EUVD-2026-56594
GHSA-52xj-xx8j-p5vw
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only UAF requiring precise heap timing (AC:H); low-privilege local account needed (PR:L); full system compromise possible post-exploitation (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Autopilot on Windows 11 (versions 24H2 and 25H2) allows a low-privileged authenticated local attacker to achieve full system compromise through a use-after-free memory corruption flaw (CWE-416). The CVSS vector (AV:L/AC:H/PR:L) confirms local access with elevated complexity - consistent with a race condition or specific heap state requirement inherent to UAF exploitation. Microsoft has released patches at builds 10.0.26100.9168 and 10.0.26200.9168; no public exploit or CISA KEV active exploitation listing has been identified at time of analysis.
Technical ContextAI
Windows Autopilot is Microsoft's cloud-based zero-touch device provisioning and enrollment service, deeply integrated into Windows 11 and managed through Microsoft Intune and Azure AD. CWE-416 (Use After Free) describes a memory safety vulnerability where a program continues to reference memory after it has been deallocated - an attacker can manipulate the contents of the freed memory region (heap grooming) to redirect execution flow or corrupt privileged data structures. In a Windows kernel or privileged service context, UAF exploitation typically involves timing a free-and-reallocate sequence to place attacker-controlled data in the vacated memory before it is dereferenced, ultimately allowing code execution at an elevated privilege level such as SYSTEM. The affected CPE scope covers Windows 11 24H2 (10.0.26100.x) and 25H2 (10.0.26200.x) based on EUVD data.
RemediationAI
Apply the vendor-released patch from Microsoft: update Windows 11 24H2 systems to build 10.0.26100.9168 or later, and Windows 11 25H2 systems to build 10.0.26200.9168 or later, via Windows Update or Microsoft Update Catalog as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65783. For environments where patching is temporarily delayed, restrict local interactive and remote desktop access to only explicitly authorized users on affected systems, reducing the pool of potential attackers who meet the PR:L prerequisite. Monitoring endpoint detection platforms for anomalous privilege escalation events (e.g., unexpected SYSTEM-level process spawning from Autopilot-related binaries) can serve as a compensating detective control. Note: restricting local logon access may impact legitimate IT administration workflows; coordinate with endpoint management teams before applying logon restrictions in managed environments.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today