CVE-2026-70017

MediumCVSS 5.5/10Last modified Oct 16, 2026

Description

Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-843

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.9376
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.7807
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.7807
MicrosoftWindows 11 version 23H2>= 10.0.22631.0, < 10.0.22631.7652
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.7652
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.9711
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.9711
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.3231
MicrosoftWindows 11 Version 26H2>= 10.0.26300.0, < 10.0.26300.9711
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.9376
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.9376
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.5761
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.33650
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.33650

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-700196.5Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network.CVE-2026-70027.3A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_mesCVE-2026-700217.0Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.CVE-2026-700237.8Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-700249.8Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.CVE-2026-700256.5Use after free in Windows Netlogon allows an authorized attacker to deny service over a network.CVE-2026-700267.0Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-700277.8Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.CVE-2026-70035.3WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OACVE-2026-700317.5Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.CVE-2026-700337.5Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a CVE-2026-700358.8Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-70017: Medium severity, CVSS 5.5 | Vulnix