EUVD-2026-44136
GHSA-445v-887f-xx48
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated attacker (AV:L/PR:L) exploiting a timing-dependent kernel UAF (AC:H) that crosses into kernel scope (S:C) yielding full SYSTEM impact (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of Windows client and server builds - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - and was reported by Microsoft with a patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Technical ContextAI
The vulnerability resides in the Windows NT kernel (ntoskrnl), the privileged core that mediates memory management, scheduling, and object handling for all user-mode processes. CWE-416 (Use After Free) means kernel code continues to reference an object after its backing memory has been freed, allowing an attacker who can reallocate that memory with controlled data to corrupt kernel state. The provided CPE set confirms the affected surface spans Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - indicating the vulnerable code path is long-lived and present across many kernel versions. The scope-changed CVSS metric (S:C) reflects that a successful exploit crosses the user/kernel trust boundary to compromise the entire OS security authority.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50688 via Windows Update or WSUS/Intune, selecting the correct cumulative update for each affected Windows 10/11 and Windows Server build (consult the MSRC update guide for exact KB and build numbers, as no single fix version applies across all SKUs). Because exploitation requires local low-privileged access, effective compensating controls until patching completes include restricting interactive and remote-desktop logon rights to trusted administrators, removing untrusted standard users from shared/terminal-server hosts, and enforcing application allowlisting (e.g. Windows Defender Application Control) to hinder delivery of the exploit binary - the trade-off being reduced usability on multi-user systems and administrative overhead to maintain allowlists. These controls reduce the attacker's ability to run the initial low-privilege code but do not remove the underlying kernel flaw.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today