CVE-2023-21688
NT OS Kernel Elevation of Privilege Vulnerability
CVSS
7.8
High
EPSS
3.6%
p89
KEV
—
Exploit Today
27
0-100
Published: Feb 14, 2023 · Last modified: Aug 19, 2026 · CWE-416
3.6%EPSS · 30 days3.6%
2026-07-222026-08-19
NT OS Kernel Elevation of Privilege Vulnerability
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-769574.9 MED—
——0libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.12hCVE-2026-769215.5 MED—
——0CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service18hCVE-2026-168517.4 HIG—
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a use-after-free.21hCVE-2026-580838.4 HIG8.1%
——2While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races.
An unprivileged local user can trigger a use-after-free in the kernel, potentially leading to privilege escalation.13hCVE-2026-494228.4 HIG4.2%
——1The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory.
The bug may be exploitable by an unprivileged local user to escalate privileges.13hCVE-2026-49418—4.2%
——1When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice.
An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.13h