EUVD-2026-56341
GHSA-g8pf-vxfc-98mh
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low-privileged authenticated session required; AC:H reflects race condition; SYSTEM-level code execution yields full C/I/A with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Winlogon allows an authorized attacker to elevate privileges locally.
AnalysisAI
Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.
Technical ContextAI
Winlogon (winlogon.exe) is the Windows process responsible for handling the secure attention sequence (Ctrl+Alt+Del), user authentication transitions, and the secure desktop - it runs persistently at SYSTEM integrity level. A use-after-free (CWE-416) arises when Winlogon frees a heap-allocated object but retains a dangling pointer that is subsequently dereferenced; an attacker who can time or trigger the reallocation of that freed memory region with attacker-controlled content can redirect execution within a SYSTEM-privileged process. Tags also include Denial of Service, indicating the UAF can destabilize the authentication stack without achieving code execution. Affected CPE scope per EUVD spans Windows 10 builds 14393-19045, Windows 11 builds 22631-28000, and Windows Server builds 9200-26100, covering both full and Server Core installation modes.
RemediationAI
Apply Microsoft's released patches via Windows Update, WSUS, or Microsoft Update Catalog, targeting the minimum fixed builds identified in the affected products section - for example, Windows Server 2019 to build 10.0.17763.9115 or later, Windows 11 24H2 to 10.0.26100.9168 or later, and Windows Server 2025 to 10.0.26100.33296 or later. The full per-version build mapping is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61939. Where immediate patching is not possible, restrict interactive and remote interactive logon rights to the minimum necessary accounts via Group Policy (User Rights Assignment: 'Allow log on locally' and 'Allow log on through Remote Desktop Services'), which reduces the pool of PR:L users who could attempt exploitation - note this may impact legitimate administrative workflows and requires careful scoping. Enabling Virtualization-Based Security and Credential Guard on supported editions further hardens the authentication subsystem but does not eliminate the underlying flaw.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today