Windows EUVD-2026-44299

Exploitation requires the attacker to already have local, authenticated access to the target as a low-privileged user (CVSS PR:L, AV:L) - it is not remotely reachable and needs an existing foothold. No user interaction is required (UI:N). The main limiting factor is the high attack complexity (AC:H): the use-after-free is a race/timing-dependent condition, so the attacker must reliably free and then reallocate the target heap object within a narrow window, making exploitation non-deterministic. Affected deployments are default installations of Windows 11 version 24H2/25H2/26H1 and Windows Server 2025 (including Server Core); no special non-default feature toggle is named in the description, so any unpatched instance running Windows Management Services is potentially exploitable by a local user.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - local vector, high attack complexity, and low privileges required, yielding full C/I/A impact within an unchanged scope. The high attack complexity is consistent with a use-after-free that must win a race or groom the heap deterministically, which lowers exploit reliability compared to a trivial bug. No EPSS score was provided, it is not in CISA KEV, and no public proof-of-concept was supplied, so all real-world exploitation signals point to no confirmed or probable exploitation at this time. This is a credible local privilege-escalation issue worth patching on a normal cycle rather than as an emergency, though its presence in the ubiquitous Windows codebase raises aggregate exposure. Because the attacker must already hold an authenticated low-privileged session (PR:L, AV:L), this is a post-compromise escalation primitive, not an initial-access vulnerability.

An attacker who has already gained a low-privileged authenticated session on a Windows 11 or Windows Server 2025 host - for example via a compromised service account or a prior malware foothold - runs a crafted local program that triggers the use-after-free in Windows Management Services while racing to reallocate the freed object with attacker-controlled data. Winning the race lets them corrupt privileged memory and execute code at a higher integrity level, escalating from limited user toward SYSTEM. No public proof-of-concept is available, and the high attack complexity (AC:H) means the exploit may require multiple attempts to succeed.