Brief Summary: CVE-2026-35420 Windows Kernel Heap Buffer Overflow Enables Local Privilege Escalation

Introduction

A heap-based buffer overflow in the Windows Kernel, patched in Microsoft's May 2026 Patch Tuesday, gives any locally authenticated user with low privileges a path to SYSTEM-level access. The flaw spans every supported version of Windows from Server 2012 through Windows 11 26H1, so the patch surface is broad and deployment is urgent, even though no active exploitation has been observed yet.

Technical information

CVE-2026-35420 is classified as CWE-122 (Heap-based Buffer Overflow) and sits in the Windows Kernel itself. Its CVSS v3.1 base score is 7.8, with this full vector string:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The attack vector is local, attack complexity is low, the attacker needs only low privileges, and no user interaction is required. Confidentiality, integrity, and availability impacts are all rated high. Scope is unchanged, which means the impact stays within the security authority of the vulnerable component. That component is the kernel, so "unchanged scope" still means full host compromise.

Root cause

Microsoft has not published source-level details for this heap-based buffer overflow, because the Windows Kernel is a closed-source component. The CWE-122 classification does tell us that a buffer allocated on the heap can be written beyond its intended bounds. In the kernel, that kind of corruption can overwrite adjacent heap metadata or kernel objects, which an attacker can use to gain arbitrary code execution in ring 0.

Attack flow

Exploitation of CVE-2026-35420 follows a pattern common to local privilege escalation vulnerabilities in the Windows Kernel:

1. The attacker first needs authenticated local access to the target system. They could get it through phishing, credential theft, exploiting a separate remote-access vulnerability, or a legitimate but low-privilege account (such as a compromised service account or a standard domain user).

2. With low-privilege access in hand, the attacker triggers the heap-based buffer overflow in the kernel. Because attack complexity is low and no user interaction is required, this step can be automated and run reliably.

3. The overflow corrupts heap metadata or adjacent objects in kernel memory. By carefully controlling the overflow contents and the heap layout (techniques well documented in kernel exploitation research), the attacker gains arbitrary code execution in kernel mode.

4. Successful exploitation yields SYSTEM-level access or a higher integrity level, which gives the attacker complete control over the host's confidentiality, integrity, and availability.

Context within the May 2026 release

CVE-2026-35420 shipped alongside several other Windows Kernel Elevation of Privilege vulnerabilities:

Counting these flaws, 13 disclosed Windows Kernel Elevation of Privilege vulnerabilities have been addressed in 2026 alone. CVE-2026-35420 is not currently flagged as "Exploitation More Likely" the way its counterparts are, but the cluster of kernel LPE fixes in a single release cycle suggests sustained research against this attack surface. Attackers often reverse engineer kernel patches to build working exploits, so the window between patch availability and exploit development may be narrow.

NVD enrichment status

At the time of writing, the National Vulnerability Database has not provided full enrichment or assessment details for CVE-2026-35420. Third-party sources indicate the vulnerability affects Windows Server 2012 up to Server 2022 23H2. For the definitive list of affected product builds and the specific Knowledge Base articles, administrators should consult the official Microsoft Security Response Center Update Guide.

Patch information

Microsoft fixed CVE-2026-35420 in its May 12, 2026 Patch Tuesday release cycle. Because this is a closed-source Windows Kernel vulnerability, no source-level diff or commit is publicly available. The fix ships only as binary cumulative updates and hotpatches, through Windows Update, WSUS, and the Microsoft Update Catalog. The MSRC advisory confirms the remediation level is "Official Fix," which means Microsoft considers the patch complete and final.

Across all 13 affected product entries in the MSRC Security Update Guide, the updates are classified as "Important" severity, with customer action marked as "Required."

Windows 11 (Client)

Windows Server

Hotpatch availability

This rollout includes hotpatch variants: KB5089466 for Windows 11 Enterprise, KB5087423 for Server 2025, and KB5087424 for Server 2022. Hotpatches apply security fixes to in-memory code without an immediate reboot, which is especially useful in production server environments. Eligible devices enrolled through Microsoft Intune with a hotpatch-enabled quality update policy will receive these automatically. The hotpatch fixes the same kernel vulnerability but lands at a slightly different OS build number than the full cumulative update. Organizations should verify which update path applies to their deployment.

No official workarounds or compensating controls have been documented for this kernel flaw, so patching is the only verified defense.

Affected systems and versions

According to the MSRC advisory and patch data, these systems are affected:

Windows 11 Client:

• Windows 11 25H2 (builds prior to 26200.8457)
• Windows 11 24H2 (builds prior to 26100.8457)
• Windows 11 26H1 (builds prior to 28000.2113)

Windows Server:

• Windows Server 2025 (builds prior to 10.0.26100.32860)
• Windows Server 2022, 23H2 Edition (builds prior to 10.0.25398.2330)
• Windows Server 2022 (builds prior to 10.0.20348.5139)
• Windows Server 2019 (builds prior to 10.0.17763.8755)
• Windows Server 2016 (builds prior to 10.0.14393.9140)
• Windows Server 2012 R2 (builds prior to 6.3.9600.23181)
• Windows Server 2012 (builds prior to 6.2.9200.26079)

Third-party sources corroborate that the vulnerability spans Windows Server 2012 through Server 2022 23H2, plus current Windows 11 releases.

Vendor security history

The May 2026 Patch Tuesday was a large one. Depending on the source, it addressed between 118 and 120 CVEs. It was the first release since June 2024 with no zero days exploited or publicly disclosed. Microsoft attributed the larger volume partly to a new multi-model, AI-driven scanning harness that is finding additional issues in previously studied code. Of the 120 flaws patched, 17 were classified as Critical, and 16 were discovered by this new agentic security system.

The Windows Kernel has been a consistent source of privilege escalation vulnerabilities, with 13 Windows Kernel Elevation of Privilege vulnerabilities disclosed and patched in 2026 alone. That volume reflects both the complexity of the kernel codebase and how much kernel LPE bugs are worth to attackers building exploit chains.

References

• NVD: CVE-2026-35420
• MSRC Security Update Guide: CVE-2026-35420
• Tenable: CVE-2026-35420
• Tenable: May 2026 Microsoft Patch Tuesday
• Zero Day Initiative: The May 2026 Security Update Review
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Microsoft MSRC Blog: A Note on Patch Tuesday
• SecPod: 120 Vulnerabilities Patched in May 2026
• Infosecurity Magazine: Microsoft Fixes 17 Critical Flaws in May Patch Tuesday
• VulDB: CVE-2026-35420
• KB5089549: Windows 11 25H2/24H2 Cumulative Update
• KB5089548: Windows 11 26H1 Cumulative Update
• KB5089466: Windows 11 Enterprise Hotpatch