Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation from an existing low-privileged session (AV:L, PR:L) with no user interaction; a successful use-after-free yields SYSTEM-level control, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Clipboard Server (Cliprdr/RDP clipboard virtual channel service) affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through 11 26H1 and Server 2025). An authenticated local attacker who can trigger a use-after-free (CWE-416) in the service can corrupt memory to run code at elevated (SYSTEM-level) privilege. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.
Technical ContextAI
The affected component is the Windows Clipboard Server, the OS service that brokers clipboard data - including across Remote Desktop / Terminal Services sessions via the clipboard virtual channel (RDPDR/CLIPRDR). CWE-416 (Use After Free) means the service continues to reference a heap object after it has been freed, typically due to a race or a state-management bug in how clipboard data structures are allocated, referenced, and released. An attacker who controls the timing and content of subsequent allocations can reclaim the freed memory with attacker-controlled data, turning a dangling pointer dereference into controlled memory corruption and, ultimately, arbitrary code execution in the security context of the privileged clipboard service. The CPE set enumerates client SKUs (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2019, 2022, 2025, including Server Core installs).
RemediationAI
Apply the Microsoft security update for CVE-2026-50689 (Patch available per vendor advisory) - install the relevant monthly cumulative update for each affected SKU as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50689; exact fixed build numbers per Windows version are provided there. Because this is a local elevation-of-privilege bug in a core OS clipboard service, there is no supported feature-level disable, so patching is the definitive fix. As interim compensating controls where immediate patching is not possible, prioritize hardening multi-user and RDP-facing hosts: on Remote Desktop Session/Gateway hosts, disable clipboard redirection via Group Policy ('Do not allow Clipboard redirection' under Remote Desktop Services > Device and Resource Redirection), which reduces the remote attack surface into the clipboard channel at the cost of losing copy/paste between client and session; and tighten who can obtain interactive or low-privilege sessions on sensitive servers to shrink the pool of potential local attackers. These controls reduce exposure but do not remediate the underlying use-after-free, so the update remains required.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-44145
GHSA-w9qp-349f-p25g