EUVD-2026-73118
GHSA-59pm-xcc3-83xf
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel UAF requiring race condition exploitation (AC:H, PR:L); full system compromise post-exploitation but no scope change beyond the host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session on the target system with at least a standard (low-privileged) user account - confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the realistic exploitation posture: local access with a standard user account is required, and the high attack complexity constrains opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update distributed via Windows Update or the Microsoft Update Catalog, targeting the fixed build numbers: 10.0.28000.2954 for Windows 11 26H1, 10.0.22631.7582 for Windows 11 23H2, 10.0.26200.9445 for Windows 11 25H2, 10.0.26100.9445 for Windows 11 24H2, and 10.0.26100.33438 for Windows Server 2025 (including Server Core). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, use Windows Update or your patch management system to identify all Windows 11 and Windows Server 2025 systems currently deployed in your environment and categorize by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today