Windows Runtime CVE-2026-50486

Exploitation requires the attacker to already have authenticated local access as a low-privileged user on the target host (CVSS PR:L, AV:L), from which they invoke the vulnerable Windows Runtime code path to trigger the use-after-free; no user interaction is required (UI:N) and attack complexity is low (AC:L). What limits exploitation: the attacker must first obtain local code execution on the machine - this cannot be triggered remotely over the network - and the target must be running one of the affected, unpatched builds (Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, or Windows Server 2025 including Server Core). No special non-default feature toggle is named in the description, so default installations of these OS versions are exposed once local access is achieved.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity attack requiring low privileges and no user interaction, yielding high confidentiality, integrity, and availability impact within an unchanged scope - a classic local EoP profile. No EPSS score was provided, and the CVE is not in CISA KEV, so there is no signal of active or probable near-term exploitation; likewise no POC was referenced, so the practical bar is 'requires local code execution as a normal user first.' The Microsoft-assigned severity aligns with 'Important' rather than 'Critical.' No conflicting signals are present, though the absence of EPSS and SSVC data means exploitation likelihood is inferred from the vector alone; UAF EoP bugs of this class are historically attractive for chaining after initial access, so it warrants timely but not emergency patching.

An attacker who already has a foothold as a standard (low-privilege) user on a Windows 11 or Server 2025 host - for example via phishing-delivered malware or a compromised service account - invokes the vulnerable Windows Runtime component to trigger the use-after-free, grooming the heap to control the freed object. Successful exploitation elevates the process to SYSTEM-level privileges, enabling full host compromise. No public POC or active exploitation was identified at time of analysis, so this remains a plausible post-access escalation path rather than an observed campaign.