Skip to content
Threat Feed
high advisory

CVE-2026-34341: Windows LLDP Double Free Privilege Escalation

CVE-2026-34341 is a double free vulnerability in the Windows Link-Layer Discovery Protocol (LLDP) that allows an authorized attacker to elevate privileges locally with a CVSS v3.1 score of 7.0.

CVE-2026-34341 is a double free vulnerability residing in the Windows Link-Layer Discovery Protocol (LLDP). Successful exploitation of this vulnerability allows an authenticated attacker with local access to elevate their privileges on the targeted system. The vulnerability was published on May 12, 2026, and has a CVSS v3.1 score of 7.0, indicating a high severity. This vulnerability allows a local attacker to gain higher privileges, potentially leading to complete system compromise. Defenders should prioritize patching systems to prevent exploitation.

Attack Chain

  1. Attacker gains initial local access to a Windows system.
  2. Attacker crafts a malicious LLDP packet or triggers a specific sequence of LLDP operations.
  3. The crafted packet or operations cause the LLDP service to allocate and subsequently free a memory region.
  4. A separate part of the attacker-controlled process causes the same memory region to be freed a second time.
  5. This double free corrupts the heap metadata.
  6. The heap corruption leads to a controlled write primitive.
  7. The attacker uses the controlled write to overwrite critical system structures.
  8. The attacker leverages the memory corruption to achieve arbitrary code execution and escalate privileges to SYSTEM.

Impact

Successful exploitation of CVE-2026-34341 allows a local attacker to elevate their privileges on the targeted Windows system. This could lead to complete system compromise, including data theft, malware installation, or disruption of services. The scope is limited to local access, but the impact is significant given the potential for full system control.

Recommendation

Detection coverage 2

Detect CVE-2026-34341 Exploitation Attempt - Suspicious LLDP Packet Generation

high

Detects CVE-2026-34341 exploitation attempt — monitors for processes generating suspicious LLDP packets indicating a double free attempt.

sigma tactics: defense_evasion, privilege_escalation techniques: T1068 sources: process_creation, windows

Detect CVE-2026-34341 Potential Exploitation - LLDP Service Abnormal Termination

medium

Detects CVE-2026-34341 exploitation attempt — abnormal termination of the LLDP service potentially caused by a double free condition.

sigma tactics: privilege_escalation techniques: T1068 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →