Executive brief
A security vulnerability has been identified in the Windows Least-privileged User Account Virtualization (LUAFV) component, which helps maintain application compatibility for older software. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive data, install malicious software, or disrupt business operations.
Technical details
This vulnerability is a race condition (CWE-362) leading to a use-after-free (CWE-416) condition within the Windows LUAFV (Least-privileged User Account Virtualization) driver. The flaw stems from improper synchronization during concurrent execution when accessing shared resources. An attacker with local access and low privileges can exploit this timing issue to execute code in a higher-privileged context, effectively achieving local privilege escalation (LPE). The attack requires the attacker to win a race condition, making the exploit complexity high, but it does not require user interaction. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 Version 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Version 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All versions including Server Core
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory