Executive brief
Windows Host Guardian Service contains a use-after-free vulnerability that allows an authorized local user to escalate their privileges to a higher access level. An attacker with existing user credentials on a Windows system could exploit this flaw to gain administrative control, potentially compromising the entire machine and any data or services running on it.
Technical details
A use-after-free vulnerability exists in Microsoft Windows Host Guardian Service, where freed memory is accessed after deallocation. The vulnerability requires an authenticated user with local access to the system. An attacker can trigger the vulnerability through local interaction with the Host Guardian Service to execute arbitrary code in a higher privilege context, achieving local privilege escalation. A patch from Microsoft is available to address this issue.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed