OnlyPatch
Windows Kernel

CVE-2026-58532 — Windows Kernel Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00311 🔬 Patch diffed 2026-07 archive

Executive Summary

Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-190: Integer Overflow or Wraparound
Released Jul 14 2026
Last Updated Jul 14 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00311 — 0.23683 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00311
probability of exploitation in the next 30 days
0.23683 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

27 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5099535 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5099535 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5099538 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5099538 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 26H1 for ARM64-based Systems 5101649 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5101649 (Security Update) Important Elevation of Privilege Yes
Windows Server 2012 5099445 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5099445 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5099444 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5099444 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5099535 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5099535 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5099538 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5099538 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5099540 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5099536 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5099536 (Security Update) Important Elevation of Privilege Yes

Patches

9 patches
Article Type Restart
5099535 Security Update Yes
5099538 Security Update Yes
5099539 Security Update Yes
5101650 Security Update Yes
5101649 Security Update Yes
5099445 Monthly Rollup Yes
5099444 Monthly Rollup Yes
5099540 Security Update Yes
5099536 Security Update Yes

Patch Diff

ghidriff · tcpip.sys (KB5101650)

Integer overflow (CWE-190) in tcpip.sys WFP ALE redirect-records deserializer. AleRedirectRecordsDeserializeFromBuffer bounds-checks input with an unchecked 64-bit multiplication recordCount*0x228; count=0x2000000000000000 wraps the product to 0 so a 16-byte buffer passes, then the loop pool-allocates ('AlcR') and copies non-existent records while remainingLength underflows. Reached via WSAIoctl(SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS, 0x980000DE) from any standard user. EoP per MSRC; reported by aprilpet 2026-04-20, fixed July 2026 (KB5101650). NOTE: ghidriff function-level verification pending (tcpip.sys diff run).

Pre-patch version 10.0.26100.8737 Download
Post-patch version 10.0.26100.8875 Download
Function Address Change Note
tcpip!AleRedirectRecordsDeserializeFromBuffer crash frame +0x18d code (expected; ghidriff verification pending) unchecked u64 multiply count*0x228 in bounds check wraps to 0; fixed with checked bound (count > remaining/0x228)
View full diff report View RCA report Download PoC

Attack Path

Pool corruption via a 64-bit multiplication overflow in the WFP ALE redirect-records deserializer

Attack path for CVE-2026-58532 Pool corruption via a 64-bit multiplication overflow in the WFP ALE redirect-records deserializer 01 — ENTRY Any standard user issues the WFP redirect-records ioctl on a socket WSAIoctl(SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS, 0x980000DE). No elevation and no special network position required. 02 — CONTROLLED INPUT recordCount is set to 0x2000000000000000 with a 16-byte buffer The count and the buffer are both caller-supplied and independent of each other. 03 — PATH AleRedirectRecordsDeserializeFromBuffer bounds-checks before the copy loop The check multiplies recordCount by the 0x228-byte record size to work out how much input is required. 04 — MISSING CHECK The multiply is unchecked 64-bit arithmetic 0x2000000000000000 * 0x228 wraps to 0, so a 16-byte buffer satisfies the bound. The patch replaces it with a division-based check: reject when count > remaining / 0x228. 05 — PRIMITIVE Pool allocations ('AlcR') and copies of records that were never supplied The loop runs against the un-wrapped count, copying from beyond the input while remainingLength underflows. Rated EoP by MSRC.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

aprilpet

On This Page