CVE-2026-21519

HIGH KEV

Windows 10/11 Privilege Escalation via Desktop Window Manager Type Confusion

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2026-21519 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2026.

Description

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0422
EPSS Percentile 89.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2026-02-10
VulnCheck KEV 2026-02-10
ENISA EUVD EUVD-2026-7358
CWE
CWE-843
Status published
Products (30)
Microsoft/Windows 10 Version 1607 10.0.14393.0 - 10.0.14393.8868
Microsoft/Windows 10 Version 1809 10.0.17763.0 - 10.0.17763.8389
Microsoft/Windows 10 Version 21H2 10.0.19044.0 - 10.0.19044.6937
Microsoft/Windows 10 Version 22H2 10.0.19045.0 - 10.0.19045.6937
Microsoft/Windows 11 version 22H3 10.0.22631.0 - 10.0.22631.6649
Microsoft/Windows 11 Version 23H2 10.0.22631.0 - 10.0.22631.6649
Microsoft/Windows 11 Version 24H2 10.0.26100.0 - 10.0.26100.7840
Microsoft/Windows 11 Version 25H2 10.0.26200.0 - 10.0.26200.7840
Microsoft/Windows 11 version 26H1 10.0.28000.0 - 10.0.28000.1575
Microsoft/Windows 11 Version 26H1 10.0.28000.0 - 10.0.28000.1575
... and 20 more
Published Feb 10, 2026
KEV Added Feb 10, 2026
Tracked Since Feb 18, 2026