Description

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-14T18:20:20.047Z",
  "pubdate": "2026-09-14T18:20:20.047Z",
  "executiveSummary": "This vulnerability involves a double-free memory corruption flaw located within the Windows Secure Kernel Mode.\nA double-free occurs when an application attempts to deallocate the same memory address twice without an intervening allocation, leading to heap corruption.\nThe vulnerability permits a locally authenticated attacker to leverage this memory corruption to achieve privilege escalation.\nBy manipulating the kernel heap state through specifically crafted requests, an attacker can gain arbitrary code execution or elevate their security context to that of the kernel.\nSuccessful exploitation compromises the integrity and confidentiality of the host operating system.\nThe attack is limited to local vectors, requiring the attacker to have already established an interactive session or valid user credentials on the target system.\nThe risk is critical, as escalation to kernel-level privileges provides full control over the system, bypassing most user-mode security boundaries and EDR telemetry.",
  "technicalDetails": "The vulnerability exists due to improper management of dynamic memory within the Windows Secure Kernel Mode component. Specifically, the kernel fails to properly invalidate or nullify a pointer after the initial free operation, allowing a subsequent instruction to trigger a second free on the same memory chunk.\nIn a kernel environment, heap management is typically handled by the Windows Kernel Pool manager. When an object is freed, the pool allocator marks the chunk as available. A double-free condition allows the attacker to manipulate the kernel heap metadata, potentially leading to a use-after-free scenario or an arbitrary write primitive.\nThe attack flow begins with the attacker interacting with a kernel-mode driver or interface that manages sensitive objects. The attacker triggers a sequence of operations that forces the kernel to release a specific object twice. During the window between the first and second free, the attacker may attempt to perform heap spraying or grooming to influence the contents of the heap at the now 'reclaimed' or corrupted memory location.\nBy controlling the contents of the memory address that is subjected to the second free, an attacker can corrupt the heap freelist pointers or object headers. This corruption is subsequently leveraged to gain an arbitrary write capability (Write-What-Where primitive) when the kernel later attempts to allocate or manipulate objects within the corrupted memory area.\nWith the ability to write to arbitrary kernel memory, an attacker can overwrite critical structures such as the process token (EPROCESS) for their own user process. By replacing the security token with the token of a highly privileged process (e.g., SYSTEM), the attacker achieves local privilege escalation.\nExploitation requires the attacker to have sufficient local access to interact with the vulnerable kernel interface. Because the vulnerability resides in kernel-mode, the exploitation bypasses standard user-mode access control lists (ACLs) and relies on the attacker's ability to navigate kernel-level protections such as Kernel Address Space Layout Randomization (KASLR) and Supervisor Mode Execution Prevention (SMEP).\nPost-exploitation, the attacker operates with kernel-level privileges, enabling the injection of malicious code, modification of kernel objects, disabling of security software, or installation of persistent rootkits, effectively granting total compromise of the underlying operating system and hardware."
}