EUVD-2026-44016
GHSA-p9pr-jc27-p43x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated attacker (AV:L/PR:L) with no user interaction and a reliable kernel UAF granting SYSTEM produces full C/I/A impact in an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) allows an authenticated local user to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of supported builds spanning Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, including Server Core installations. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
Win32K (win32k.sys / win32kbase.sys / win32kfull.sys) is the kernel-mode component of the Windows graphics and windowing subsystem, handling window management, GDI objects, and user-mode-to-kernel transitions via system calls. It has historically been a rich source of local privilege-escalation bugs because it manages complex kernel object lifecycles across the user/kernel boundary. The root cause here is CWE-416 (use-after-free): a kernel object is freed while a dangling reference remains, and subsequent access to that stale reference lets an attacker corrupt kernel memory. Per the CPE data the flaw spans Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019/2022/2025 including Server Core, consistent with shared Win32K code across the Windows kernel family.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54114 from the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54114, selecting the cumulative update / KB matching each affected Windows 10, Windows 11, or Windows Server build (the exact fixed build number is listed per SKU in that advisory; no standalone fix-version string was supplied in the input, so consult MSRC directly). Because this is a kernel-mode Win32K flaw with no configuration-based toggle, there is no clean workaround short of patching; compensating controls until the update is deployed include restricting untrusted users' ability to execute arbitrary code via application allow-listing (WDAC/AppLocker), tightening interactive and RDP logon rights on shared servers to limit who can obtain a local foothold, and enabling kernel exploit-mitigation and EDR detections for anomalous Win32K activity - none of these fully prevent exploitation and each carries operational overhead, so they are stopgaps rather than substitutes for the update.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today