EUVD-2026-44085
GHSA-pfwp-6ww7-h9wr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel EoP from a low-privileged foothold with no user interaction; use-after-free yields SYSTEM, giving full confidentiality, integrity, and availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated low-privileged user exploit a use-after-free (CWE-416) memory corruption flaw to elevate to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server builds. Reported by Microsoft and rated CVSS 7.8, it is not currently in CISA KEV and has no public exploit identified at time of analysis; the EPSS score is low at 0.26% (17th percentile). A vendor patch is available via the MSRC update guide.
Technical ContextAI
The defect resides in the Windows Kernel (the core ntoskrnl/kernel-mode execution layer that manages memory, scheduling, and object handling for the entire OS). CWE-416 Use After Free means kernel code continues to reference a memory object after it has been freed, so an attacker who can influence allocation/free timing and re-occupy the freed slot can corrupt kernel memory and hijack execution flow. Because the kernel runs at the highest privilege ring, a successful UAF exploit typically yields arbitrary code execution or a controlled write in kernel context, translating directly to SYSTEM-level privileges. The CPE set spans Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core), indicating the vulnerable code path is present in the shared modern Windows kernel base rather than a single edition-specific component.
RemediationAI
Apply the Microsoft security update that raises each affected edition to its fixed build or later: Windows 10 21H2 to 10.0.19044.7548, Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2 to 10.0.26100.8875, Windows 11 25H2 to 10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 (including Server Core) to 10.0.26100.33158, all obtained via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50459. Because exploitation requires a local low-privileged foothold, the most effective compensating control until patching is to minimize who can run code as a standard user on the host: restrict interactive and remote-desktop logon rights on shared or multi-user systems, remove unnecessary local accounts, and enforce application allowlisting (e.g., WDAC/AppLocker) to make it harder for an attacker to land the initial user-context code needed to trigger the kernel UAF - noting that allowlisting adds administrative overhead and can block legitimate tooling. There is no network-facing setting to disable, so patching remains the definitive fix.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today