Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Local privilege escalation in the Windows Internal System User Profile component allows an already-authenticated attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free memory corruption condition (CWE-416). The flaw affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025 including Server Core. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.8 rating and full high impact on confidentiality, integrity, and availability make it a meaningful patch-cycle priority.

Affected VersionsENISA

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.8875
Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7548
Windows Server 2025 10.0.26100.0 <10.0.26100.33158
Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2269
Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33158
Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7548
Windows 11 Version 25H2 10.0.26200.0 <10.0.26200.8875

Affected Packages

microsoft windows_10_version_21h2_10_0_19044_7548 fix: Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.7548, Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.7548, Windows 10 Version 21H2 for x64-based Systems 10.0.19044.7548
microsoft windows_10_version_22h2_10_0_19045_7548 fix: Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.7548, Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.7548, Windows 10 Version 22H2 for x64-based Systems 10.0.19045.7548
microsoft windows_11_version_24h2_10_0_26100_8875 fix: Windows 11 Version 24H2 for ARM64-based Systems 10.0.26100.8875, Windows 11 Version 24H2 for x64-based Systems 10.0.26100.8875
microsoft windows_11_version_25h2_10_0_26200_8875 fix: Windows 11 Version 25H2 for ARM64-based Systems 10.0.26200.8875, Windows 11 Version 25H2 for x64-based Systems 10.0.26200.8875
microsoft windows_11_version_26h1_10_0_28000_2269 fix: Windows 11 version 26H1 for x64-based Systems 10.0.28000.2269
microsoft windows_11_version_26h1_10_0_28000_2525 fix: Windows 11 Version 26H1 for ARM64-based Systems 10.0.28000.2525
microsoft windows_server_2025_10_0_26100_33158 fix: Windows Server 2025 10.0.26100.33158, Windows Server 2025 (Server Core installation) 10.0.26100.33158
euvd windows_10_version_21h2 fix: 10.0.19044.7548
euvd windows_10_version_22h2 fix: 10.0.19045.7548
euvd windows_11_version_24h2 fix: 10.0.26100.8875
euvd windows_11_version_25h2 fix: 10.0.26200.8875
euvd windows_11_version_26h1 fix: 10.0.28000.2269
euvd windows_server_2025 fix: 10.0.26100.33158
euvd windows_server_2025_server_core_installation fix: 10.0.26100.33158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 14 packages in microsoft, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Windows Server 2025 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CIRCL (temporal) 6.8 MEDIUM

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.

Executive ViewAI

Why It Matters

CVE-2026-50425 is a local privilege escalation vulnerability in Windows 10, 11, and Server 2025 enabling unauthorized elevation to SYSTEM-level access. No public exploit identified at time of analysis, but the vulnerability affects millions of enterprise Windows endpoints and requires prompt patching to maintain confidentiality and integrity controls. A vendor patch is available for immediate deployment.

Recommended Action

Within 24 hours, inventory all Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025 systems across the organization and establish a patching timeline with infrastructure teams. Within 7 days, deploy the vendor-released patch in phases, prioritizing critical servers and systems handling sensitive data. Achieve full patch deployment across all affected enterprise systems, including Server Core, within 30 days and validate compliance through endpoint detection or asset management systems.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Vendor Action
See Below
Required. The vulnerability documented by this CVE requires customer action to resolve.
Vendor Status
Publicly Disclosed:No
Exploited:No
Latest Software Release:Exploitation Less Likely
Data Quality
5 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Windows Server 2025

View all
CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
CVE-2025-33073 HIGH POC
8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2025-21293 HIGH POC
8.8 Jan 14

Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
CVE-2025-30397 HIGH POC
7.5 May 13

Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the

CVE-2024-49039 HIGH POC
8.8 Nov 12

Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
CVE-2026-96951 HIGH POC
8.8 Oct 13

Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
CVE-2026-81963 HIGH POC
7.8 Sep 08

Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
CVE-2025-26633 HIGH POC
7.0 Mar 11

A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute

CVE-2026-68820 HIGH POC
7.0 Aug 11

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
PATCH https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50425 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-50425

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy