CVE-2026-34332

Windows Kernel-Mode Driver Remote Code Execution Vulnerability

View on CVE.org
Published May 12, 2026 CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Description
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.

Analysis

AI-generated

Technical impact

The vulnerability is a use‑after‑free in Windows kernel‑mode drivers that can be triggered by a network packet. An attacker with sufficient authorization can cause the driver to execute arbitrary code in kernel mode, giving full control of the machine.

Affected Systems

Microsoft Windows Server 2025 and Windows Server 2025 Server Core are affected by this flaw.

Risk and Exploitability

With a CVSS score of 8, the flaw is considered high severity. The exploit requires the attacker to be authorized and able to send crafted traffic to the server. The EPSS is not available, and it is not listed in CISA’s KEV catalog, but the high CVSS suggests a significant risk if the vulnerability remains unpatched.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Microsoft security update that addresses CVE-2026-34332.
  • Configure firewall rules to limit inbound traffic to the ports required for legitimate remote management, thereby reducing the attack surface.
  • Enable detailed auditing and real‑time monitoring of kernel driver activity to detect anomalous behavior.

Generated by OpenCVE AI on May 12, 2026 at 19:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2025 (server Core Installation)
Type Values Removed Values Added
Description Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.
Title Windows Kernel-Mode Driver Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows Server 2025
Weaknesses CWE-416
CPEs cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
microsoft
Published
Updated
Aug 10, 2026, 3:13 PM
Reserved
Mar 26, 2026, 9:02 PM

View source JSON

Updated
May 13, 2026, 9:59 AM

JSON

Status
Analyzed
Published
May 12, 2026, 6:17 PM
Modified
Oct 26, 2026, 6:10 PM

View source JSON

No data.

Updated
May 12, 2026, 8:15 PM

JSON