An anonymous researcher has published proof-of-concept (PoC) code for what they describe as an unpatched local privilege-escalation flaw in Windows 11, posting the writeup online just a day before Microsoft's August Patch Tuesday. If the claims hold, a standard user on a fully updated Windows 11 25H2 machine could use the bug to push code toward SYSTEM-level control — the highest privilege on the box.
The vulnerability, tagged CVE-2026-62737 by its finder, does not yet appear in Microsoft's advisory database or the National Vulnerability Database, and Microsoft has not confirmed it. The researcher says the PoC still fires on the latest Windows build and released a crash dump as evidence, while deliberately withholding the full exploit.
The flaw sits in ExecutionContext.sys, a genuine Microsoft-signed kernel driver that has shipped with Windows since at least 2021 and is documented as the "CPU Scheduler for High Performance I/O." It is a demand-start component that does not run by default.
According to the writeup, a loader/proxy path inside Windows' NDIS networking stack re-exposes this access-controlled device to low-privilege users, sidestepping the permissions (ACL) meant to keep them out. From there, the driver accepts a user-supplied function pointer and passes it to a kernel worker thread, which runs it after only checking that the address falls inside kernel memory.
It never verifies who supplied the pointer or whether it is legitimate enough, the researcher argues, to redirect kernel execution.
The disclosure fits a pattern that has defined 2026: researchers racing to drop kernel PoCs around each Patch Tuesday, which have swelled to record sizes, with Microsoft fixing more than 600 flaws in a single recent month.
This author frames the bug as an AI-assisted find, claiming large language models handled the tedious code-audit work that once took weeks. "After years of relative stability, the Patch Tuesday process has experienced significant turbulence," Rapid7's Adam Barnett said of the 2026 cadence.
On its own, the PoC only forces a blue-screen crash, not a working SYSTEM shell; a full exploit needs a separate kernel-address (KASLR) leak to line up. And while the targeted driver is genuine, the vulnerability itself is not yet confirmed — Microsoft has not acknowledged it, and no other researcher has reproduced the finding.
Defenders should watch tomorrow's Patch Tuesday release for a matching fix and deploy it fast, since privilege-escalation bugs are usually the second stage of a breach rather than the way in. Until Microsoft weighs in, limiting who can run untrusted code on shared and multi-user systems — and watching for unexplained crashes in the affected driver — remains the practical hedge.