Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CIRCL (temporal)
6.8 MEDIUM
cvss
vuln.today AI
7.8 HIGH

Local privilege escalation from an existing low-privileged session (AV:L, PR:L) with no user interaction; a successful use-after-free yields SYSTEM-level control, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 19:38 vuln.today
CVE Published
Jul 14, 2026 - 17:08 nvd
HIGH 7.8

DescriptionCVE.org

Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Clipboard Server (Cliprdr/RDP clipboard virtual channel service) affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through 11 26H1 and Server 2025). An authenticated local attacker who can trigger a use-after-free (CWE-416) in the service can corrupt memory to run code at elevated (SYSTEM-level) privilege. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.

Technical ContextAI

The affected component is the Windows Clipboard Server, the OS service that brokers clipboard data - including across Remote Desktop / Terminal Services sessions via the clipboard virtual channel (RDPDR/CLIPRDR). CWE-416 (Use After Free) means the service continues to reference a heap object after it has been freed, typically due to a race or a state-management bug in how clipboard data structures are allocated, referenced, and released. An attacker who controls the timing and content of subsequent allocations can reclaim the freed memory with attacker-controlled data, turning a dangling pointer dereference into controlled memory corruption and, ultimately, arbitrary code execution in the security context of the privileged clipboard service. The CPE set enumerates client SKUs (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2019, 2022, 2025, including Server Core installs).

RemediationAI

Apply the Microsoft security update for CVE-2026-50689 (Patch available per vendor advisory) - install the relevant monthly cumulative update for each affected SKU as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50689; exact fixed build numbers per Windows version are provided there. Because this is a local elevation-of-privilege bug in a core OS clipboard service, there is no supported feature-level disable, so patching is the definitive fix. As interim compensating controls where immediate patching is not possible, prioritize hardening multi-user and RDP-facing hosts: on Remote Desktop Session/Gateway hosts, disable clipboard redirection via Group Policy ('Do not allow Clipboard redirection' under Remote Desktop Services > Device and Resource Redirection), which reduces the remote attack surface into the clipboard channel at the cost of losing copy/paste between client and session; and tighten who can obtain interactive or low-privilege sessions on sensitive servers to shrink the pool of potential local attackers. These controls reduce exposure but do not remediate the underlying use-after-free, so the update remains required.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-49795 HIGH POC
8.8 Jul 14

Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

Share

CVE-2026-50689 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy