Windows Kernel Vulnerability Lets Attackers Modify Kernel Memory Counters

Gbhackers •Divya • May 27, 2026

A critical Windows kernel vulnerability, CVE-2026-40369, allows any unprivileged process, including a browser renderer sandbox, to increment arbitrary kernel memory and reliably escalate to SYSTEM on Windows 11 24H2–25H2. The bug sits in ntoskrnl.exe inside ExpGetProcessInformation, reachable via a single NtQuerySystemInformation call with information class 253. Windows Kernel Vulnerability CVE-2026-40369 is described as an untrusted pointer dereference in the Windows […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Windows Kernel Vulnerability Enables SYSTEM Privilege Escalation A critical vulnerability in the Windows kernel, identified as CVE-2026-40369, has been disclosed, allowing unprivileged processes to escalate privileges to SYSTEM level. This flaw affects Windows 11 versions 24H2 through 25H2 and resides in the ntoskrnl.exe component, specifically within the ExpGetProcessInformation function. Attackers can exploit this vulnerability from restricted environments, such as browser sandboxes, using a single NtQuerySystemInformation call. The vulnerability was published on May 12, 2026, with a proof of concept (PoC) made public shortly after on May 14, 2026. Security researchers have emphasized the potential for widespread exploitation given the ease of access to the attack vector. Organizations using affected Windows versions are urged to apply security updates as soon as they are available. 2 sources 69

Extracted Entities

Windows Kernel Vulnerability Lets Attackers Modify Kernel Memory Counters

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)