EUVD-2026-73560
GHSA-fm9c-392v-g882
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only UAF LPE requiring race condition (AC:H), low-privilege account (PR:L), yielding full system compromise within unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
AnalysisAI
Use-after-free in the Windows Image Acquisition (WIA) subsystem enables an authorized local attacker to escalate privileges on every supported Windows release, from Server 2012 to Windows 11 26H1. The CVSS vector (AV:L/AC:H/PR:L) places exploitation difficulty above average - a low-privileged user must trigger a race condition or specific memory-reuse timing within the WIA service - but a successful exploit yields full C:H/I:H/A:H impact, effectively granting SYSTEM-level control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing authenticated local session with at least low-privilege rights (PR:L); anonymous or unauthenticated remote exploitation is not possible per the AV:L/PR:L CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.0 is consistent with a local privilege escalation requiring complexity (AC:H): real-world exploitation is harder than a network-reachable, zero-complexity bug, but the potential payoff - full system compromise from a low-privileged foothold - makes this significant in multi-user, shared-infrastructure, or post-initial-compromise scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update distributed via Windows Update or WSUS targeting the specific fixed builds listed for each version branch (see affected_products for exact build thresholds). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Windows Server 2012+ and Windows 11 systems, then immediately deploy available Microsoft patches to eliminate the attack surface; within 7 days, verify patch deployment across the entire infrastructure using WSUS, SCCM, or equivalent tools and remediate any systems that missed the update; within 30 days, audit security logs for exploitation attempts and confirm 100% patch compliance.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today