EUVD-2026-43854
GHSA-h5g9-xf42-5xc8
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only post-foothold EoP so AV:L/PR:L; race-condition use-after-free gives AC:H; full kernel compromise yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Secure Kernel Mode (VBS/Isolated User Mode trust boundary) affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local attacker gain elevated privileges. Microsoft rates it 7.0 (High) with a local, high-complexity vector requiring low privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation would require winning a memory-corruption race after already having a foothold.
Technical ContextAI
Secure Kernel Mode is the trusted component of Windows Virtualization-Based Security (VBS): it runs at a higher virtual trust level (VTL1) than the normal NT kernel and enforces protections such as Credential Guard, HVCI, and Isolated User Mode. A CWE-416 use-after-free in this component means a kernel object is freed while a stale reference remains reachable; reallocating that memory with attacker-controlled contents and then triggering the dangling reference can corrupt secure-kernel state. Because the flaw sits in the security-enforcing layer itself, successful exploitation undermines the very isolation VBS is meant to guarantee. The affected CPE set (windows_11_version_24h2/25h2/26h1, windows_server_2025 including Server Core) indicates the defect is in shared modern-Windows secure-kernel code rather than a single edition.
RemediationAI
Apply the Microsoft security update for CVE-2026-50392 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50392 (Patch available per vendor advisory); the MSRC update guide lists the exact patched build number for each affected edition - deploy the current cumulative update for your Windows 11 24H2/25H2/26H1 or Windows Server 2025 branch. No standalone workaround is published, which is expected for a secure-kernel memory-corruption bug that only a code fix can close. As compensating controls until patching, restrict and monitor local/interactive logon rights so fewer accounts can run code on affected hosts (limits the PR:L prerequisite), enforce least privilege and application allowlisting to reduce the ability of low-privileged code to trigger the vulnerable path, and prioritize patching on multi-tenant, RDP-exposed, and server hosts where untrusted local code is more likely; note these controls reduce opportunity but do not remove the flaw.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today