Windows Autopilot CVE-2026-65783

Exploitation requires an authorized user with low-privilege local access to the affected Windows 11 system (PR:L, AV:L confirmed by CVSS vector). The high attack complexity (AC:H) indicates that exploitation is not straightforward - the attacker must achieve a specific memory state or win a race condition inherent to UAF exploitation in the Autopilot component, meaning reliable exploitation requires skill or tooling. No user interaction is required once the attacker has local access. Limiting factors: exploitation is constrained to local sessions only (no network path), requires Windows 11 24H2 or 25H2 specifically, and the high complexity makes opportunistic mass exploitation unlikely. Denial-of-service (crash) is a realistic outcome of failed exploitation attempts, which may be detectable. No specific non-default configuration requirement is documented beyond OS version eligibility.

The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a genuine but access-constrained risk: exploitation requires existing low-privilege local access and high attack complexity, substantially limiting the attack surface compared to network-exploitable vulnerabilities. The AC:H metric is consistent with UAF race conditions, which require precise timing or memory state manipulation and are non-trivial to weaponize reliably. No EPSS score was provided in the input data, and this CVE does not appear in the CISA KEV catalog, suggesting no confirmed in-the-wild exploitation at time of analysis. The tags include 'Denial of Service,' indicating that failed exploitation attempts may crash the affected component rather than achieve privilege escalation, which is a realistic outcome for complex UAF bugs. Real-world priority: meaningful for post-compromise scenarios (lateral movement, persistence escalation) and insider threat use cases, but not an immediate mass-exploitation risk given the local-only attack vector.

An attacker who has already obtained a low-privileged local session on a Windows 11 24H2 or 25H2 device - via phishing, credential theft, or physical access - triggers the use-after-free condition in the Windows Autopilot component by inducing a specific sequence of allocations and frees while racing to place attacker-controlled data in the vacated memory. If the heap grooming succeeds, the attacker gains SYSTEM-level code execution, enabling full control over the device including credential dumping, disabling security tooling, or establishing persistence. No public proof-of-concept has been identified at time of analysis, which increases the current exploitation complexity beyond the already-high AC:H baseline.