CVE-2026-70290
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Risk Assessment
An authorized attacker could access uninitialized data, potentially leading to disclosure of sensitive information.
Recommendation
Apply Windows security updates that address this issue.
Other vulnerabilities in Windows Win32 Kernel Subsystem
See all- CVE-2025-24983HighActively exploited
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- CVE-2022-41113High
Vulnerability in the Windows Win32 Kernel Subsystem allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.
- CVE-2026-70289High
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- CVE-2024-38253High
An elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem.
- CVE-2024-38252High
An elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem.
- CVE-2024-30086High
A vulnerability in the Windows Win32 kernel subsystem allows elevation of privilege. This flaw can be exploited by a local attacker to gain higher privileges on the system.
Original NVD description (English source)
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.