Windows Kernel CVE-2026-40369 — NtQuerySystemInformation ProbeForWrite Bypass Enables Arbitrary Kernel Memory Increment → SYSTEM LPE from Browser Sandboxes (Ori Nimron) — Threadlinqs Intelligence
As of 2026-05-30, Windows Kernel CVE-2026-40369 — NtQuerySystemInformation ProbeForWrite Bypass Enables Arbitrary Kernel Memory Increment → SYSTEM LPE from Browser Sandboxes (Ori Nimron) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0604 · Severity: CRITICAL · CVSS: 7.8 · Status: MONITORING · Category: VULNERABILITY
CVE-2026-40369 is a critical Windows kernel untrusted-pointer-dereference vulnerability (CWE-822) in ntoskrnl.exe's ExpGetProcessInformation, reachable via NtQuerySystemInformation information class
## Overview
CVE-2026-40369 is an untrusted pointer dereference (CWE-822) in the Windows kernel's ExpGetProcessInformation routine inside ntoskrnl.exe. The vulnerability is reachable through NtQuerySystemInformation when called with SystemInformationClass=253 (SystemProcessInformationExtension) and SystemInformationLength=0. Under this specific input shape, the kernel skips its ProbeForWrite validation on the SystemInformation OUT parameter and proceeds to dereference the user-supplied pointer as a write target. Because the operation performed inside the vulnerable code path is an interlocked add/increment against a counter field, the attacker obtains a deterministic, race-free, single-syscall arbitrary-kernel-memory-increment primitive.
The issue was reported by security researcher Ori Nimron and addressed by Microsoft in the May 2026 Patch Tuesday cumulative updates (build floors: 24H2 10.0.26100.8390, 25H2 10.0.26200.8390, 26H1 10.0.28000.2113, Server 2025 10.0.26100.32772). Microsoft assigned a CVSS v3.1 base score of 7.8 (Local/Low complexity/Low privileges/No UI/High C-I-A); Threadlinqs Intelligence rates the threat CRITICAL because the syscall is not subject to Win32k lockdown, integrity-level checks, or browser sandbox policy restrictions, meaning a content-process compromise in any major browser can pivot directly through this primitive into a full kernel compromise without additional friction.
## Root Cause
Inside `ExpGetProcessInformation`, the SystemProcessInformationExtension (class 253) handler dispatches based on the caller-supplied `SystemInformationLength`. The intended invariant is that any non-NULL `SystemInformation` pointer must be validated with `ProbeForWrite(SystemInformation, Length, Alignment)` before any write occurs. The defective branch, however, is taken when `Length == 0`: the code skips ProbeForWrite (because the length is zero and the developer assumed no write would occur) but still performs an `InterlockedIncrement` (or equivalent atomic add) against a fixed offset inside the buffer to update an internal counter / version field. The increment is executed at `SystemInformation + offset` against the raw user pointer, which the kernel never validated. By choosing `SystemInformation` to point at any kernel virtual address, the attacker forces a 4-byte (DWORD) increment to that target.
The primitive is exceptionally clean: it is single-syscall, deterministic on every Windows build between Windows 11 24H2 RTM and 25H2 (prior to the May 2026 patch), requires no race window, no heap manipulation, no spray, no information leak prerequisite, and does not depend on any sensitive APIs that browser sandboxes block. The only constraints are (a) the write is an addition, not an arbitrary write, and (b) the offset is fixed by the SystemProcessInformationExtension layout.
## Exploitation Chain
1. **Initial Trigger.** The attacker (running in a low-privilege or sandboxed context such as a Chromium renderer) constructs a call: `NtQuerySystemInformation(0xFD /*SystemProcessInformationExtension*/, TargetKernelAddress, 0, &ReturnLength)` and obtains a +4-byte increment at `TargetKernelAddress + KnownOffset`.
2. **Bootstrapping Arbitrary Read via CmpLayerVersions.** Ori Nimron's chain corrupts the registry configuration manager's `CmpLayerVersions` table — a globally referenced kernel structure whose entries include length/pointer fields the kernel later treats as trustworthy when servicing registry layer queries. By incrementing the high bits of an entry's pointer field byte-by-byte, the attacker redirects subsequent reads through `NtQueryKey`-class APIs (or related registry hive APIs) to user-controlled memory, transforming the increment primitive into an arbitrary kernel read primitive.
3. **EPROCESS Walk & KASLR Defeat.** With arbitrary read, the attacker locates the kernel base, walks `PsActiveProcessHead` to enumerate the EPROCESS list, and identifies the System (PID 4) process and the attacker's own
Target sectors: government, financial, healthcare, technology, defense, manufacturing, education, energy, telecommunications, retail
Target regions: Global, North America, Europe, Asia-Pacific, Middle East, Latin America, Africa
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-40369, T1189, T1106, T1203, T1068, T1134.001, T1134.002, T1134.004, T1211, T1134, T1055