CVE-2026-45657: Microsoft Windows Kernel Use-After-Free Remote Code Execution
Microsoft published CVE-2026-45657, a use-after-free condition in the Windows Kernel that the record says allows an unauthorized attacker to execute code over a network. The record reports a CVSS base score of 9.8 (critical), and CISA KEV does not list it. Affected Windows 11 and Windows Server builds are listed with upper bounds that indicate where the fixed builds begin.
Overview
Microsoft published CVE-2026-45657 for the Windows Kernel. The record describes a use-after-free condition that can let an unauthorized attacker execute code over a network. The record is marked as analyzed and reports a CVSS base score of 9.8, which is critical.
Impact
- The vector in the record indicates network attack vector, low complexity, no privileges and no user interaction required.
- The vector also indicates high impact on confidentiality, integrity and availability.
- The record's SSVC data marks the issue as automatable with total technical impact.
Affected products and versions
The record lists the following affected products with upper bounds:
- Windows 11 23H2: before 10.0.22631.7219
- Windows 11 24H2: before 10.0.26100.8655
- Windows 11 25H2: before 10.0.26200.8655
- Windows 11 26H1: before 10.0.28000.2269
- Windows Server 2022: before 10.0.20348.5256
- Windows Server 2025 (including Server Core installation): before 10.0.26100.32995
The record's fixes list is empty. Based on the listed upper bounds, builds at or above these values appear to be the ones that address the issue, but the vendor advisory should be checked for the authoritative list.
Exploitation status
- CISA KEV does not list this CVE in the data consulted.
- The SSVC exploitation field is recorded as none.
- The EPSS probability is 0.00974 with a percentile of 0.61737.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify all Windows 11 and Windows Server systems in the environment and compare their build numbers with the affected builds above.
- Apply the security update for each affected product as published by Microsoft in the MSRC update guide.
- Prioritize systems that accept network connections from untrusted networks.
- Confirm the installed build after patching and keep a record of the verification.
- The record does not describe workarounds. Check the vendor advisory for any additional mitigation guidance.
Detection guidance
- Review inventories and patch management reports for systems still running builds below the listed upper bounds.
- Monitor for unexpected kernel crashes, system restarts or stop errors on exposed hosts, which can be signs of memory corruption issues.
- Keep network monitoring in place for services exposed to untrusted networks.
Limitations of the available information
- The description says use-after-free, but the record maps the weakness to CWE-122, Heap-based Buffer Overflow. The sources consulted do not explain this difference.
- The fixes list is empty, so fixed builds are inferred from the upper bounds of the affected ranges.
- The record contains no technical details about the trigger and no information about public proof-of-concept code. These are unknown.
- The EPSS date in the record (2026-10-23) is later than the publication date, so its timing should be verified before use.
Frequently asked questions
Is CVE-2026-45657 known to be actively exploited?
CISA KEV does not list this CVE in the data consulted, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none.
Which Windows builds are affected?
The record lists Windows 11 23H2 before 10.0.22631.7219, 24H2 before 10.0.26100.8655, 25H2 before 10.0.26200.8655, 26H1 before 10.0.28000.2269, Windows Server 2022 before 10.0.20348.5256, and Windows Server 2025 before 10.0.26100.32995.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.