Windows Runtime CVE-2026-50410

Exploitation requires the attacker to already have local, authenticated access with the ability to execute code at low privilege on the target (CVSS PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point, so it presumes a prior foothold. No user interaction is needed (UI:N). Exploitation is further limited by High attack complexity (AC:H): the use-after-free is a race/heap-grooming condition that is not deterministically triggerable, reducing reliability and favoring skilled or targeted attackers. The flaw is present in default configurations of every listed Windows client and server edition because WinRT is a core OS component, so no special feature toggle or non-default setting is required beyond the ability to run code locally.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Several signals temper the raw severity: the attack vector is Local (AV:L), so the attacker must already execute code on the host; attack complexity is High (AC:H), consistent with a use-after-free that typically requires winning a race or grooming the heap; and low privileges (PR:L) are required, meaning an existing foothold is a prerequisite. Against that, the impact triad is fully High (C:H/I:H/A:H), reflecting a realistic path to SYSTEM. No EPSS score and no SSVC decision data were supplied, so automatable/technical-impact framing cannot be quantified from the input. There is no KEV listing and no indication of a public POC, so this reads as a real but non-urgent priority - an important second-stage escalation primitive to patch on the normal Patch Tuesday cadence rather than an emergency. The AC:H rating in particular suggests exploitation is non-trivial and may favor targeted rather than commodity use.

An attacker who has already gained a low-privileged foothold - for example through a phishing payload, a compromised service account, or a standard user login on a shared server - runs a crafted program that repeatedly manipulates a WinRT object to trigger the use-after-free and groom the freed memory. By winning the timing race and controlling the reallocated allocation, the attacker corrupts privileged state and elevates to SYSTEM. No public POC is identified at time of analysis, and the High attack complexity means the exploit likely requires reliable heap-grooming to succeed.