Untrusted pointer dereference in Windows Kernel

CVE-2026-40369 is a Windows Kernel elevation-of-privilege bug caused by an untrusted pointer dereference (CWE-822). Microsoft and the CVE record describe it as a local flaw: an attacker with code execution as a low-privilege user can abuse kernel handling to reach SYSTEM-level control. The affected ranges published in the CVE record are Windows 11 24H2 before 10.0.26100.8457, Windows 11 25H2 before 10.0.26200.8457, Windows 11 26H1 before 10.0.28000.2113, and Windows Server 2025 before 10.0.26100.32860.

paragraphs

Why this verdict

• Downward pressure: requires prior compromise — AV:L/PR:L means the attacker already has code running locally or has valid low-privilege access. That implies post-initial-access, which materially narrows reachable population compared with network bugs.
• Upward pressure: broad Windows footprint — this hits mainstream Windows 11 branches and Windows Server 2025, so once you own a foothold, there is a large real-world host population where the exploit target exists.
• Upward pressure: public exploit chain exists — public PoC/exploit references reduce attacker development cost and make this much more than a theoretical kernel bug, especially for actors chaining browser or userland execution into SYSTEM.

Why not higher?

It is not unauthenticated remote code execution, not a wormable service, and not a pre-auth edge-device issue. There is also no verified KEV entry or active exploitation evidence in the reviewed sources, so calling it CRITICAL would overstate the immediacy.

Why not lower?

This is still a kernel-to-SYSTEM escalation on very common Windows builds, and public exploit availability matters. In a 10,000-host estate, any malware, browser compromise, or misused user context becomes much more dangerous if SYSTEM is one syscall path away.

1. Tighten application control on user space — Use WDAC/AppLocker/allow-listing to cut down the number of low-privilege processes that can execute arbitrary code in the first place. For a HIGH verdict, deploy or tighten this within 30 days where you cannot patch immediately, because the prerequisite foothold is the cleanest choke point.
2. Harden browsers and isolate high-risk users — Because public reporting ties this bug to browser-sandbox-escape value, prioritize browser exploit prevention, extension control, and isolation for admins, developers, and internet-facing staff. Treat this as a compensating control to deploy within 30 days on unpatched populations.
3. Enforce least privilege and remove standing local admin — This does not stop the bug outright, but it reduces the number of initial contexts an attacker can weaponize and limits post-SYSTEM blast radius by keeping privilege boundaries tighter across the fleet. Apply within 30 days for systems that will remain on vulnerable builds during patch waves.
4. Tune EDR for token abuse and defense tampering — You are unlikely to get perfect detection on the exact kernel transition, so focus on catching the aftermath: token manipulation, suspicious service creation, LSASS access, security product tampering, and unusual child-process chains. Put the tuning in place within 30 days while remediation proceeds.

Run this on the target Windows host or through your EDR/management shell. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-CVE-2026-40369.ps1 from an elevated shell is preferred, but standard-user rights are usually enough because the script only reads OS version metadata from the registry and CIM.

# check-CVE-2026-40369.ps1

# Determines likely exposure to CVE-2026-40369 based on Windows build/version.

# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'

function Get-OsInfo {
    $cvPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $cv = Get-ItemProperty -Path $cvPath

    $productName    = [string]$cv.ProductName
    $displayVersion = [string]$cv.DisplayVersion
    $currentBuild   = [int]$cv.CurrentBuildNumber
    $ubr            = [int]$cv.UBR
    $buildLabEx     = [string]$cv.BuildLabEx

    $cs = Get-CimInstance Win32_ComputerSystem
    $os = Get-CimInstance Win32_OperatingSystem

    return [pscustomobject]@{
        ProductName    = $productName
        DisplayVersion = $displayVersion
        CurrentBuild   = $currentBuild
        UBR            = $ubr
        BuildLabEx     = $buildLabEx
        DomainRole     = $cs.DomainRole
        Caption        = [string]$os.Caption
        Version        = [string]$os.Version
    }
}

function Test-Vulnerable {
    param(
        [Parameter(Mandatory=$true)]$Info
    )

    $pn = $Info.ProductName.ToLowerInvariant()
    $dv = $Info.DisplayVersion.ToLowerInvariant()
    $build = [int]$Info.CurrentBuild
    $ubr = [int]$Info.UBR

    # Windows Server 2025 / Server Core: vulnerable if build 26100 and UBR < 32860

    if ($pn -like '*server 2025*' -or $Info.Caption.ToLowerInvariant() -like '*server 2025*') {
        if ($build -eq 26100) {
            return ($ubr -lt 32860)
        }
        return $false
    }

    # Windows 11 24H2: build 26100, UBR < 8457

    if (($pn -like '*windows 11*') -and ($dv -eq '24h2' -or $build -eq 26100)) {
        if ($build -eq 26100) {
            return ($ubr -lt 8457)
        }
        return $false
    }

    # Windows 11 25H2: build 26200, UBR < 8457

    if (($pn -like '*windows 11*') -and ($dv -eq '25h2' -or $build -eq 26200)) {
        if ($build -eq 26200) {
            return ($ubr -lt 8457)
        }
        return $false
    }

    # Windows 11 26H1: build 28000, UBR < 2113

    if (($pn -like '*windows 11*') -and ($dv -eq '26h1' -or $build -eq 28000)) {
        if ($build -eq 28000) {
            return ($ubr -lt 2113)
        }
        return $false
    }

    throw 'Platform/version not in the published affected list.'
}

try {
    $info = Get-OsInfo
    $isVuln = Test-Vulnerable -Info $info

    if ($isVuln) {
        Write-Output 'VULNERABLE'
        exit 1
    } else {
        Write-Output 'PATCHED'
        exit 0
    }
}
catch {
    Write-Output 'UNKNOWN'
    exit 2
}

Sources

1. Microsoft Security Update Guide advisory
2. NVD CVE record
3. OpenCVE record with affected version ranges
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS project
6. FIRST EPSS API documentation
7. Check Point advisory / protection coverage
8. BleepingComputer May 2026 Patch Tuesday coverage