What is the CVSS score of CVE-2026-27909?

CVE-2026-27909 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-27909?

A local privilege escalation vulnerability in Microsoft Windows Search Component (CVE-2026-27909) allows low-privileged authenticated users to gain SYSTEM-level access on Windows 10, Windows 11, and…. A patch is available.

How to fix or mitigate CVE-2026-27909?

Within 24 hours: Inventory all Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server (2012-2025) systems in your environment. Within 7 days: Apply vendor-released patches to all identified systems, prioritizing servers and privileged workstations. Within 30 days: Complete patch deployment across all remaining affected systems and verify compliance through your patch management system.

Microsoft CVE-2026-27909

EUVD-2026-22447 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

GHSA-jmgc-3mxg-m5mr

Denial Of Service Use After Free Memory Corruption Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:28 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22447

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Search Component affects Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2012-2025) via use-after-free memory corruption (CWE-416). Authenticated local attackers with low privileges can exploit this vulnerability to gain SYSTEM-level access with low attack complexity and no user interaction required (CVSS 7.8). Vendor-released patches available for all affected versions; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Windows Search Component (searchindexer.exe and associated COM objects), a core Windows service responsible for file indexing and search functionality. The use-after-free condition (CWE-416) occurs when the component attempts to access memory after it has been freed, typically during object lifecycle management or reference counting errors. This memory corruption flaw allows controlled manipulation of freed memory regions, enabling attackers to redirect execution flow. The Windows Search service runs with elevated SYSTEM privileges, making it an attractive target for local privilege escalation. The vulnerability affects a broad surface area spanning legacy Windows 10 builds (1607 from 2016) through current Windows 11 26H1 and Windows Server 2025 deployments, indicating the flaw exists in long-standing shared code components across multiple Windows generations.

RemediationAI

Apply vendor-released security updates immediately through Windows Update or WSUS deployment channels. For Windows 10 1607, update to build 10.0.14393.9060 or later; Windows 10 1809 to 10.0.17763.8644; Windows 10 21H2 to 10.0.19044.7184; Windows 10 22H2 to 10.0.19045.7184. Windows 11 systems require updates to 10.0.22631.6936 (22H3/23H2), 10.0.26100.32690 (24H2), 10.0.26200.8246 (25H2), or 10.0.28000.1836 (26H1). Windows Server 2012 requires build 6.2.9200.26026, Server 2012 R2 requires 6.3.9600.23132, Server 2016 requires 10.0.14393.9060, Server 2019 requires 10.0.17763.8644, Server 2022 requires 10.0.20348.5020, Server 2022 23H2 requires 10.0.25398.2274, and Server 2025 requires 10.0.26100.32690. Download patches from Microsoft Update Catalog or reference the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27909. No effective workarounds exist; patching is the only complete mitigation. Prioritize domain controllers, privileged access workstations, and internet-facing servers in deployment sequencing.