CVE-2026-32165

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free condition in Windows User Interface Core. A low-privileged authenticated user who can run code on an affected Windows system may be able to trigger memory corruption in the UI subsystem and execute code in a higher-privileged context. Successful exploitation can result in elevated privileges with high impact to confidentiality, integrity, and availability. The CVSS vector indicates local access, low privileges required, no user interaction, high attack complexity, and changed scope, meaning exploitation likely depends on specific memory-layout, timing, or system-state conditions rather than a simple one-shot trigger.

Why it matters to the business

If exploited, this flaw can let an already-authenticated user or malware running with limited rights gain administrative or SYSTEM-level control of a Windows workstation or server. That can enable credential theft, security tool tampering, lateral movement, persistence, and deployment of additional payloads. The risk is most significant on shared workstations, VDI, RDS/terminal servers, developer endpoints, helpdesk/admin workstations, and Windows servers that allow interactive logon. The current public risk signals are moderate-to-low: EPSS is 0.002 with no 30-day increase, it is not listed in CISA KEV, and no public exploit maturity is reported; however, Windows local privilege escalation bugs are commonly chained with phishing, browser compromise, or malware execution to complete system takeover.

How an attack unfolds

An attacker first obtains the ability to run code as a low-privileged user on an affected Windows system, such as through stolen credentials, malware execution, phishing, or access to a shared host. The attacker then runs a local exploit designed to interact with Windows User Interface Core in a way that frees an object while references to it remain in use. By carefully shaping memory and triggering reuse of the freed object, the exploit attempts to redirect execution or corrupt privileged state. If the exploit succeeds, the attacker gains elevated privileges and can launch a command shell, inject into privileged processes, disable defenses, dump credentials, install persistence, or move laterally. Because attack complexity is high and no mature public exploit is reported, real-world exploitation may be unreliable or require tailoring to specific Windows versions and patch levels.

How to fix it

Apply the Microsoft security update or cumulative update that remediates this vulnerability for all affected Windows versions: Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022, including 23H2; and Windows Server 2025. No exact fixed build or KB numbers were provided in the input, so use the relevant Microsoft Security Update Guide entry and Windows release-health documentation to identify the correct cumulative update for each supported OS branch. Prioritize systems that permit interactive user logon, shared systems, VDI/RDS hosts, internet-exposed jump boxes, administrator workstations, and servers used by privileged users. Where immediate patching is not possible, reduce exposure by limiting local logon rights, removing unnecessary local administrator access, enforcing application control, enabling endpoint protection, blocking untrusted executable/script content, and monitoring for suspicious local privilege escalation behavior. Ensure unsupported Windows versions are upgraded to a supported release because they may not receive a complete fix.

How to confirm the fix worked

Confirm remediation by verifying that each affected system has installed the Microsoft cumulative/security update that includes the fix for this vulnerability. Validate through Windows Update, WSUS, Microsoft Intune, Configuration Manager, vulnerability scanning, or authenticated inventory that reports OS edition, build number, update history, and installed KBs. Cross-check detected Windows builds against the Microsoft Security Update Guide for the relevant release branch. For servers and high-value endpoints, perform an authenticated vulnerability scan after patch deployment and verify that the scanner no longer reports this issue. Also confirm that compensating controls remain in place: standard users lack local admin rights, interactive logon to servers is restricted, and endpoint telemetry is collecting process creation, privilege assignment, and crash events.

Typical attack path

1. Gain authenticated local access to an affected Windows workstation or server using credentials, malware execution, or another initial-access technique.
2. Confirm the Windows version/build is vulnerable and that the current user can execute local code.
3. Run a local privilege escalation exploit that targets the Windows User Interface Core use-after-free condition.
4. Manipulate heap layout and trigger the vulnerable UI code path to corrupt memory after an object has been freed.
5. Obtain execution or token manipulation in a higher-privileged context, potentially administrative or SYSTEM.
6. Use elevated access to disable security controls, dump credentials, establish persistence, access sensitive data, or move laterally.

How to detect it

There are no reliable public exploit-specific indicators for this vulnerability based on the provided information, so detection should focus on behavioral evidence of attempted or successful local privilege escalation. Review Windows Security logs, Sysmon, EDR telemetry, Microsoft Defender for Endpoint advanced hunting data, Windows Error Reporting, and application/system crash logs. Look for low-privileged user processes that are followed by elevated command shells, unexpected service creation, scheduled task creation, token manipulation, credential access, or security-control tampering. Investigate crashes in Windows shell, desktop, or UI-related processes occurring immediately before privilege changes, especially if followed by new SYSTEM-level processes launched from user-writable locations. Useful event sources include Security Event ID 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for logon activity, 7045 for new service installation, 4698 for scheduled task creation, 1102 for audit log clearing, Sysmon Event ID 1 for process creation, Sysmon Event ID 7 for image loads where available, Sysmon Event ID 10 for process access, and EDR alerts for exploit behavior, credential dumping, or privilege escalation. Because this is a local exploit, correlate activity by host and user over short time windows rather than relying on network indicators.

What your security team should do

• Patch affected Windows endpoints and servers during the next available maintenance window, with priority for shared systems, VDI/RDS, jump hosts, administrator workstations, and systems where non-admin users can log on interactively.
• Use Microsoft Security Update Guide to map this vulnerability to the correct cumulative update or KB for each Windows release because fixed versions were not provided in the input.
• Run authenticated vulnerability scans or patch-compliance reports to identify any remaining Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems missing the fix.
• Harden local privilege boundaries by removing unnecessary local administrator membership, enforcing least privilege, and restricting interactive logon on servers.
• Use application control, script control, and EDR prevention policies to reduce the chance that a low-privileged user or malware can run a local exploit binary.
• Monitor for suspicious privilege escalation chains, especially low-privileged user processes spawning elevated shells, security-tool tampering, credential-dumping tools, or unexpected service creation.
• Treat exploitation as a possible post-compromise activity: investigate any endpoint where unusual UI-process crashes are followed by privileged process creation or new persistence mechanisms.
• Because EPSS is low, flat, and there is no KEV listing or known mature exploit, prioritize proportionally, but do not defer indefinitely because local Windows elevation bugs are valuable in multi-stage attacks.