Microsoft Kernel do Windows · Public exploit code

CVE-2026-40369: unprivileged Windows kernel write reachable from browser sandboxes

Oct 26, 2026 · 1 min read

CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write primitive in the Windows function nt!ExpGetProcessInformation. According to @DarkWebInformer, it can be reached from any context capable of calling NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderer processes, and a PoC and writeup are public. The source mentions no fix; track Microsoft advisories and patch when released.

By HIFY Radar newsroom Updated 10/26/2026 04:43 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CVE-2026-40369 has been disclosed: an unprivileged arbitrary 12-byte write primitive in the Windows kernel function nt!ExpGetProcessInformation. According to @DarkWebInformer, it is reachable from any context capable of calling NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderer processes. A proof of concept and a writeup have been published.

Why it matters

The flaw reaches the Windows kernel, the most privileged layer of the system, and can be triggered from an isolated browser tab. The sandbox meant to contain malicious browser code does not block access. No fix is cited in the source, widening the risk window for Windows endpoints.

What to do

Track Microsoft advisories and apply the CVE-2026-40369 fix as soon as it is released. With no patch cited, strengthen monitoring of Windows endpoints and treat exploitation alerts with top priority.

For the technical team

CVE: CVE-2026-40369
Affected: Microsoft Kernel do Windows (nt!ExpGetProcessInformation) · Windows kernel, function nt!ExpGetProcessInformation. Specific Windows versions not stated in the source. Reachability applies to any context that can call NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderers.
Exploitation: PoC and writeup publicly released (reported by @DarkWebInformer). No in-the-wild exploitation reported in the source.
Fix: Not mentioned in the source; no patched version or mitigation cited.
Vector: Unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation (CVE-2026-40369). Exploitation condition: the attacking context only needs to be able to call NtQuerySystemInformation, which includes sandboxed Chrome, Edge, and Firefox renderer processes.
More details: Disclosed via an X post by @DarkWebInformer linking the PoC and the writeup. The source does not name the researcher, list affected Windows versions, or give a fix timeline.