EUVD-2026-99631
GHSA-5mp7-hj75-qrgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryInvoke crafted AppX deployment operation
-
ExploitTrigger use-after-free race in AppXSvc
-
ExecutionReuse freed object to hijack execution
-
ImpactElevate privileges to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local authenticated access to the host - any low-privileged interactive or logged-on user qualifies (PR:L, AV:L, UI:N) - and the attacker must trigger and win a use-after-free race condition inside the AppX Deployment Service (AppXSvc), reflected in the high attack complexity (AC:H). The AppX Deployment Service is a default-enabled component on supported Windows client and server builds, so no special non-default configuration is needed to reach the vulnerable code. Primary limiting factors are the local-only vector (no remote/network exploitation) and the reliability challenge of exploiting a memory-corruption race, which may require multiple attempts; there is no network exposure and no path to pre-authentication exploitation. |
| Impact | This is a locally-exploitable use-after-free (CWE-416) in the Windows AppX Deployment Service (AppXSvc) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are largely consistent and point to a real-but-not-urgent priority. Positive-risk signals: the technical impact is total (confirmed C:H/I:H/A:H and SSVC 'Technical Impact: total'), meaning successful exploitation yields full SYSTEM compromise, and PR:L means any authenticated low-privileged user can attempt it. Risk-dampening signals dominate, however: the attack vector is local only (AV:L - no remote reach), attack complexity is high (AC:H, typical of a UAF race condition that must be won reliably), SSVC marks Exploitation as 'none' and Automatable as 'no', and there is no KEV listing and no public POC in the provided data. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified. Net: a credible local privilege-escalation primitive useful as a post-compromise step, but not a remotely-wormable, mass-exploitable issue. Patch-promptly-but-not-emergency for most environments; prioritize on multi-user/shared Windows hosts where untrusted local users exist. |
| Exploit ScenarioDerived | An attacker who already has low-privileged authenticated access to a Windows host (e.g., via a standard user account or an initial foothold) triggers an AppX deployment operation that drives the AppX Deployment Service into a use-after-free, then wins the race to reuse the freed object and hijack execution. Because complexity is high (AC:H), the attacker may need multiple attempts to reliably trigger the race, after which they execute code in the SYSTEM-level service context. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) on supported Windows 10, Windows 11 and Windows Server builds allows a low-privileged, locally logged-on user (PR:L, AV:L, UI:N) to win a use-after-free race inside the service and execute code in a higher-privileged service context. The issue is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with high attack complexity reflecting the difficulty of reliably triggering and winning the memory-reuse race, and CISA's SSVC assessment records no exploitation, no automatable path and no public exploit identified at time of analysis. Because AppXSvc is default-enabled and the vector is strictly local, residual risk is concentrated on unpatched multi-user, shared or kiosk Windows hosts where any interactive account could repeatedly attempt the race; vendor patches are available and materially reduce that risk.
RemediationAI
Vendor-released patches are available: apply the Microsoft security update for CVE-2026-85934 from the MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85934), which raises each affected branch to at least the fixed build noted in the affected-version data - 10.0.17763.9376 for Windows 10 1809 / Server 2019, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.28000.3231 for Windows 11 26H1, 10.0.26300.9711 for Windows 11 26H2, 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025 (including Server Core). Patch status is 'Patch available per vendor advisory'; no upstream PR/commit-only fix applies here, so the MSRC update is the authoritative remediation and should be rolled out on the normal monthly cadence, prioritising multi-user, RDP-accessible and shared/kiosk hosts where an attacker can plausibly hold an interactive session. Because the vector is local-only (AV:L), network segmentation, edge filtering and remote exploitation controls offer no benefit; the effective attack-surface reduction is to limit who can log on interactively to affected machines and to monitor for repeated AppXSvc crashes or anomalies that could indicate race attempts. If immediate patching is impossible, disabling the AppX Deployment Service (setting the AppXSvc service start value to disabled via registry or Group Policy) removes the vulnerable code path, but the trade-off is significant: MSIX/AppX package installation, updates, staging, removal and provisioning - including Microsoft Store app servicing and many enterprise line-of-business package deployments - will fail or degrade, and the service may be re-enabled by servicing operations, so this should be treated as a temporary stopgap rather than a substitute for the vendor fix. No public exploit code or in-the-wild exploitation is identified in the available intelligence, so remediation can proceed on a risk-prioritised schedule rather than as an emergency, with unpatched, multi-user hosts patched first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in AppXSvc, the Windows AppX Deployment Service that stages, registers and services MSIX/AppX package operations on behalf of the operating system. In a use-after-free, a memory object associated with package deployment bookkeeping (such as a deployment or registration context) is released while a reference to it is still held; a concurrently timed operation then dereferences the stale pointer, giving the attacker control over memory contents in a process that normally runs with elevated service privileges. The result is memory corruption that can be steered toward code execution in the service context, which is why the impact triad is rated high (C:H/I:H/A:H) while the attack vector stays local (AV:L) and complexity high (AC:H): the attacker must race two operations and win consistently, and there is no network or pre-authentication path. This is a local authenticated scenario per the assessed vector (PR:L, UI:N) - any low-privileged interactive or logged-on user qualifies - and the affected component is enabled by default on the listed Windows client and server SKUs, so no non-default configuration is required to reach the vulnerable code. Input tags (Use After Free, Memory Corruption, Denial Of Service) are consistent with the CWE-416 root cause class; CISA's SSVC rates technical impact as total while exploitation is none and automatable is no, indicating a high-consequence but currently unexploited local flaw.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only UAF race (AV:L, AC:H) exploitable by any authenticated low-priv user (PR:L) with no interaction, yielding full SYSTEM impact (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation vulnerability in the default-enabled Windows AppX Deployment Service (AppXSvc) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an authenticated local user to execute code in a higher-privileged service context. The risk is most acute on unpatched multi-user, shared, or kiosk systems where multiple interactive accounts could repeatedly attempt the race, though no public exploit identified at time of analysis. Leadership should prioritize patching these high-exposure hosts to prevent potential privilege escalation and lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB