PT-2026-40204 · Microsoft · Windows Kernel+1

Published

2026-05-12

·

Updated

2026-05-20

·

CVE-2026-40369

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Windows 11 24H2 Windows 11 25H2
Description An untrusted pointer dereference in the Windows Kernel allows an authorized attacker to elevate privileges locally. The issue exists within ntoskrnl.exe in the ExpGetProcessInformation() function. When using the 'NtQuerySystemInformation' endpoint with info class 253 and a length argument of zero, the ProbeForWrite guard is bypassed because it is wrapped in an if (Length) check. This allows a caller-supplied kernel address to be processed without validation, resulting in an arbitrary kernel address increment. This primitive can be reached from browser render process sandboxes, such as those in Chrome, Edge, and Firefox, potentially enabling a sandbox escape.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

BDU:2026-06638
CVE-2026-40369

Affected Products

Windows
Windows Kernel