Executive brief
A security vulnerability has been identified in Microsoft Windows that could allow a user with limited access to gain full administrative control over a computer. This type of flaw is often used by attackers who have already gained a foothold on a system to deepen their access and bypass security restrictions. To exploit this, an attacker must already have the ability to run code on the target machine.
Technical details
A Use-After-Free (UAF) vulnerability (CWE-416) exists in Microsoft Windows that facilitates local privilege escalation. An attacker with low-privileged access can exploit this memory corruption flaw to execute code with higher privileges, potentially reaching SYSTEM level. The attack vector is local, requiring the attacker to already have execution capabilities on the target host. While the complexity is rated as high, successful exploitation allows the attacker to bypass security boundaries (Scope: Changed) and impacts confidentiality, integrity, and availability. Microsoft has released security updates to address this issue across multiple Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 Versions 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Versions 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 Standard and Server Core installations
Timeline
- 2026-07-14: advisory: Initial advisory published by Microsoft and NVD