EUVD-2026-43912
GHSA-jxj3-7969-pqhq
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local UAF EoP requiring a pre-existing low-privilege foothold (PR:L, AV:L) and winning a race/heap condition (AC:H), yielding full SYSTEM-level C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Runtime (WinRT) affects a broad range of supported Windows client and server releases, from Windows 10 1809 and Windows Server 2019 through Windows 11 26H1 and Windows Server 2025. An authorized local attacker who can execute low-privilege code can trigger a use-after-free (CWE-416) memory-corruption condition to elevate privileges, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch.
Technical ContextAI
The flaw lives in the Windows Runtime (WinRT), the modern component/object model that underpins Universal Windows Platform APIs and many in-box Windows services and apps. The root cause is CWE-416, a use-after-free: a memory object is freed while a reference to it remains live, allowing the freed allocation to be reused and its contents controlled before a dangling pointer is dereferenced. In a privilege-escalation context an attacker grooms the heap so the reused allocation contains attacker-influenced data, converting the dangling reference into control over execution or a security-relevant object, and thereby into elevated privileges. The CPE set indicates the affected code ships identically across Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025, consistent with a shared core OS component rather than an application-specific bug.
RemediationAI
Apply the Microsoft security update for CVE-2026-50449 (Patch available per vendor advisory); consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50449 for the exact patched build number matching each affected release, as Microsoft ships these as cumulative updates rather than a single named version. The exact fix version is not restated in this input, so pull it from the MSRC page for your specific OS build. Because the vulnerability requires local low-privilege code execution, effective compensating controls until patching include restricting the ability of untrusted users to run code on affected hosts, enforcing least-privilege on interactive and service accounts, and applying application allow-listing (e.g., WDAC/AppLocker) to reduce the chance an attacker lands the low-privilege foothold needed to trigger the bug; the trade-off is administrative overhead and potential disruption to legitimate line-of-business applications. There is no network-side mitigation because the attack vector is local.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today