EUVD-2026-43987
GHSA-62c2-hmjm-mpm6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged attacker (AV:L/PR:L) triggers a kernel UAF with no user interaction (AC:L/UI:N), yielding SYSTEM-level control and full C/I/A impact within the same system (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel (Windows 11 version 26H1) lets an already-authenticated low-privileged user corrupt kernel memory through a use-after-free condition and gain SYSTEM-level control. Microsoft self-reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (High) score reflects full confidentiality, integrity, and availability compromise achievable entirely from a local, low-privilege foothold with no user interaction.
Technical ContextAI
The vulnerability is a CWE-416 use-after-free in the Windows NT kernel, the trusted core (ring 0) component that mediates process scheduling, memory management, and object handling for all user-mode code. A use-after-free occurs when kernel code continues to reference an object after its backing memory has been freed; an attacker who can reallocate that freed slot with controlled data can steer kernel execution or overwrite privileged structures (e.g., process tokens), yielding arbitrary kernel read/write and ultimately SYSTEM privileges. The CPE data pins the affected surface to cpe:2.3:a:microsoft:windows_11_version_26h1, and the vendor tags (Use After Free, Memory Corruption, Denial of Service) indicate the same freed-object flaw can also crash the kernel (bugcheck/DoS) if exploitation is unreliable.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-49173 via Windows Update or your patch-management system to all Windows 11 version 26H1 systems; the exact KB/build should be taken from the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49173 (no standalone fix version string was provided in the input, so confirm the KB there before deployment). Because exploitation requires a local low-privileged foothold, effective compensating controls until patching completes include enforcing least privilege and application allow-listing (e.g., Windows Defender Application Control/AppLocker) to limit which code low-privileged users can run, restricting interactive and remote-desktop logon rights on high-value hosts, and enabling attack-surface-reduction and kernel-mode hardening (HVCI/VBS) which raises the difficulty of turning the UAF into reliable SYSTEM execution - noting HVCI can affect performance and older driver compatibility. These controls reduce but do not eliminate the risk; patching is the only complete fix.
More in Windows 11 Version 26H1
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Desktop Window Manager (DWM) component of Windows 11 version 26H1 allows an authentica
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today