Executive brief
Windows Push Notifications is a system service that enables applications to receive real-time notifications. A use-after-free vulnerability allows an authenticated local user to exploit a memory management flaw and execute code with elevated privileges, potentially gaining full system control.
Technical details
This vulnerability is a use-after-free flaw in the Windows Push Notifications service, a memory safety issue where freed memory is accessed after deallocation. The flaw is reachable only to authenticated users with local access to the system. An attacker with valid credentials can trigger the vulnerable code path to corrupt memory and escalate privileges to SYSTEM level. The vulnerability has been patched by Microsoft as indicated by the security update guide reference.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed