CVE-2026-35420

published 2026-05-12

CVE-2026-35420: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_server_2012	—	—
microsoft	windows_server_2012	>= 6.2.9200.0 < 6.2.9200.26079	6.2.9200.26079
microsoft	windows_server_2012_r2	>= 6.3.9600.0 < 6.3.9600.23181	6.3.9600.23181
microsoft	windows_server_2016	< 10.0.14393.9140	10.0.14393.9140
microsoft	windows_server_2016	>= 10.0.14393.0 < 10.0.14393.9140	10.0.14393.9140
microsoft	windows_server_2019	< 10.0.17763.8755	10.0.17763.8755
microsoft	windows_server_2019	>= 10.0.17763.0 < 10.0.17763.8755	10.0.17763.8755
microsoft	windows_server_2022	< 10.0.20348.5074	10.0.20348.5074
microsoft	windows_server_2022	>= 10.0.20348.0 < 10.0.20348.5139	10.0.20348.5139
microsoft	windows_server_2022_23h2	< 10.0.25398.2330	10.0.25398.2330
microsoft	windows_server_2025	< 10.0.26100.32772	10.0.26100.32772
microsoft	windows_server_2025	>= 10.0.26100.0 < 10.0.26100.32860	10.0.26100.32860

CWE-122