EUVD-2026-22612
GHSA-3hp2-fjxj-6wj4
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Server Update Service (WSUS) on Windows 11 version 26H1 allows low-privileged authenticated users to gain SYSTEM-level access via use-after-free memory corruption. Exploitation requires local access and high attack complexity (CVSS AC:H), indicating timing-dependent or race condition triggers. Microsoft has released patch version 10.0.28000.1836 to address this vulnerability. No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
This vulnerability stems from a use-after-free (CWE-416) condition in the Windows Server Update Service component. Use-after-free vulnerabilities occur when code attempts to access memory after it has been freed, potentially allowing an attacker to manipulate memory allocation to execute arbitrary code or escalate privileges. The affected product per CPE data is Windows 11 version 26H1 (microsoft:windows_11_version_26h1), specifically builds prior to 10.0.28000.1836. WSUS is a critical Windows component responsible for managing and distributing operating system updates across enterprise networks. The high attack complexity (AC:H) in the CVSS vector suggests the exploit requires precise timing or winning a race condition, making reliable exploitation more difficult than standard memory corruption issues. The local attack vector (AV:L) restricts exploitation to users with existing system access.
RemediationAI
Apply Microsoft's security update to upgrade Windows 11 version 26H1 to build 10.0.28000.1836 or later, which addresses the use-after-free vulnerability in WSUS. The patch is available through standard Windows Update channels and Microsoft Update Catalog. Organizations should prioritize patching systems where multiple users have local access or where account compromise risk is elevated. Download the update directly from Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32224. No workarounds are documented in available advisories; patching is the definitive remediation. Verify patch deployment by checking system build number (winver.exe) confirms version 10.0.28000.1836 or higher. In environments where immediate patching is not feasible, implement compensating controls including enhanced monitoring of privilege escalation attempts, restricted local logon permissions, and application control policies to limit execution of unsigned binaries.
More in Windows 11 Version 26H1
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Desktop Window Manager (DWM) component of Windows 11 version 26H1 allows an authentica
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today