Permissions, Privileges, and Access Controls in Microsoft Windows and Windows Server - #VU131349
Published: May 13, 2026
Vulnerability identifier: #VU131349
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error in Windows CTFMON. A local unprivileged user can create an arbitrary memory section object in any directory object, writable by SYSTEM, and execute arbitrary code with SYSTEM privileges.
The vulnerability was dubbed GreenPlasma by its researcher.
Affected software
Microsoft Windows
Windows Server
Windows Server
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.