EUVD-2026-43765
GHSA-h4ff-8jr3-p6jp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged attacker runs code with no user interaction (AV:L/AC:L/PR:L/UI:N); a successful use-after-free yields SYSTEM control, so C/I/A are all High with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Storage component affects a broad range of Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). By exploiting a use-after-free memory-corruption flaw (CWE-416), an already-authenticated local attacker can elevate to SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.15%), and CISA SSVC records exploitation status as none.
Technical ContextAI
Windows Storage is a core operating-system subsystem responsible for storage-stack and volume management services present on every listed Windows edition. The root cause is a use-after-free (CWE-416): a memory object is freed while a reference to it remains in use, so a subsequent operation dereferences a dangling pointer. In a kernel or privileged-service context an attacker who can control the freed allocation's contents (heap grooming) can steer execution or corrupt privileged data structures. The CPE set confirms the affected code spans Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025, including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-58526 via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58526; a vendor-released patch is available and raises each affected build to at least the fixed version (for example Windows 11 24H2 to 10.0.26100.8875, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 to 10.0.26100.33158). There is no documented Microsoft workaround for this issue, so patching is the only reliable remediation. Where immediate patching is not possible, reduce risk by tightening who can run code on the host: enforce least privilege so untrusted or standard users cannot execute local binaries, apply application allow-listing (WDAC/AppLocker) to limit arbitrary local code, and prioritize multi-user, terminal-server, and shared workstation hosts where low-privilege local access is most common - accepting that these controls only shrink the attacker population and do not close the underlying use-after-free.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today