CVE-2026-45593: Windows SDK Use-After-Free Privilege Escalation

Technical summary

CVE-2026-45593 is a use-after-free vulnerability (CWE-416) in the Windows SDK affecting multiple versions of Windows 10, Windows 11, and Windows Server. The flaw stems from improper memory management where a pointer to a freed memory location is dereferenced, allowing an authenticated local attacker to execute arbitrary code with elevated privileges. The vulnerability also involves integer-related memory handling (CWE-190). With a CVSS 3.1 score of 7.8 (HIGH), the attack vector is local, requires low complexity, needs prior user privileges, and causes high impact across confidentiality, integrity, and availability.

Business impact

Organizations relying on Windows 10 and Windows 11 desktops, as well as Windows Server 2019, 2022, and 2025 infrastructure, face a direct privilege escalation risk. A compromised user account—whether through phishing, credential theft, or lateral movement—can be weaponized to gain System privileges without additional exploitation. This undermines endpoint hardening strategies and creates a pathway for attackers to achieve persistent, elevated access. Risk is elevated in multi-tenant or shared-workstation environments where user isolation is critical.

Affected systems

The vulnerability affects Windows 10 (versions 1809, 21H2, and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, and 26H1), and Windows Server editions 2019, 2022, and 2025. Organizations running any of these versions should assume exposure unless a patch has been applied. Note that the older Windows 10 1809 appears in the affected list; verify patch availability for out-of-mainstream-support versions with Microsoft.

Exploitability

The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and local-access prerequisite make it a natural target for privilege escalation chains once an attacker gains initial user-level access. Exploitation requires no user interaction, only that the attacker possess valid credentials. The barrier to exploit is technical knowledge rather than social engineering.

Remediation

Apply security updates from Microsoft as soon as they become available for your Windows version. Organizations should prioritize patching based on the criticality of affected systems—servers and administrative workstations should be addressed first. For systems where patching is delayed, enforce application whitelisting, restrict local logon privileges, and monitor for suspicious memory corruption patterns as interim controls.

Patch guidance

Contact Microsoft's Security Update Guide or your organization's patch management system for the specific update version targeting this vulnerability on your Windows version. Test patches in a non-production environment to confirm compatibility with legacy applications and system configurations. Given the breadth of affected versions, coordinate patching across Windows 10, Windows 11, and Windows Server ecosystems in a phased rollout to minimize business disruption.

Detection guidance

Monitor Windows event logs for unusual process privilege escalation events, particularly those involving System token impersonation or unexpected token elevation. Security tools capable of detecting memory corruption exploits—such as control-flow integrity checks and heap spray detection—may identify active exploitation attempts. Network detection is limited since the attack is local; focus on endpoint detection and response (EDR) capabilities to catch post-exploitation activity such as lateral movement or data exfiltration following successful privilege escalation.

Why prioritize this

A CVSS score of 7.8 coupled with broad Windows version coverage justifies immediate attention. While not yet exploited in the wild (KEV status: false), the uncomplicated attack path and high impact make this a prime vector for attackers seeking to escalate compromised user accounts. Environments with strict access controls and air-gapped networks face lower risk; those with shared workstations or frequent third-party access should elevate priority.

Risk score, explained

The HIGH severity reflects the combination of low attack complexity, the authenticated-but-not-interactive nature of the attack, and the severity of impact (full System-level compromise). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H captures a local, low-complexity attack requiring prior user privileges with no user interaction, resulting in high confidentiality, integrity, and availability impact. The lack of KEV status slightly mitigates urgency compared to actively exploited flaws, but the inherent risk remains substantial.

Frequently asked questions