PULSEUnderground Intel

AO VIVO6sinais / 24h

FEED

ransomqilin reclama a Kayaku Safety Systems Malaysia Sdn Bhd · MY · Manufacturingransomscarlettgroup reclama a fittleworth.com · GB · Retail & E-Commerceransombarracuda reclama a FINSA · ES · Financial Servicesransomnetrunner reclama a F***** G****** C********** C*** · USransomendzone reclama a Momentum Telecom · Technologyransomendzone reclama a Absolute Bail Bonds · US · Financial Servicesransomeverest reclama a Grundbaulabor Trier GmbH · DE · Manufacturingransomnetrunner reclama a I****** A***** · KWransominterlock reclama a K&A Industries · USransomeverest reclama a Final Notice Before Publication · Otherransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomqilin reclama a Kayaku Safety Systems Malaysia Sdn Bhd · MY · Manufacturingransomscarlettgroup reclama a fittleworth.com · GB · Retail & E-Commerceransombarracuda reclama a FINSA · ES · Financial Servicesransomnetrunner reclama a F***** G****** C********** C*** · USransomendzone reclama a Momentum Telecom · Technologyransomendzone reclama a Absolute Bail Bonds · US · Financial Servicesransomeverest reclama a Grundbaulabor Trier GmbH · DE · Manufacturingransomnetrunner reclama a I****** A***** · KWransominterlock reclama a K&A Industries · USransomeverest reclama a Final Notice Before Publication · Otherransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerce

← Todos os CVEs

CVE Watch11 de nov. de 2026

CVE-2026-40369

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS

7.8

Alta

EPSS

4.7%

p92

KEV

—

Exploit Today

28

0-100

Publicado: 12 de mai. de 2026 · Última mod.: 11 de nov. de 2026 · CWE-822

EPSS · 30d

0.3%EPSS · 30 dias4.7%

2026-10-172026-11-13

Descrição técnica

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Referências oficiais

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40369

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-910077.8 ALT

——0The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory. With CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties — drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c — store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug. The result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected. The fix makes both verifiers reject the two notifier properties outright — including when the supplied callback is NULL, since the notifiers are device state — and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety.3d CVE-2026-961687.0 ALT

——5Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4d CVE-2026-961397.0 ALT

——5Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.4d CVE-2026-961247.0 ALT

——5Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4d CVE-2026-961227.8 ALT

——7Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4d CVE-2026-960737.0 ALT

——5Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.4d