EUVD-2026-43827
GHSA-68x7-6v3r-qfc7
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated attacker (AV:L/PR:L) must win a use-after-free race (AC:H), with full SYSTEM-level CIA impact and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Runtime (WinRT) on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated local user to gain higher privileges by exploiting a use-after-free memory-corruption flaw (CWE-416). Successful exploitation yields high confidentiality, integrity, and availability impact, effectively enabling escalation to SYSTEM-level control on the host. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the elevated attack complexity (AC:H) indicates exploitation requires winning a race or meeting specific timing/heap conditions.
Technical ContextAI
Windows Runtime (WinRT) is the modern application/component object model that underpins UWP and many in-box Windows apps and system services, exposing a broad API surface accessible to low-privileged code. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains, and subsequent reuse of that freed memory lets an attacker control object state or a function pointer, corrupting memory in a higher-privileged context. Per the CPE data the flaw affects Windows 11 version 24H2, 25H2 and 26H1 as well as Windows Server 2025 (including Server Core), consistent with a defect in a shared WinRT component present across current Windows client and server builds.
RemediationAI
Apply the vendor patch: Patch available per Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50323 - install the corresponding monthly cumulative update (KB) for your specific SKU (Windows 11 24H2/25H2/26H1 or Windows Server 2025, including Server Core) as listed in the MSRC update guide; an exact fix build number was not included in the input data and should be taken from that advisory. Because this is a local privilege-escalation flaw, the primary compensating control until patching is to limit who can run code on the host: restrict interactive and remote (RDP) logon rights to trusted administrators, remove untrusted local/standard user accounts from multi-user and terminal servers, and enforce application allow-listing (WDAC/AppLocker) to block untrusted binaries that would deliver the exploit - the trade-off is reduced flexibility for shared-host and developer workloads. There is no described feature toggle that disables the vulnerable WinRT path without impacting functionality, so patching is the only complete fix.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
MSHTML Framework contains a protection mechanism failure (CVE-2026-21513, CVSS 8.8) allowing remote attackers to bypass
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today