Executive brief
A security vulnerability has been identified in the Windows Backup Engine, a core component responsible for system and data recovery. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive files, install malicious software, or disrupt business operations.
Technical details
A use-after-free vulnerability (CWE-416) exists in the Windows Backup Engine. The flaw is triggered when the engine incorrectly manages memory objects during backup operations, allowing a locally authenticated attacker with low privileges to execute code in a higher-privileged context. Exploitation requires the attacker to win a race condition or navigate complex timing (High Attack Complexity). Successful exploitation results in a complete loss of confidentiality, integrity, and availability as the attacker achieves SYSTEM-level privileges. Microsoft has released security updates to address this issue across affected Windows 10 and 11 versions.
Affected products
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory