Critical Windows Kernel Vulnerability CVE-2023-21768 Lets Attackers Modify Kernel Memory

Key Takeaways

• A critical Windows kernel vulnerability, identified as CVE-2026-40369, allows attackers to achieve full SYSTEM-level privilege escalation.
• The flaw affects Windows 11 versions 24H2 through 25H2 and is located in the ntoskrnl.exe component.
• The vulnerability is highly deterministic and can be exploited from sandboxed environments, including popular web browsers.
• As of this report, no official patch has been released, leaving affected systems vulnerable.

Unpatched Windows Kernel Flaw Enables SYSTEM-Level Privilege Escalation

A newly uncovered critical vulnerability within the Windows kernel, tracked as CVE-2026-40369, poses a significant threat, allowing attackers to escalate privileges to the highest SYSTEM level. This severe flaw is particularly concerning because it can be exploited even from highly restricted environments, such as those found in modern web browsers.

Security researcher Ori Nimron is credited with discovering this critical issue. The vulnerability impacts Windows 11 operating systems across versions 24H2 to 25H2. Its root cause lies within the ntoskrnl.exe component, specifically within the ExpGetProcessInformation function.

What makes this vulnerability exceptionally dangerous is its deterministic nature. Exploitation requires only a single system call from an unprivileged process to directly manipulate kernel memory. This bypasses many traditional security measures and makes the attack highly reliable.

The Mechanics of Kernel Manipulation

At the heart of CVE-2026-40369 is the NtQuerySystemInformation syscall, specifically when used with information class 253 (SystemProcessInformationExtension). The core issue arises when this syscall is invoked with a buffer length of zero. This specific condition leads to a complete bypass of the kernel’s ProbeForWrite validation mechanism.

This bypass allows an attacker to supply any pointer, including sensitive kernel addresses, without any integrity checks. The result is a potent, arbitrary kernel-memory-increment primitive. During execution, the vulnerable function iterates through all running processes and increments values at an attacker-controlled memory address. This effectively modifies kernel memory in a predictable and repeatable manner.

This flaw distinguishes itself from typical exploitation techniques, as it does not rely on complex methods such as race conditions, heap spraying, or token manipulation. Instead, it provides direct write access to kernel memory through a fundamental logic error.

Browser Sandbox Escapes and Broader Implications

Adding to its severity, the NtQuerySystemInformation syscall is not subject to common sandbox protections, including Win32k lockdown or integrity-level checks. This makes the vulnerability reachable from sandboxed environments, such as those used by Chrome, Edge, and Firefox renderers. Consequently, CVE-2026-40369 becomes an extremely valuable tool in browser escape chains, allowing an attacker to break out of a compromised browser and gain higher privileges on the host system.

An attack scenario could begin with a compromised browser renderer process. Utilizing this vulnerability, an attacker can increment specific kernel structures to gain further primitives, including the crucial ability to read arbitrary kernel memory. By carefully corrupting internal structures like CmpLayerVersions, attackers can redirect kernel pointers into user-controlled memory, enabling the extraction of sensitive kernel data.

This capability allows attackers to bypass protections such as Kernel Address Space Layout Randomization (KASLR) and locate critical structures like EPROCESS. With kernel read access established, attackers can traverse the active process list to locate their own process token and manipulate privilege bitmasks. Incrementing specific offsets within the token structure can enable privileges such as SeDebugPrivilege, which permits opening handles to high-privilege processes like winlogon.exe and injecting malicious code, ultimately leading to the execution of a command shell with NT AUTHORITYSYSTEM privileges.

The vulnerability also highlights a broader architectural weakness within Windows: the lack of Supervisor Mode Access Prevention (SMAP) enforcement. This absence allows the kernel to safely access user-mode memory during exploitation, simplifying the attack. Attackers can map fake structures in user space, and the kernel will process them without triggering faults, significantly easing the exploitation process.

Security researcher Ori Nimron emphasized that the existence of this bug in a highly scrutinized syscall demonstrates that even well-audited code paths can harbor critical flaws. The vulnerability was initially developed for Pwn2Own Berlin 2026 but was publicly disclosed after its submission was rejected due to capacity constraints.

Currently, no official patch details have been confirmed by Microsoft, meaning users running affected Windows 11 builds remain at risk. Organizations are strongly advised to remain vigilant.

What You Should Do

• Monitor for any unusual usage patterns of the NtQuerySystemInformation syscall within your environment.
• Apply all Windows updates as soon as they become available from Microsoft, especially those addressing kernel vulnerabilities.
• Implement robust endpoint detection and response (EDR) rules to identify and alert on abnormal kernel interaction patterns or suspicious process behavior.
• Maintain strict patch management policies for all browser applications to reduce the risk of initial browser compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.