EUVD-2026-43947
GHSA-qwj3-r4r6-v2cr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local use-after-free EoP needs an existing low-privileged account (PR:L) and no interaction (UI:N); successful privilege elevation yields full C/I/A impact on the host.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets a locally authenticated attacker elevate to higher privileges. Per the CVSS vector an already-authorized low-privileged user (PR:L) can execute the attack without user interaction, gaining full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as none, though a vendor patch is available from Microsoft.
Technical ContextAI
Windows Runtime (WinRT) is the object-oriented API layer built into modern Windows that brokers calls between user-mode applications and lower-level OS components, and it runs with elevated trust for many system operations. The root cause is CWE-416 (Use After Free): an object is freed while a reference to it remains in use, so subsequent access operates on reclaimed or attacker-controlled memory, enabling arbitrary code execution or corruption in the context of the component. Because WinRT is a core inbox component, the flaw is present across the affected Windows 11 24H2/25H2/26H1 and Windows Server 2025 builds identified in the Microsoft CPE data (cpe:2.3:a:microsoft:windows_11_version_24h2 through windows_server_2025). The tags also note Denial Of Service as a possible outcome of the same memory-corruption condition.
RemediationAI
Vendor-released patch: install the Microsoft cumulative update that raises builds to at least 10.0.26100.8875 (Windows 11 24H2), 10.0.26200.8875 (25H2), 10.0.28000.2269 (26H1), or 10.0.26100.33158 (Windows Server 2025 and Server Core), as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50413. There is no documented configuration workaround because Windows Runtime is a non-removable inbox component, so patching is the only reliable fix; until the update is deployed, reduce exposure by limiting who holds interactive/local logon rights on affected hosts (the attack requires an existing low-privileged local account), enforcing least privilege and application allow-listing to hinder an attacker from running the exploit binary, and prioritizing servers and multi-user/RDP hosts where untrusted local sessions are most likely. These controls narrow opportunity but do not eliminate the flaw, so they are stopgaps pending the update.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today