CVE-2026-40369: An unprivileged arbitrary 12-byte kernel write primitive exists in nt!ExpGetProcessInformation and can be reached from any context capable of calling NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderer processes. PoC and Writeup 👇

PoC: Writeup and Video Credit:

msrc patched this in may. fun detail: its own advisory calls it a heap overflow, while the CWE on the same page says untrusted pointer dereference.

Install the official Windows security update for CVE-2026-40369, as OpenCVE recommends.

A 12-byte write reachable from a sandboxed renderer is a full escape in waiting. Sandboxes filter what syscalls do, not which info classes NtQuerySystemInformation exposes. Patch Tuesday can't come fast enough for anyone running shared Windows hosts.

ProbeForWrite with Length=0 is a no-op. So NtQuerySystemInformation(253, kernelAddr, 0, ...) just increments whatever you point at. That is why renderer sandboxes are in scope.

#microsoft had released an #official and complete #fix in the #WindowsUpdate of may 12th 2026 for #CVE-2026-40369 in #windows11 and #server2025. Read more and the links to the updates:

A kernel write you can reach from inside a sandboxed browser renderer is exactly the second half of a drive-by chain. With a public PoC out, I'm confirming which cumulative update covers it and pushing it to workstations first, servers right after.