Windows Server 2016 EUVD-2026-22461

Local authenticated user account on Windows system with WFP NDIS Lightweight Filter Driver (wfplwfs.sys) loaded. Requires specific timing conditions to trigger the use-after-free vulnerability during filter driver operations.

Real-world risk assessment requires balancing multiple signals. The CVSS 7.0 (High) score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local attack vector requiring low privileges but high attack complexity, with potential for complete system compromise (confidentiality, integrity, availability all rated High). The AC:H (high complexity) substantially reduces exploitability compared to AC:L vulnerabilities, suggesting precise timing, race conditions, or specific system states may be required. The PR:L requirement means attackers need existing authenticated access, limiting exposure to insider threats, compromised accounts, or multi-stage attacks. No public exploit identified at time of analysis and no CISA KEV listing indicate this is not currently weaponized, despite affecting widely deployed Windows versions. The kernel-mode nature (wfplwfs.sys) and use-after-free class make reliable exploitation technically demanding but highly valuable to sophisticated adversaries seeking SYSTEM privileges. Patch availability from Microsoft across all affected versions (Windows 10 builds 14393.9060+, 17763.8644+, 19044.7184+, 19045.7184+; Windows 11 builds 22631.6936+, 26100.32690+, 26200.8246+, 28000.1836+; Server builds similarly patched) provides clear remediation path. Priority should be medium-high for enterprise environments with untrusted local users or systems processing untrusted content, but lower than remotely exploitable or actively exploited vulnerabilities.

An authenticated local user exploits a use-after-free vulnerability in wfplwfs.sys by triggering specific filter driver operations that cause kernel memory corruption. The attacker achieves privilege escalation to SYSTEM level, gaining complete system control.