Microsoft has disclosed CVE-2026-45657, a critical (CVSS 9.8) use-after-free flaw in the Windows Kernel that lets an unauthenticated attacker execute code remotely over a network.
What Is It
CVE-2026-45657 is a use-after-free vulnerability in the Windows Kernel. According to Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." It is classified under CWE-416 (Use After Free) and CWE-122 (Heap-based Buffer Overflow). The vulnerability was published on June 9, 2026, and is currently undergoing analysis by NVD.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL). Its vector string, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicates the most dangerous possible profile for exploitation:
- Network attack vector: exploitable remotely
- Low attack complexity: no special conditions required
- No privileges required: attacker needs no prior access
- No user interaction: no victim action needed
- High confidentiality, integrity, and availability impact: full compromise potential
A kernel-level flaw exploitable remotely without authentication or user interaction represents a worst-case scenario for affected systems.
What's Vulnerable
The affected component is the Windows Kernel. The supplied NVD record does not enumerate specific affected product versions or CPEs at this time, as the entry is still undergoing analysis. Refer to Microsoft's advisory for the authoritative list of affected platforms.
Patch Status
The source identifier for this CVE is [email protected], and Microsoft has published a vulnerability entry in its Update Guide (see Sources). The supplied data does not include a CISA KEV entry, so there is no confirmation of active exploitation in the provided source material, and no KEV-mandated remediation deadline is present. Administrators should consult Microsoft's MSRC advisory for patch availability and update guidance.