EUVD-2026-56736
GHSA-39wg-845w-6fc5
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack requiring low-privileged session and high-complexity memory conditions; full C/I/A reflects SYSTEM-level control upon successful exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
AnalysisAI
Use-after-free memory corruption in Windows Autopilot on Windows 11 (24H2 and 25H2) enables a locally authenticated, low-privileged user to escalate privileges, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack requires local access and high complexity (AV:L/AC:H/PR:L), meaning an attacker must meet specific memory state or race conditions - reducing opportunistic risk but not eliminating it for determined local threat actors. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Windows Autopilot is Microsoft's cloud-driven device provisioning and enrollment service, deeply integrated into the Windows 11 OS lifecycle and identity stack. The root cause is CWE-416 (Use After Free): a memory safety defect where the software continues to reference a memory region after it has been deallocated, allowing an attacker who can influence subsequent heap allocations to redirect code execution or corrupt program state. In a privileged OS component like Autopilot - which manages device identity, enrollment, and configuration - a successful use-after-free can provide a pathway to SYSTEM-level execution. The CVSS vector AV:L/AC:H confirms the flaw is only reachable locally and requires engineering of specific memory conditions. Affected builds are precisely bounded by EUVD-2026-56736: Windows 11 24H2 (build 10.0.26100.0 up to but not including 10.0.26100.9168) and Windows 11 25H2 (build 10.0.26200.0 up to but not including 10.0.26200.9168).
RemediationAI
Apply the vendor-released patch via Windows Update, WSUS, or Microsoft Intune, targeting build 10.0.26100.9168 or later for Windows 11 24H2, and build 10.0.26200.9168 or later for Windows 11 25H2. Full details are in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65781. As a compensating control where immediate patching is not feasible, restrict interactive local logon rights on Autopilot-enrolled devices to trusted administrative personnel only, since PR:L (low-privileged local session) is a hard prerequisite for exploitation - note this may disrupt legitimate end-user workflows and should be treated as a temporary measure paired with expedited patch deployment. Additionally, review Autopilot enrollment device scope and limit which endpoints are enrolled to reduce attack surface.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today