Executive brief
Windows Authentication Methods, a core component of the Windows operating system responsible for validating user credentials and managing authentication, contains a use-after-free vulnerability. An authorized attacker with local access to an affected system can exploit this flaw to execute code with elevated privileges, potentially compromising the entire system.
Technical details
The vulnerability is a use-after-free (CWE-416) condition in Windows Authentication Methods that occurs when memory is accessed after it has been freed. This is triggered by an authorized attacker with local system access. The attack requires the attacker to already have user-level privileges on the system (precondition: local authentication and user account). Successful exploitation allows privilege escalation to system or administrator level. A patch is available from Microsoft as indicated by the MSRC security update guide.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed