EUVD-2026-44235
GHSA-54wx-vc69-4w38
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 20, 2026
Local privilege escalation in Microsoft XML Core Services (MSXML) lets an already-authenticated user on affected Windows 10, Windows 11, and Windows Server systems corrupt memory via a use-after-free (CWE-416) and run code at elevated privilege. The flaw was reported by Microsoft and is patched; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.25% (16th percentile) exploitation probability. Impact is total (high confidentiality, integrity, and availability) but requires prior local access.
Earlier versions of this analysis (1)
Local privilege escalation in Microsoft XML Core Services (MSXML) lets a low-privileged, authorized attacker on a Windows host reclaim a freed object (use-after-free, CWE-416) to run code at elevated privilege. It affects a broad Windows footprint spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, including Server Core installations. Microsoft reported the flaw, a patch is available, and there is no public exploit identified at time of analysis; CISA SSVC currently rates exploitation as none.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local use-after-free needing an existing low-priv foothold (AV:L/PR:L) and a hard-to-win heap race (AC:H), yielding full local compromise (C/I/A:H) without scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege escalation in Microsoft XML Core Services (MSXML) affects Windows 10, Windows 11, and Windows Server systems, enabling authenticated users to escalate privileges and run malicious code with system-level access; no public exploit identified at time of analysis. While exploitation risk is currently low, successful attack would grant complete control over affected systems, enabling data theft, malware installation, and operational disruption. Immediate patching across your Windows infrastructure is required.
Within 24 hours: Inventory all Windows 10, Windows 11, and Windows Server systems in your environment and assess which handle sensitive workloads or contain critical data; prioritize servers and endpoints with elevated privileges or administrative access. Within 7 days: Deploy the vendor-released patch to all affected systems beginning with high-criticality infrastructure, development environments, and systems handling sensitive data. Within 30 days: Verify patch compliance across 100% of the Windows infrastructure through patch management reporting, and monitor for exploitation attempts targeting this vulnerability (CWE-416 use-after-free patterns).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB