EUVD-2026-99946
GHSA-gvq2-vhm2-7mf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryTrigger use-after-free in firewall service
-
ExploitCorrupt freed object memory
-
ExecutionExecute code as SYSTEM
-
ImpactFull host privilege escalation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have authenticated, low-privileged local code execution on an affected Windows 11 (23H2/24H2/25H2/26H1/26H2) or Windows Server 2025 host (PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated user. No special non-default feature or configuration is named - the Windows Defender Firewall Service runs by default - so the primary limiting factor is the prerequisite local foothold. Exploitation is further bounded by affected build ranges below the patched versions (e.g., 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); fully patched systems are not vulnerable. |
| Impact | This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity privilege escalation requiring the attacker to already hold valid low-privileged credentials on the host (PR:L) - not a remotely reachable flaw. The use-after-free in CWE-416 class bugs typically yields code execution in the SYSTEM-level firewall service, consistent with the full C:H/I:H/A:H impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. Microsoft has published a patch. Net: a classic second-stage local EoP useful to an attacker who already has a foothold, worth patching in normal cycle on managed Windows fleets, but it is not a standalone remote-compromise threat. Note a tag/impact tension: the input Tags include 'Denial Of Service,' yet the description and CVSS describe privilege elevation with full confidentiality/integrity/availability impact - treat it as an EoP with incidental DoS potential rather than a pure DoS. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) triggers the use-after-free in the Windows Defender Firewall Service to corrupt memory and execute code in the service's privileged context, elevating to SYSTEM. Because AC:L and UI:N, exploitation is reliable and needs no victim interaction once local access exists. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Windows Defender Firewall Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host trigger a use-after-free condition and elevate to full SYSTEM privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). The vulnerability cannot be reached remotely or by an unauthenticated user, and exploitation is additionally bounded by the affected build ranges, so fully patched systems are not exposed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the independent assessment rates this as a credible but not emergency-level priority, making it a standard monthly-patch item rather than an out-of-band emergency.
RemediationAI
Vendor-released patch: apply the current Microsoft cumulative security update that brings each platform to or above its fixed build - Windows 11 23H2 to 10.0.22631.7652, 24H2 to 10.0.26100.9711, 25H2 to 10.0.26200.9711, 26H1 to 10.0.28000.3231, 26H2 to 10.0.26300.9711, and Windows Server 2025 (including Server Core) to 10.0.26100.33650 - distributed through Windows Update, WSUS, or the Microsoft Update Catalog as described in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83679. Because this is a local privilege-escalation primitive rather than a remote one, there is no port, service, or ACL that can be blocked to eliminate the exposure without disabling the firewall itself (which would broadly weaken host protection and is not recommended); the practical compensating controls are to treat local admin-equivalent code execution as already game-over on unpatched hosts, restrict interactive logon and RDP access to trusted accounts, and run EDR or Sysmon rules that alert on SYSTEM-token creation or unexpected child processes spawning from firewall service processes, accepting that these are detective rather than preventive and will not stop a determined attacker who already has a foothold. Prioritize patch deployment on multi-user, RDP-exposed, and server workloads where an unprivileged local account is a realistic starting point, and note that fully patched systems are not vulnerable, so patch verification via build-number inventory is the only reliable confirmation of remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in the Windows Defender Firewall Service, the built-in filtering engine (mpssvc) that runs with SYSTEM privileges and enforces host firewall policy, including filter, rule, and management interfaces. A freed heap object is referenced again after deallocation, so a local attacker who can reach the vulnerable code path can influence the contents of the reclaimed memory and turn the dangling reference into controlled memory corruption - potentially an arbitrary write or pointer redirection in a SYSTEM-level process. Successful corruption yields privilege elevation from low-integrity to SYSTEM; the associated Denial Of Service / Memory Corruption tags indicate the same defect can also crash the service or the host if the corrupted region is unstable. The flaw is purely local (AV:L) and requires an authenticated session (PR:L) with no user interaction (UI:N), so it is a post-compromise escalation primitive rather than an initial access vector, and the vulnerable component is enabled by default on all affected Windows builds, meaning no optional feature has to be present for the weakness to exist.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker needs an authenticated local foothold (AV:L, PR:L) but no user interaction or special complexity (AC:L, UI:N); the UAF in the SYSTEM firewall service yields full C/I/A impact within the same scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A locally exploitable privilege-escalation flaw in the Windows Defender Firewall Service affects Windows 11 (23H2 through 26H2) and Windows Server 2025, allowing an attacker who already holds a low-privileged account on a host to gain full SYSTEM control of that machine. Because a pre-existing foothold is required, this is not a remotely exploitable or worm-capable issue, but it materially raises the value of any phished credential, compromised service account, or insider position by converting limited access into complete host takeover. Leadership should treat it as a routine but mandatory patch item for endpoint and server fleets, with priority given to domain-joined servers and administrative workstations where SYSTEM access would enable lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB