Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local authenticated attacker (AV:L/PR:L) with no user interaction and a reliable kernel UAF granting SYSTEM produces full C/I/A impact in an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 18:11 vuln.today
CVE Published
Jul 14, 2026 - 17:04 nvd
HIGH 7.8

DescriptionCVE.org

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Win32K (the kernel-mode GUI subsystem) allows an authenticated local user to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of supported builds spanning Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, including Server Core installations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain low-privileged local access
Delivery
Launch crafted process invoking Win32K syscalls
Exploit
Trigger use-after-free on freed kernel object
Execution
Corrupt kernel memory / hijack token
Impact
Elevate to SYSTEM privileges

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to already have authenticated local code-execution on the target (CVSS PR:L, AV:L): they must be able to run an arbitrary process as a standard/low-privileged user and invoke the vulnerable Win32K system-call path - there is no remote or network-facing exposure and no default-configuration remote risk. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8 (High): local attack vector, low complexity, low privileges required, no user interaction, and full high impact to confidentiality, integrity, and availability within an unchanged scope - the classic profile of a reliable local EoP that grants SYSTEM. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has already gained a low-privileged foothold - via phishing, a compromised service account, or a malicious insider - runs a crafted program that issues Win32K system calls to trigger the use-after-free, corrupting kernel memory to overwrite a process token or hijack execution and elevate to SYSTEM. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and no-user-interaction (UI:N) profile make a reliable local exploit plausible once code is developed.
Remediation Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54114 from the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54114, selecting the cumulative update / KB matching each affected Windows 10, Windows 11, or Windows Server build (the exact fixed build number is listed per SKU in that advisory; no standalone fix-version string was supplied in the input, so consult MSRC directly). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all Windows 10 (build 1809+), Windows 11, and Windows Server 2019-2025 systems to assess exposure and prioritize based on user access and data sensitivity. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-50489 HIGH POC
8.8 Jul 14

Local privilege escalation in the Windows Win32K kernel subsystem (CWE-122 heap-based buffer overflow) lets an already-a

CVE-2026-49795 HIGH POC
8.8 Jul 14

Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-54992 HIGH POC
8.4 Jul 14

Local code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and s

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50667 HIGH POC
7.8 Jul 14

Elevation of privilege in the Windows NTFS file-system driver lets an already-authenticated local user escalate to SYSTE

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56188 CRITICAL
9.8 Jul 14

Remote code execution in the Windows Server Network driver stems from a race condition (CWE-362) that lets an unauthoriz

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-54114 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy