EUVD-2026-56377
GHSA-vwj8-mr8p-vjfq
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only trigger with PR:L for authorized attacker; AC:H reflects double-free race/state complexity; full C/I/A for successful local privilege escalation to SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation via a double-free memory corruption flaw in the Windows Kerberos implementation affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A low-privileged local attacker can exploit the CWE-415 double-free condition to achieve arbitrary code execution at an elevated privilege level, effectively gaining full control over confidentiality, integrity, and availability of the affected system. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity, limiting immediate widespread risk; a vendor-released patch is available via Microsoft's Security Response Center.
Technical ContextAI
Windows Kerberos is Microsoft's implementation of the Kerberos v5 authentication protocol, deeply integrated into Windows authentication subsystems and used for domain authentication on both client and server systems. CWE-415 (Double Free) describes a memory management error where a heap-allocated buffer is passed to free() more than once. In the Kerberos implementation, a code path apparently frees a memory region and then, under specific conditions (race condition, malformed ticket, or error-handling path), frees the same pointer again. This corrupts the heap allocator's internal metadata, which can be leveraged by a skilled attacker to achieve controlled writes and ultimately arbitrary code execution. The CVSS vector AV:L/AC:H confirms the flaw is locally triggered and requires precise timing or environmental conditions, consistent with a race-condition or specific state-dependent double-free. Affected CPEs are drawn from EUVD data covering Windows 11 build ranges and Windows Server 2025.
RemediationAI
The primary remediation is to apply Microsoft's released patch, which brings affected systems to the fixed build thresholds: Windows Server 2025 to 10.0.26100.33296 or later, Windows 11 24H2 and Server 2025 to 10.0.26100.9168 or later, Windows 11 25H2 to 10.0.26200.9168 or later, and Windows 11 26H1 to 10.0.28000.2704 or later. The patch is available through Windows Update and the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62766. Because exploitation requires local, low-privileged access with high complexity, compensating controls for systems where immediate patching is not possible include restricting interactive logon rights to the minimum necessary set of accounts via Group Policy, enforcing Credential Guard to harden Kerberos credential handling, and auditing local account membership on affected hosts to reduce the attacker's access surface. These mitigations reduce exposure but do not eliminate the vulnerability; patching remains the only confirmed fix.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today