Windows Runtime CVE-2026-50449

Exploitation requires the attacker to already possess local, low-privilege authenticated code-execution on the target (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. No user interaction is required (UI:N). The chief limiting factor is high attack complexity (AC:H): the use-after-free depends on winning a race or achieving a specific heap/timing state the attacker does not fully control, so exploitation is not guaranteed on a single attempt. The affected Windows Runtime component is present by default across all listed Windows 10/11 and Windows Server builds, so no non-default configuration is needed once local access is obtained.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, high attack complexity, and low privileges required, but high impact across all three dimensions. The high attack complexity (AC:H) is significant: it signals that reliable exploitation depends on winning a race or grooming heap state the attacker does not fully control, which typically slows weaponization. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is not in CISA KEV and no POC is referenced, so this is a real but not emergency-tier issue: a locally-authenticated attacker (e.g., malware or a standard user seeking SYSTEM) is the realistic threat model, not remote mass exploitation. Because it is a memory-corruption EoP in a ubiquitous OS component, it is a strong candidate for chaining after initial access and should be patched in the normal-to-expedited cycle even without active-exploitation signals.

An attacker who already has a low-privileged foothold on a Windows host - for example via a phishing-delivered user-mode payload or a compromised standard account - invokes a vulnerable Windows Runtime code path and races to reuse a freed object, corrupting memory to escalate from the current user to SYSTEM. Given AC:H, the exploit likely needs multiple attempts to win the underlying race or heap-grooming condition, but success grants full control of the machine. No public POC is currently identified.