EUVD-2026-99198
GHSA-7mj6-4xvg-2wgv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access
-
DeliveryInvoke Console Driver via crafted calls
-
ExploitTrigger use-after-free race
-
ExecutionReclaim freed kernel object
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated local access and the ability to execute code on the target Windows host (AV:L, PR:L) - there is no remote or unauthenticated path. The attacker must interact with the Windows Console Driver and win a use-after-free timing race (AC:H), which limits reliability and typically requires multiple attempts. No special non-default configuration is called out in the advisory: standard Windows installations with the Console Driver present are affected across the listed builds. The practical limiting factors are the need for a pre-existing local foothold and the race-condition complexity; risk is concentrated on shared, multi-user, or Remote Desktop/terminal-server systems where untrusted users can run code. |
| Impact | This is a moderate-priority local elevation-of-privilege flaw, not an urgent internet-facing emergency. The CVSS 3.1 base score of 7.0 reflects AV:L (local vector - the attacker must already be able to run code on the host), AC:H (high complexity, consistent with winning a use-after-free race condition in the Windows Console Driver), and PR:L (a low-privileged but authenticated local user). Impact is total (C:H/I:H/A:H), matching the SSVC 'Technical Impact: total' rating, because a successful UAF in a kernel-mode driver yields SYSTEM-level control. However, the exploitation signals argue against treating this as a drop-everything issue: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, no public POC was provided, and no EPSS score was supplied. The combination of AC:H plus a non-automatable local vector means reliable weaponization requires skill and a pre-existing foothold. In short, high technical impact but constrained real-world exploitability - prioritize patching on multi-user, shared, or terminal-server hosts where untrusted users can execute code, below any remotely exploitable or actively exploited items. |
| Exploit ScenarioDerived | A low-privileged user who already has interactive or code-execution access to a Windows host runs a crafted program that manipulates Console Driver object lifetimes to trigger a use-after-free, winning a timing race to reclaim the freed kernel object and corrupt memory. Successful exploitation elevates the attacker from a standard user to SYSTEM, enabling full host compromise. No public exploit identified at time of analysis; the high attack complexity (AC:H) reflects the race-condition reliability challenge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
RemediationAI
Vendor-released patch: Microsoft has published a security update that fixes the use-after-free, and the fixed build numbers are explicit per branch - Windows 10 1607/Server 2016 to 10.0.14393.9612, Windows 10 1809/Server 2019 to 10.0.17763.9376, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Windows Server 2012 to 6.2.9200.26434, Windows Server 2012 R2 to 6.3.9600.23470, Windows Server 2022 to 10.0.20348.5761, and Windows Server 2025 to 10.0.26100.33650. Deploy these updates through Windows Update, WSUS, or your configuration-management pipeline and verify the resulting OS build numbers against the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70223; Server Core installations should be patched with the same cumulative update as their full-UI counterparts. Because exploitation requires an attacker to already hold authenticated local code execution (PR:L) and to win a timing race (AC:H), there is no single switch that removes the exposure - but you can raise cost meaningfully by enforcing least privilege so that interactive users and service accounts never hold local administrative rights, blocking unapproved executables through WDAC or AppLocker so an attacker cannot stage a race trigger on the host, and confining untrusted code to containers, AppContainer-sandboxed processes, or separate VDI sessions that lack access to the host console subsystem. On shared, multi-user, and Remote Desktop/terminal-server hosts - where this risk concentrates - restrict who may log on interactively and monitor for repeated console-process crashes, since a failing race typically manifests as a console or system crash (the DoS symptom noted in the intelligence) before any successful escalation; enabling Credential Guard and Protected Process Light for LSASS does not prevent this bug but limits lateral credential theft after a successful EoP. There is no recommended way to disable the Windows Console Driver itself, as doing so would break command-line and PowerShell operation across the platform, so treat patching as the only complete remediation and the privilege-restriction and sandboxing measures as compensating controls that reduce - but do not eliminate - the attack surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the Windows Console Driver, the kernel-mode component that backs the console subsystem used by cmd.exe, PowerShell and legacy console applications. A use-after-free occurs when the driver frees a pool or object allocation - typically tied to console screen buffers, input records, or console handle state - without invalidating outstanding references, so a subsequent operation dereferences reclaimed memory. Because the freed block can be reallocated with attacker-influenced contents, a successful race can corrupt kernel-mode structures and pivot to elevated execution in a high-integrity security context. The CVSS vector (AV:L, AC:H, PR:L, UI:N, S:U, C:H/I:H/A:H) confirms this is not a remote or unauthenticated primitive: the attacker must already run code locally under a lower-privileged token and then repeatedly trigger console operations to hit the narrow reuse window, which is why AC is rated High despite the total (C:H/I:H/A:H) impact once the race is won. Scope is Unchanged, so the compromise stays within the same security authority rather than crossing a boundary such as a hypervisor. The bug class is a memory-safety defect in a kernel driver, consistent with the 'Memory Corruption' and 'Denial Of Service' tags in the source intelligence - a failed race is most likely to produce a crash/BSOD (the DoS symptom) rather than a controlled escalation, which is also why exploitation is assessed as not automatable.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user exploiting a kernel UAF race (AV:L, PR:L, AC:H) to gain SYSTEM, yielding full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation vulnerability in the Windows Console Driver (conhost) affects every supported Windows client and server branch, from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H2. An authenticated local attacker who already holds code execution on a host could win a use-after-free race to gain high-integrity code execution, resulting in full loss of confidentiality and integrity on that system. With no public exploit identified at time of analysis and exploitation requiring both a pre-existing local foothold and high attack complexity, this is a moderate-priority hardening item for the broad Windows estate rather than an internet-facing emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB