PT-2026-2662 · Microsoft · Windows

Daniil Romanovych · Published 2026-01-13 · Updated 2026-03-29 · CVE-2026-20811

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to patchday February 2026

Description An issue exists in the Win32k component (Win32k.sys) of the Windows operating system related to accessing a resource using incompatible types, known as 'type confusion'. Exploitation of this issue can allow an attacker to elevate privileges locally. The vulnerability affects the ICOMP functionality within Win32k. Specifically, a CMonitorTopology* object survives incomplete sanitization in the asynchronous path. This can allow an authorized attacker to elevate privileges locally.

Recommendations Apply the updates released during the February 2026 patchday.

Fix

Untrusted Pointer Dereference

Type Confusion

Weakness Enumeration

CWE-822

CWE-843

Related Identifiers

BDU:2026-00428

CVE-2026-20811

Affected Products

Windows

References · 8

• https://bdu.fstec.ru/vul/2026-00428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20811 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20811 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20811 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20811 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20811 · Security Note
• https://twitter.com/CVEnew/status/2012490427656437917 · Twitter Post
• https://twitter.com/s4dbrd/status/2038319097243402591 · Twitter Post