A single syscall escapes the browser sandbox and lands SYSTEM. CVE-2026-40369 is patched. The public exploit code is everywhere.

WHAT THE FLAW ACTUALLY IS

CVE-2026-40369 is an untrusted pointer dereference in the Windows kernel. The vulnerability lives in ExpGetProcessInformation, the helper function inside ntoskrnl.exe that ExpQuerySystemInformation calls when handling several process-information request classes. The specific information class that triggers the bug is 253, also known as SystemProcessInformationExtension. The trigger condition is precise. The attacker calls NtQuerySystemInformation with information class 253, passes a pointer of their choosing as the buffer argument, and sets the buffer length to zero.

When the buffer length is zero, the kernel does not validate the caller-controlled pointer. The function proceeds to write process accounting data directly to the attacker-supplied kernel address. The write is twelve bytes wide and takes the form of three thirty-two-bit increments at offsets zero, four, and eight from the supplied pointer. The first value is the count of running processes excluding the Idle process and processes that ExpSysInfoShouldSkipProcess filters out. The second is the sum of active thread counts. The third is the sum of process handle counts. These values are predictable enough that the resulting kernel write behaves as a controlled increment primitive at any address the attacker chooses.

The technical write-up from VoidSec describes how this twelve-byte primitive chains into a full local privilege escalation. The exploit reads the kernel base address through a separate side-channel, increments specific kernel structures to manipulate token privileges, then calls NtCreateToken to mint a full SYSTEM token. The path is well-documented in published research. The chain achieves complete privilege escalation in milliseconds.

The vulnerability affects Windows 11 versions 24H2 and 25H2 directly. Several advisories note that Windows Server 2025 may also be affected, though Microsoft's advisory text is not fully explicit on server impact. The fix is included in the May 12, 2026 Patch Tuesday cumulative updates. Organizations that have applied the May Patch Tuesday update are protected. Organizations on earlier patch levels are not.

WHY THIS BUG IS DIFFERENT

Kernel privilege escalation vulnerabilities are not rare. Microsoft patches several each Patch Tuesday. What makes CVE-2026-40369 operationally distinctive is the property that the triggering syscall, NtQuerySystemInformation, is reachable from inside the standard browser renderer sandbox.

Modern web browsers run each tab's renderer process inside a restrictive sandbox. The sandbox is the defensive control that limits the damage from any code execution vulnerability inside the renderer. A JavaScript engine bug, a font parser flaw, an image codec issue, any of the bugs browsers patch every month, would produce arbitrary code execution inside the renderer process. The sandbox is supposed to contain that code execution to a narrow set of capabilities, preventing the attacker from reaching the broader system. The renderer sandbox is one of the most heavily-engineered defense layers in modern client computing.

The Windows-specific component of that defense layer is Win32k lockdown, a mitigation Microsoft introduced to restrict the syscalls a sandboxed process can make. Win32k lockdown blocks most syscalls that historically had a track record of kernel vulnerabilities. The intent is that even if an attacker achieves arbitrary code execution inside a renderer, they cannot reach the dangerous kernel attack surface. The mitigation has been successful at narrowing the attack surface significantly.

NtQuerySystemInformation is not on the Win32k lockdown restricted list. It is considered an information-disclosure syscall and was not historically a target of write-primitive exploitation. CVE-2026-40369 demonstrates that the assumption was incorrect. A syscall that browsers expected to be benign turns out to provide a one-call arbitrary kernel write primitive when called with the right information class. The mitigation that defenders relied on to keep browser renderers contained does not block this exploit.

The mitigation that defenders relied on to keep browser renderers contained does not block this exploit.

The result is that any browser renderer code execution bug, of which several are patched in every browser update, can now chain into full kernel privilege escalation through a single additional syscall. The complete attack path is: user visits malicious webpage, JavaScript engine bug produces renderer code execution, attacker calls NtQuerySystemInformation with the right arguments, twelve-byte kernel write executes, NtCreateToken mints a SYSTEM token, attacker has full control of the workstation. The chain is short. The chain is deterministic. The chain is now publicly documented and exploitable.

THE DISCLOSURE TIMELINE MATTERS

The disclosure of this vulnerability followed an unusual path that compresses the defender response window. Microsoft patched CVE-2026-40369 in the May 12, 2026 Patch Tuesday update. The advisory described the flaw as an Important-severity elevation of privilege vulnerability in the Windows kernel. Microsoft's standard practice is to release patches with limited technical detail, giving defenders time to deploy before exploit researchers reverse-engineer the fix and develop public proof-of-concept code.

The window did not last in this case. On May 13, the day after Patch Tuesday, security researcher Ori Nimron published a complete exploit package on GitHub. The repository includes a basic proof-of-concept that demonstrates the primitive, a full local privilege escalation chain that achieves SYSTEM, and a separate variant that explicitly models the Chrome sandbox environment to demonstrate the sandbox escape scenario. The publication was substantive. Anyone with basic offensive security skills can use the code to build a working exploit.

VoidSec's Andrea Pierini disclosed parallel research approximately a week later. Pierini had been preparing the same vulnerability for Pwn2Own Berlin, which Atarus covered on May 18. Two researchers independently discovering the same primitive and choosing different disclosure paths is itself a signal about the bug. It is not an obscure flaw that took years of fuzzing to find. Two researchers found it through manual analysis around the same time. Other researchers, including ones working for nation-state programs, very likely found it earlier and have not disclosed.

For defenders, the compressed timeline means the operational risk window opened the day the patch shipped, not weeks or months later. The historical pattern of patch-Tuesday-then-quiet-deployment-window does not apply to this CVE. The exploit code has been public for fourteen days. Any adversary that wanted to weaponize the chain has had two weeks to do so. The defender posture is not catching up to a future threat. It is responding to a present one.

WHAT THIS LOOKS LIKE IN PRACTICE

The practical exploitation scenario is the classic drive-by attack chain that nation-state actors and high-end criminal groups build their client-side campaigns around. The user does nothing wrong. They visit a webpage. The webpage may be a malicious site directly, a compromised legitimate site, an advertisement on a legitimate site, or content delivered through a watering-hole attack against the victim's industry. The browser renders the page. A JavaScript engine vulnerability or similar renderer-side flaw produces code execution inside the renderer process.

Until CVE-2026-40369 was public, the attacker at this stage was contained by the renderer sandbox. The sandbox would limit their access to the operating system. Without a separate sandbox escape vulnerability, the attack would stop here or be limited to a narrow set of further exploits. The sandbox was the difference between a noisy unsuccessful intrusion and a quiet successful one.

With CVE-2026-40369 public and unpatched, the sandbox stops being a meaningful barrier. The attacker's code inside the renderer makes a single NtQuerySystemInformation call, achieves the kernel write primitive, chains to NtCreateToken, and now operates as SYSTEM. From SYSTEM, the attacker can disable endpoint security products, install persistent implants, exfiltrate data, harvest credentials from memory, move laterally to other systems, and conduct any other post-compromise activity. The attack chain has gone from browser to SYSTEM in milliseconds, with no user interaction beyond visiting a webpage.

The downstream implications cascade. The Atarus body of work has documented multiple recent supply chain compromises that put malicious code in front of legitimate users: the GitHub compromise via poisoned VS Code extension, the Grafana codebase theft, the broader Coinbase Cartel and TeamPCP campaigns. Each of those compromises produced opportunities for attackers to inject content into legitimate-looking software or websites that targeted users would trust. Combined with CVE-2026-40369, those upstream compromises become drive-by SYSTEM compromise of any downstream user on an unpatched Windows 11 machine. The vulnerability does not exist in isolation. It compounds with every other compromise in the ecosystem.

INDICATORS AND TIMELINE

WHAT TO DO TODAY