EUVD-2026-22551
GHSA-8h4w-q329-j73w
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows COM across Windows 10 (1809, 21H2, 22H2), Windows 11 (22H3-26H1), and Windows Server (2019-2025) allows unauthenticated attackers with local access to achieve full system compromise (high confidentiality, integrity, and availability impact) by exploiting acceptance of untrusted data alongside trusted data. CVSS 8.4 reflects the severe impact of complete privilege escalation despite requiring local access. Vendor-released patch available with specific build n
Technical ContextAI
The vulnerability resides in the Windows Component Object Model (COM), a Microsoft binary-interface standard enabling inter-process communication and dynamic object creation across Windows systems. The flaw is classified as CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data), indicating the COM subsystem improperly validates or distinguishes between trusted and untrusted data sources during object instantiation or method invocation. This confusion allows attackers to inject malicious data that the system treats with elevated trust, bypassing authentication boundaries. Affected products span Windows 10 builds from 1809 (10.0.17763.0) through 22H2, Windows 11 from 22H3 through the upcoming 26H1 preview builds (10.0.28000.x), and Windows Server editions from 2019 (both standard and Server Core) through Server 2025. The broad CPE coverage reflects COM's foundational role in Windows architecture, making this a platform-wide issue affecting enterprise and consumer systems alike.
RemediationAI
Apply Microsoft-issued security updates immediately via Windows Update or WSUS to remediate this vulnerability. Fixed builds are Windows 10 1809/Server 2019 build 10.0.17763.8644 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2/Server 2025 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2022 build 10.0.20348.5020 or later, and Windows Server 2022 23H2 Server Core build 10.0.25398.2274 or later. Download patches directly from the Microsoft Update Catalog if automated deployment is unavailable. Organizations unable to patch immediately should restrict local logon access to trusted users only, disable unnecessary COM components via DCOM hardening policies (though Microsoft has not published component-specific mitigations for this CVE), and monitor for unusual COM object instantiation or privilege escalation events in Windows Security logs (Event IDs 4688, 4672, and
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today