Executive brief
Windows Push Notifications is a system service that delivers notifications to Windows devices. A use-after-free vulnerability in this service allows an authorized local user to elevate privileges and gain system-level access, potentially enabling unauthorized control over the affected device.
Technical details
This is a use-after-free vulnerability in the Windows Push Notifications service, a memory safety issue where the service accesses memory that has been freed, leading to potential code execution. The vulnerability requires an authenticated local attacker with user-level privileges on the system. By exploiting this flaw, an attacker can escalate to higher privileges (likely SYSTEM level), gaining complete control over the device. A patch has been released by Microsoft for this CVE and is available through their security update process.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed