EUVD-2026-99096
GHSA-2xg9-3gfq-rcx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
ExploitRepeatedly trigger Windows Storage race condition
-
ExecutionExploit use-after-free memory corruption
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an existing local, low-privileged account or process (PR:L, AV:L) on the Windows host; no user interaction is needed (UI:N). The attacker must win a race condition (CWE-362, reflected in AC:H) in the Windows Storage component to trigger the use-after-free, which makes exploitation timing-dependent and unreliable rather than deterministic. The flaw affects default configurations of all listed supported Windows 10/11 and Windows Server (2019/2022/2025, including Server Core) builds below the patched versions, but the limiting factors are the need for a prior local foothold and the difficulty of reliably winning the race. |
| Impact | This is a genuine but moderate-priority local privilege-escalation issue rather than an urgent internet-facing threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) shows that an attacker must already have local access and at least low privileges (PR:L), and must overcome high attack complexity (AC:H) - consistent with CWE-362, a race condition that must be won to trigger the use-after-free. Once triggered, impact is total (C:H/I:H/A:H), matching the SSVC 'Technical Impact: total' rating. However, the mitigating signals dominate: SSVC reports 'Exploitation: none' and 'Automatable: no', there is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied in the input. The AC:H/race-condition nature makes reliable weaponization hard. Net: patch on a normal-but-timely cadence as a privilege-escalation fix, not an emergency. Note that no EPSS value was provided, so probabilistic exploitation likelihood could not be factored in. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) repeatedly exercises the affected Windows Storage code path to win a timing-dependent race condition, triggering a use-after-free. Successful exploitation corrupts memory to execute code at SYSTEM, completing a local privilege escalation. No public exploit identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
RemediationAI
Vendor-released patch: Microsoft has published fixed builds for every affected line, and the primary action is to apply the current cumulative security update so each host meets or exceeds the build thresholds in the advisory (Windows 11 23H2 -> 10.0.22631.7652, 24H2 -> 10.0.26100.9711, 25H2 -> 10.0.26200.9711, 26H1 -> 10.0.28000.3231, 26H2 -> 10.0.26300.9711; Windows Server 2025 -> 10.0.26100.33650; Windows Server 2022 -> 10.0.20348.5761; Windows Server 2019 and Windows 10 1809 -> 10.0.17763.9376; Windows 10 21H2 -> 10.0.19044.7807), using the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69766 to confirm the exact KB per build. Because the vector is local-only, there is no network-facing mitigation such as blocking a port or disabling a service; Windows Storage is core OS functionality, so disabling the storage stack is neither possible nor safe, and the honest trade-off is that mitigation must come from removing the PR:L foothold rather than from configuration hardening. Practical compensating controls, with their side effects: restrict interactive logon and RDP access on Terminal Server, VDI, AVD, Citrix, and jump hosts so untrusted users cannot obtain the low-privileged local session the exploit requires (this reduces exposure but does not help on endpoints where standard users must log in); enforce least privilege so standard users hold no local administrator rights and no rights over storage-management interfaces such as disk/volume management or storage driver installation (an operational change that can break legitimate admin tooling if applied too broadly); and deploy WDAC or AppLocker to block untrusted executables from running locally, which raises the bar for the attacker's own payload while requiring maintenance of allowlists. Prioritize the patch on multi-user and remote-session hosts, since a local privilege-escalation bug of this class is most valuable where many low-privileged sessions coexist, and treat patch latency as the main residual risk: SSVC records exploitation as none and automatable as no, so there is no confirmed active campaign, but the historical pattern for Windows LPE flaws is that exploit code appears after patch release and this becomes an n-day risk rather than a zero-day one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Windows Storage component, the user-mode and kernel-mode storage stack that handles volumes, disk and storage-class drivers, and the storage management interfaces exposed to local processes. Independent classification lists the root cause as CWE-362 (concurrent execution using a shared resource without proper synchronization), and Microsoft's description characterizes the resulting failure as a use-after-free, meaning a race between threads frees an object (typically a storage-related structure or driver context) while another thread still holds a reference to it, after which the attacker can reclaim the freed memory with controlled contents to redirect execution in a higher-privileged context. This matches the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: the race is winnable but timing-sensitive (AC:H), requires prior local code execution under a low-privileged token (AV:L/PR:L), needs no victim interaction (UI:N), and yields total technical impact within the same security scope. The vulnerability affects default configurations of the listed Windows 10, Windows 11, Windows Server 2019/2022/2025 builds, including Server Core installations, so there is no non-default component that must be enabled for exposure. The CWE-362/CWE-416 pairing is the important nuance: patching typically adds locking or reference-counting around the storage object, so exploits targeting the pre-patch build are version-specific to the exact build thresholds listed in the EUVD data.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only use-after-free (AV:L) needing a standard-user foothold (PR:L) and a hard-to-win race (AC:H); successful exploitation yields SYSTEM, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege-escalation flaw in the Windows Storage component affects the entire supported Windows 10, Windows 11, and Windows Server estate, meaning nearly every endpoint and server in the organization is in scope for the vendor update. If exploited, an attacker who already has a low-privileged account or process on a machine could gain high-integrity control of that host, opening the door to credential theft, defense evasion, and lateral movement. Leadership should care because the fix is available now and the residual risk grows over time, as local privilege-escalation bugs are routinely reverse-engineered into working exploits after patch publication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB