Windows Autopilot EUVD-2026-56736

Exploitation requires a locally authenticated session with at minimum low-privileged (standard user) rights - the description explicitly states 'authorized attacker,' and the CVSS PR:L metric confirms authentication is mandatory; unauthenticated or remote exploitation is not possible (AV:L). High Attack Complexity (AC:H) further limits exploitation: the attacker must achieve specific memory layout conditions or timing windows not fully under their control, making exploitation non-trivial and not reliably repeatable. No user interaction from a third party is required (UI:N). Scope is unchanged (S:U), meaning impact is confined to the vulnerable Windows 11 system. Exploitation is therefore limited to threat actors with physical or RDP/interactive access to an affected endpoint running an unpatched Windows 11 24H2 or 25H2 build, who can tolerate the reliability constraints of a high-complexity memory corruption exploit.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H characterizes a local privilege escalation requiring meaningful attacker effort. The High Attack Complexity (AC:H) is the primary limiting factor: exploitation is not repeatable on demand and requires the attacker to engineer specific heap layout or race conditions. The attacker must also already hold a low-privileged local session (PR:L), ruling out remote or unauthenticated exploitation entirely. Despite these constraints, successful exploitation yields complete system compromise (C:H/I:H/A:H), making it high-value for any attacker already positioned on the endpoint. The tags include Denial of Service alongside privilege escalation, suggesting the use-after-free may also be triggerable for crash/DoS at lower difficulty than full exploitation. No EPSS data was provided in the input, so exploitation probability cannot be quantified. This CVE is not in the CISA KEV catalog based on available data. Overall priority is medium-high for enterprises with untrusted local users on Autopilot-enrolled Windows 11 24H2 or 25H2 endpoints; AC:H meaningfully suppresses real-world exploitation rate compared to simpler LPE chains.

A low-privileged user logged into a Windows 11 24H2 or 25H2 endpoint triggers a specific sequence of API calls or provisioning operations against the Windows Autopilot service, inducing a use-after-free condition. The attacker then performs heap grooming or exploits a race condition (AC:H) to place controlled data in the freed memory region, redirecting execution to attacker-controlled code and escalating from a standard user session to SYSTEM privileges. No public exploit code has been identified at time of analysis, but use-after-free primitives in Windows components are a well-documented target for heap-spray and race-based exploitation techniques.