EUVD-2026-43974
GHSA-cxcw-4f63-5835
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with an existing low-privileged account (AV:L/PR:L), race-condition use-after-free raises complexity (AC:H), and successful elevation yields full C/I/A in an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows App Installer (the AppX/MSIX deployment component) lets a low-privileged but authenticated user corrupt memory via a use-after-free (CWE-416) and gain higher privileges on the host. The flaw affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, was reported by Microsoft, and has a vendor patch available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold a valid low-privileged local account on the target (PR:L) and to interact locally with the Windows App Installer component (AV:L) that processes MSIX/AppX package operations - there is no network vector and no user interaction is required (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.0, High) describes a local (AV:L), high-complexity (AC:H) attack requiring an existing low-privileged account (PR:L) with no user interaction, yielding full confidentiality, integrity and availability impact within an unchanged scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained an ordinary, low-privileged foothold on a Windows 11 or Server 2025 machine (for example via phishing or stolen credentials) invokes App Installer package operations and wins a memory-reuse race to trigger the use-after-free, corrupting heap state in a privileged context to execute code or write with elevated rights. Success is not guaranteed on each attempt because of the high attack complexity (AC:H) inherent to the race condition, and no public exploit is currently identified. |
| Remediation | Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48571 for the affected Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2025 builds; the MSRC update guide lists the exact fixed KB and build numbers per release, which were not provided in this dataset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025 instances and identify those where low-privilege users have interactive access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows 11 Version 23H2
View allRemote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary c
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Se
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged u
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Ser
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer o
Local privilege escalation in the Windows Push Notifications component (WPN) affects Windows 11 (23H2, 24H2, 25H2, 26H1)
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated att
Local code execution in Microsoft Windows NTFS driver allows an authenticated attacker to run arbitrary code by triggeri
Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privilege
Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client a
Local privilege escalation in Windows App Installer (App Installer / MSIX handler) on Windows 11 (23H2 through 26H1) and
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today