CVE-2026-54107
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A race condition in the Windows Win32K driver allows an authorized attacker to elevate privileges locally due to improper synchronization of shared resources. This vulnerability can be exploited to gain higher system privileges.
Risk Assessment
The organization faces the risk of an authorized user gaining elevated privileges, potentially leading to unauthorized access, data breaches, or system compromise.
Recommendation
Apply the security update provided by Microsoft as part of the monthly Patch Tuesday or an out-of-band release immediately. Consider restricting local user privileges until the patch is applied.
Other vulnerabilities in Windows Win32K
See all- CVE-2026-34347High
A use after free vulnerability in Windows Win32K allows an authorized attacker to elevate privileges locally.
- CVE-2026-33839High
A race condition in Windows Win32K allows an authorized attacker to locally elevate privileges due to improper synchronization during concurrent execution using shared resources.
- CVE-2026-24285High
A use after free vulnerability in Windows Win32K allows an authorized attacker to elevate privileges locally.
- CVE-2025-30388High
CVE-2025-30388 involves a heap-based buffer overflow in the Win32K driver in Windows, allowing an unauthorized attacker to execute code locally.
- CVE-2022-41109High
Vulnerability in Windows Win32k allows elevation of privilege. It could be exploited to gain higher privileges on the system.
- CVE-2022-21882HighActively exploited
Win32k Elevation of Privilege Vulnerability.
- CVE-2021-26863High
Elevation of Privilege vulnerability in Windows Win32k. Details are not provided in the description.
- CVE-2021-1732HighActively exploited
A vulnerability in the Win32k component of Windows allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.
- CVE-2019-1458HighActively exploited
A vulnerability in Windows when the Win32k component fails to properly handle objects in memory allows elevation of privilege.
- CVE-2018-8120HighActively exploited
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability.' This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.