EUVD-2026-43836
GHSA-h5jv-76rr-555v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local low-privileged attacker exploits a kernel use-after-free with no user interaction (AV:L/PR:L/AC:L/UI:N); high integrity and availability impact, no confidentiality or scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Kernel lets an already-authenticated, low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and gain higher privileges on the host. The flaw affects a broad range of currently-supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025); Microsoft has shipped a fix. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerable component is the Windows Kernel (ntoskrnl / kernel-mode subsystem), the most privileged code on the platform, running in ring 0. The root cause is CWE-416, a use-after-free: kernel code continues to reference an object after its backing memory has been freed, allowing an attacker who can control the reallocation of that freed memory to manipulate kernel data structures. Successful manipulation lets attacker-controlled data be treated as a valid kernel object, which is the classic primitive for kernel-mode privilege escalation. The CPE data enumerates affected products purely as Microsoft Windows editions (client 10/11 and Server 2016-2025), indicating a defect in shared kernel code common to all supported branches rather than an edition-specific feature.
RemediationAI
Apply the Microsoft security update that addresses CVE-2026-50354 for each affected Windows edition; Patch available per vendor advisory - the input confirms a patch is available but does not specify an exact KB or build number, so consult the Microsoft update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50354 for the correct cumulative update per OS version and install it through Windows Update or WSUS/SCCM. Because exploitation requires an existing local low-privileged foothold, effective compensating controls until patching completes are to enforce least privilege and restrict interactive/local logon rights to trusted users, limit code execution by standard users (application allow-listing such as WDAC/AppLocker), and monitor endpoints for unexpected kernel crashes or privilege changes; these reduce the pool of accounts that could stage the attack but do not remove the underlying flaw and may impose administrative overhead on legitimate software.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today