CVE-2026-45597: Windows UI Automation Manager Local Privilege Escalation

Technical summary

CVE-2026-45597 is a race condition (CWE-362) in the uiamanager.dll component of Windows that enables local privilege escalation. The vulnerability stems from inadequate synchronization mechanisms protecting shared resources during concurrent execution. An authorized user with local access can manipulate the timing of resource access to bypass privilege boundaries. The CVSS 3.1 vector reflects local attack vector (AV:L), high complexity (AC:H), low privilege requirement (PR:L), no user interaction needed (UI:N), and impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

Business impact

Organizations operating affected Windows editions face elevated risk in multi-user or shared workstation scenarios. Compromise of administrative privileges can lead to unauthorized system modifications, malware persistence, lateral movement to other systems, and exposure of sensitive data. The impact scales with environment size: enterprises with thousands of workstations should prioritize remediation to prevent post-compromise activities. Server environments (Windows Server 2022 and 2025) present particular risk if interactive logon is permitted or if service accounts are exploitable via this vector.

Affected systems

The vulnerability affects Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025. Any deployment of these specific builds should be inventoried for exposure. Virtualized environments, development systems, and shared workstations are higher-risk configurations due to increased likelihood of concurrent user sessions or automated process interactions.

Exploitability

Exploitation requires local access and existing user privileges—a significant constraint that prevents remote unauthenticated attacks. However, the high complexity factor (AC:H) suggests the race condition window is timing-dependent rather than trivial to trigger reliably. In practice, this means exploitation may require multiple attempts or specialized knowledge of UI Automation Manager internals. The prerequisite of local access limits spread but does not protect against insider threats, compromised service accounts, or environments where physical or remote desktop access is broadly granted.

Remediation

Apply security updates from Microsoft addressing this vulnerability in uiamanager.dll. Verify patch availability through the Microsoft Security Update Guide and apply to all affected Windows 11 and Windows Server editions in your environment. For systems where patching is temporarily delayed, restrict local user access where operationally feasible and monitor UI Automation Manager activity for suspicious concurrent operations.

Patch guidance

Check Microsoft's official security advisories and Windows Update catalog for patches targeting CVE-2026-45597 on your specific Windows 11 and Server 2022/2025 builds. Patches should be tested in non-production environments before broad deployment to confirm compatibility with business applications. Prioritize servers and multi-user workstations. Verify patch installation by confirming uiamanager.dll version updates and testing UI Automation features remain functional post-patch.

Detection guidance

Monitor process execution and API call patterns related to UI Automation Manager, particularly focusing on concurrent access to shared resources from different user contexts. Windows Event Viewer logs (Security and System channels) may reveal privilege escalation attempts. Endpoint Detection and Response (EDR) tools should flag suspicious elevation patterns preceded by local access. Look for unusual timing correlations between UI automation API calls and system-level operations.

Why prioritize this

This vulnerability rates HIGH severity due to local privilege escalation capability affecting multiple current Windows versions and server editions. While requiring prior local access limits immediate remote threat, the broad install base of Windows 11 and Server 2025, combined with the complete compromise potential (C:H/I:H/A:H), warrants prompt remediation. Prioritize over lower-severity issues but below critical remote code execution flaws. The race condition's complexity may slow exploit development, providing a reasonable window for patching before widespread weaponization.

Risk score, explained

The CVSS 3.1 score of 7.0 (HIGH) reflects a scenario where an attacker with low privileges and local access can achieve complete system compromise through a time-dependent race condition. The high complexity increases the practical barrier to exploitation, preventing automatic scoring to CRITICAL. The lack of network attack vector and authentication requirement substantially reduce threat surface compared to remote vulnerabilities, but local privilege escalation to system-level access in multi-user environments remains a significant organizational risk.

Frequently asked questions