A critical double free vulnerability in the Windows Kernel allows a locally authenticated attacker to escalate privileges to full system control.

This is a double free memory corruption flaw (CWE-415) residing within the Windows Kernel. It requires the attacker to have local access and low-level privileges to trigger the vulnerability, which subsequently allows for arbitrary code execution with kernel-mode permissions.

Successful exploitation of this flaw grants an attacker complete control over the affected system, as kernel-mode code execution bypasses all standard user-space security boundaries. With a CVSS score of 7.8, the risk is classified as High due to the potential for total system compromise, data exfiltration, and the installation of persistent malicious backdoors.

Immediate Action: Apply the April 2026 security updates provided by Microsoft via the official update guide to patch the vulnerable kernel components.

Proactive Monitoring: Monitor system logs for unexpected process crashes, kernel panics, or unusual elevation of privilege events associated with local user accounts.

Compensating Controls: Ensure robust endpoint detection and response (EDR) solutions are active to identify and block unauthorized attempts to execute kernel-level exploits or perform suspicious memory operations.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository nikosecurity/CVE-2026-26179.

Given that this vulnerability allows for complete system takeover, it is imperative that all affected Windows systems are updated immediately. Prioritize patching for multi-user environments and jump servers where a local attacker might attempt to escalate their privileges to compromise the broader infrastructure.