EUVD-2026-56619
GHSA-w8g9-p62g-p2fg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and a low-privileged account are required to trigger the UAF in appinfo; successful exploitation yields SYSTEM-level code execution, justifying C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Application Information Services allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.
Technical ContextAI
Application Information Services (appinfo.dll, hosted in the appinfo service) is the core Windows component that brokers User Account Control (UAC) elevation requests between standard user sessions and the Windows kernel. CWE-416 (Use After Free) describes a class of memory safety flaw where a memory object is freed but a dangling pointer to the same region persists and is later dereferenced - allowing an attacker to plant controlled data in the freed region and redirect code execution or corrupt internal data structures before the stale pointer is used. Because appinfo runs with elevated privileges and processes input from standard user processes, a successful UAF exploit in this service can escalate the attacker's execution context to NT AUTHORITY\SYSTEM. The ENISA EUVD data (EUVD-2026-56619) pins affected build ranges precisely: Windows 11 26H1 below 10.0.28000.2704, Windows 11 24H2/25H2 below 10.0.26100.9168 and 10.0.26200.9168 respectively, and Windows Server 2025 (including Server Core) below 10.0.26100.33296. Vulnerability reported through the Microsoft Security Response Center (secure@microsoft.com).
RemediationAI
Apply the Microsoft-released security update to reach the following fixed builds: Windows 11 26H1 to 10.0.28000.2704 or later, Windows 11 24H2 to 10.0.26100.9168 or later, Windows 11 25H2 to 10.0.26200.9168 or later, and Windows Server 2025 (standard and Server Core) to 10.0.26100.33296 or later, as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61357. Patch deployment via Windows Update, WSUS, or Microsoft Endpoint Configuration Manager is the only confirmed remediation. If immediate patching is not feasible, restrict local interactive logon and Remote Desktop access for untrusted or low-privileged user accounts on affected systems - this limits exploitation to users who already have a physical or RDP session, reducing but not eliminating risk. Restricting UAC elevation behavior via Group Policy (e.g., requiring administrator approval for all elevation requests) may raise the bar slightly but does not address the underlying memory safety flaw in appinfo. Note that a failed exploit attempt may crash the appinfo service, disrupting UAC prompts system-wide until the service restarts - monitor for unexpected appinfo terminations as a potential indicator of exploitation attempts.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today