EUVD-2026-73647
GHSA-66mx-v4gj-fpr3
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack (AV:L), heap exploitation demands precise grooming (AC:H), existing low-privileged local session required (PR:L); full C/I/A impact reflects SYSTEM-level escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in the Windows Display Enhancement Service (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a locally authenticated low-privileged attacker to gain elevated privileges through exploitation of a double-free memory corruption flaw (CWE-415). The vulnerability requires local access and high attack complexity, reflecting the precision required to reliably trigger and exploit heap corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an existing authenticated local session on the affected Windows 11 or Server 2025 system with at minimum low-privilege (standard user) rights - this is the PR:L precondition; (2) the Windows Display Enhancement Service must be running in its default configuration, which is standard on affected Windows 11 builds; (3) high attack complexity (AC:H) means a reliable exploit requires precise heap-state manipulation to overcome modern Windows heap hardening (Safe Unlinking, Segment Heap). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a realistic assessment: exploitation is local-only (AV:L), requires an existing authenticated session with low privileges (PR:L), and demands high attack complexity (AC:H) due to heap exploitation challenges on modern Windows. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released patches immediately via Windows Update or WSUS. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all Windows 11 24H2/25H2/26H1 and Windows Server 2025 systems to understand deployment scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today