Windows Runtime CVE-2026-50457

Exploitation requires the attacker to already possess local, authenticated access with at least low privileges on the target (CVSS PR:L, AV:L) and the ability to execute code that reaches the vulnerable Windows Runtime code path; no user interaction is needed (UI:N) and attack complexity is low (AC:L). What limits exploitation is the mandatory local foothold: the flaw cannot be triggered remotely or by an unauthenticated party, so it functions as a second-stage escalation after an initial compromise. The description names no non-default feature or configuration prerequisite, so any supported Windows 10/11 or Windows Server 2019/2025 build running the standard WinRT stack is exposed once local code execution is achieved.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) describes a locally exploitable flaw with low attack complexity, requiring low existing privileges and no user interaction, yielding high confidentiality, integrity, and availability impact within an unchanged scope. This is a classic local elevation-of-privilege profile rather than a remotely wormable bug: the AV:L constraint means an attacker must already be able to execute code on the target. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation-probability and automatability signals are unknown; the absence of KEV and any known public exploit suggests this is not a mass-exploitation priority today. That said, use-after-free EoP flaws in core Windows components are a well-trodden path for local attackers and are historically reliable to weaponize, so it should be prioritized in normal Patch-Tuesday cycles, especially on multi-user and terminal-server hosts. No signals conflict; the primary uncertainty is the lack of EPSS/exploit-maturity data.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload or a compromised standard user account - invokes the vulnerable Windows Runtime code path to trigger the use-after-free, grooms the heap to reclaim the freed object, and hijacks execution to run code as SYSTEM. No user interaction is required, and no public exploit is identified at time of analysis, so successful exploitation depends on the attacker developing or acquiring a working technique.