EUVD-2026-73072
GHSA-f27q-fxjw-mjqg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local access with a low-privileged account suffices; scope change to a higher-privileged Windows security context justifies S:C and full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged local Windows account (PR:L per CVSS) and local access to an affected Windows 11 system (AV:L) - interactive logon or an existing low-privilege session both qualify. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is driven by S:C (security boundary crossing) plus full C:H/I:H/A:H impact in the elevated context, with only PR:L required and no user interaction needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft cumulative security update for the installed Windows 11 feature release: build 10.0.22631.7582 or later for 23H2, 10.0.26100.9445 or later for 24H2, 10.0.26200.9445 or later for 25H2, and 10.0.28000.2954 or later for 26H1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Windows 11 systems across the affected feature releases (23H2, 24H2, 25H2, 26H1) using your endpoint management platform and document current patch levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today