EUVD-2026-44056
GHSA-948w-pp9c-f274
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only use-after-free EoP needing an existing low-privileged foothold (AV:L, PR:L), easily triggered with no user interaction (AC:L, UI:N), yielding full SYSTEM compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server allows an authenticated attacker to run arbitrary code with elevated (SYSTEM-level) privileges by triggering a use-after-free memory-corruption condition (CWE-416). Microsoft has released a patch, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 score of 7.8 (High) with a fully local vector reflects meaningful post-compromise impact but requires the attacker to already have a foothold on the host.
Technical ContextAI
The affected component is the Windows Runtime (WinRT), the object-oriented API layer introduced with Windows 8 and used pervasively by modern Windows and UWP/Store applications to broker access to system capabilities. The root cause is CWE-416 (Use After Free): a memory region is freed while a dangling reference to it is retained, and subsequent use of that reference lets an attacker reclaim the freed allocation with attacker-controlled data, corrupting object state or function pointers. Because WinRT brokers run within or across privilege boundaries, controlled corruption of a freed object can be steered into arbitrary code execution in a higher-privileged context. The CPE data confirms the defect spans the OS runtime across Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019 and 2025 (including Server Core installations).
RemediationAI
Apply the Microsoft security update for CVE-2026-50457 for your specific Windows or Windows Server build; the fix is distributed through the standard monthly cumulative update, and exact patched build numbers are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50457 (Patch available per vendor advisory). Because the vulnerability is a local elevation-of-privilege issue with no documented configuration-based workaround, patching is the only reliable remediation; there is no feature toggle to safely disable WinRT. Until the update is deployed, reduce exposure by tightening who can obtain code execution on the host - restrict interactive and remote-desktop logon rights on multi-user and server systems, enforce least-privilege on service and user accounts, and prioritize patching terminal servers and shared workstations where untrusted users can run code, with the trade-off that these controls constrain legitimate operations without truly fixing the flaw.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today