EUVD-2026-43901
GHSA-7g84-83gr-hw7p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity use-after-free requiring an existing low-privileged account (PR:L), no user interaction, yielding full code execution and thus high C/I/A with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Windows Runtime (WinRT) lets an authenticated attacker who can reach an affected host over the network exploit a use-after-free memory corruption to gain higher privileges, with total confidentiality, integrity, and availability impact per CVSS 8.8. Affected platforms include Windows 11 (24H2, 25H2, 26H1), Windows Server 2025, and its Server Core installation. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.48%, 38th percentile), but the technical impact is rated total and a vendor patch is available.
Technical ContextAI
Windows Runtime (WinRT) is the object-oriented API surface and component model underpinning modern Windows applications, exposing system services to both in-box and third-party apps. The root cause is CWE-416 (Use After Free): the code frees a memory object but retains and later dereferences a dangling pointer, allowing an attacker to reoccupy that freed allocation with controlled data and hijack the resulting operation. In this case the flaw sits in a WinRT component shipped across the Windows 11 24H2/25H2/26H1 client lines and Windows Server 2025 (including Server Core), per the Microsoft CPE list, and successful control of the freed object yields code execution at elevated privilege.
RemediationAI
Apply the Microsoft security update via Windows Update or WSUS to reach at least the fixed builds: 10.0.26100.8875 for Windows 11 24H2, 10.0.26200.8875 for Windows 11 25H2, 10.0.28000.2269 for Windows 11 26H1, and 10.0.26100.33158 for Windows Server 2025 and Server Core (Patch available per vendor advisory; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50340 for the exact KB per platform). No official standalone workaround is published for this WinRT flaw, which is typical for in-box component fixes; as compensating controls until patching, restrict and monitor which accounts can authenticate to and run code on affected hosts (since exploitation requires PR:L), enforce least privilege to limit the value of an escalation, and use network segmentation and EDR to detect anomalous local privilege-escalation behavior. The trade-off of these controls is that they reduce but do not eliminate exposure - only the update removes the underlying use-after-free.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today