: CVE-2026-35417 — Windows Win32k ICOMP Type Confusion Privilege Escalation

Introduction

A type confusion flaw in the Windows Win32K ICOMP kernel subsystem gives any locally authenticated user with low privileges a reliable path to SYSTEM, with no user interaction required and low attack complexity. Disclosed in Microsoft's May 2026 Patch Tuesday alongside 119 other fixes, CVE-2026-35417 carries a CVSS 3.1 score of 7.8 and an "Exploitation More Likely" assessment from Microsoft. That makes it a priority for any organization managing Windows endpoints or servers.

Technical Information

Root Cause: Type Confusion in Win32K ICOMP

The vulnerability is a type confusion condition (CWE-843) in the Win32K ICOMP component. Win32k is the kernel-mode driver behind the Windows graphical subsystem. It handles window management, GDI operations, and related system calls. Type confusion occurs when the kernel treats a memory object as a type it was not intended to be, which lets an attacker corrupt kernel data structures in a controlled way.

Microsoft's advisory classifies this as "Access of Resource Using Incompatible Type." The ICOMP code path accesses an internal resource using an incompatible type, and a locally authenticated user can trigger it. Because Win32k runs in kernel mode, successful exploitation gives the attacker SYSTEM-level privileges.

CVSS Vector Breakdown

The full CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H:

Attack Flow

An exploit for CVE-2026-35417 would follow a local privilege escalation pattern:

1. Initial Access: The attacker gets a low-privilege foothold on a Windows system through phishing, credential theft, remote access, or another initial access technique.
2. Trigger the Type Confusion: The attacker crafts specific sequences of GDI or window management API calls aimed at the Win32k ICOMP subsystem. These calls cause the kernel to misinterpret a memory object's type within the ICOMP code path.
3. Kernel Memory Corruption: By carefully controlling the layout and contents of the confused object, the attacker corrupts kernel memory structures. This can redirect execution flow or overwrite security tokens.
4. Privilege Escalation: The attacker gains code execution in kernel context, or modifies their process token to gain SYSTEM privileges. Either way, a standard user ends up with full system control.

Win32K is a closed-source kernel-mode driver, so no public source code diff or vulnerable code snippet is available. Microsoft delivers the fix entirely through binary patches.

Patch Information

Microsoft released an official fix for CVE-2026-35417 on May 12, 2026, as part of the May 2026 Patch Tuesday security rollout. At the time of publication, the MSRC advisory marks the Remediation Level as "Official Fix" and the Exploit Code Maturity as "Unproven."

The following table maps each KB article to the affected products and patched build numbers:

Several products also received Security Hotpatch Updates (KB5089466, KB5087423, KB5087424), which can be applied without a full reboot and so cut operational downtime. These hotpatch KBs deliver the same security fix, but their build numbers differ slightly to reflect the hotpatch delta.

Known deployment issue: On Windows 11 Version 23H2, devices with specific BitLocker Group Policy configurations and PCR7 binding set to "Not Possible" may require a BitLocker recovery key on the first restart after KB5087420 is deployed. Make sure BitLocker recovery keys are escrowed and accessible before you deploy the update.

To apply the fix, install the relevant cumulative update through Windows Update or WSUS, or download the standalone package from the Microsoft Update Catalog.

The vulnerability is also tracked in the GitHub Advisory Database under GHSA-3wc2-mwpc-hr6w.

Detection Methods

Network-Based Detection via Snort IDS/IPS

On May 12, 2026, Cisco Talos released Snort rules covering multiple vulnerabilities from this Patch Tuesday cycle, CVE-2026-35417 among them:

• Snort 2: SIDs 1:66438 through 1:66445, 1:66451 through 1:66460, and 1:66470 through 1:66476
• Snort 3: SIDs 1:301494 through 1:301497, 1:301500 through 1:301506, 1:66472 through 1:66473, and 1:66476

The Talos blog does not provide per-CVE SID mappings for this release. These ranges cover multiple May 2026 Patch Tuesday vulnerabilities as a group. Cisco Security Firewall customers should update their Security Rule Update (SRU), and open-source Snort Subscriber Ruleset users should download the latest rule pack from Snort.org. Although this is a local privilege escalation vulnerability, Snort rules may detect reconnaissance, exploitation attempts, or related post-exploitation network activity in environments where remote access protocols such as RDP are in use.

Vulnerability Scanning with Qualys

Qualys released QIDs for the May 2026 Patch Tuesday cycle. This is the full QQL query for identifying systems missing the May 2026 patches:

vulnerabilities.vulnerability: ( qid: 110525 or qid: 110526 or qid: 387304 or qid: 387305 or qid: 5012492 or qid: 92384 or qid: 92385 or qid: 92386 or qid: 92387 or qid: 92388 or qid: 92390 or qid: 92392 or qid: 92393 or qid: 92394 or qid: 92396 )

Upstream analysis suggests using QIDs 92385 and 92386 to filter for systems specifically affected by the Win32k-related updates, including CVE-2026-35417.

Endpoint and Behavioral Detection

Successful exploitation takes an attacker from a low-privileged user to SYSTEM, so endpoint detection is critical:

• Unexpected privilege transitions: Monitor for processes that move from standard user privileges to SYSTEM, especially ones that interact heavily with the Win32k kernel subsystem (win32kfull.sys, win32kbase.sys).
• Anomalous Win32k system call patterns: Type confusion exploits in Win32k typically rely on specific sequences of GDI or window management API calls. Look for unusual patterns of Win32k-related syscalls from processes that would not normally make them.
• Process lineage anomalies: Watch for low-integrity processes spawning high-integrity child processes, such as a user-mode application spawning cmd.exe or powershell.exe running as SYSTEM.

Patch Verification

Defenders can confirm that systems are protected by checking that the relevant May 2026 security updates are installed. For example, Windows 11 Version 24H2 systems should be at build 10.0.26100.8457 or later (KB5089549), and Windows Server 2025 should be at build 10.0.26100.32860 or later (KB5087539).

Affected Systems and Versions

The vulnerability affects a broad range of Windows client and server operating systems on 32-bit, x64, and ARM64 architectures:

References

• NVD Entry for CVE-2026-35417
• MSRC Security Update Guide: CVE-2026-35417
• CVE Record: CVE-2026-35417
• GitHub Advisory: GHSA-3wc2-mwpc-hr6w
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Cisco Talos: Microsoft Patch Tuesday May 2026
• Qualys: Microsoft Patch Tuesday May 2026 Security Update Review
• KB5089548: Windows 11 26H1 (OS Build 28000.2113)
• KB5089549: Windows 11 24H2/25H2 (OS Builds 26200.8457 and 26100.8457)
• KB5087420: Windows 11 23H2 (OS Build 22631.7079)
• KB5087544: Windows 10 21H2/22H2 (OS Builds 19045.7291 and 19044.7291)
• KB5087538: Windows Server 2019 / Windows 10 1809 (OS Build 17763.8755)
• KB5087539: Windows Server 2025 (OS Build 26100.32860)
• KB5087545: Windows Server 2022 (OS Build 20348.5139)
• KB5087541: Windows Server 2022 23H2 (OS Build 25398.2330)
• Ten Forums: Microsoft May/June 2026 Security Updates
• Windows Forum: CVE-2026-35417