CVE-2026-45593

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free memory safety flaw in the Windows SDK components present on affected Windows client and server releases. An attacker who already has valid local access can trigger the vulnerable code path after an object has been freed, causing memory corruption that may allow execution of attacker-controlled code in a higher-privileged security context. Successful exploitation can provide high confidentiality, integrity, and availability impact on the local system, including the ability to read protected data, modify system state, disable security controls, or execute commands with elevated privileges.

Why it matters to the business

The main business risk is that a low-privileged foothold on a Windows workstation or server could be turned into full local control, increasing the impact of phishing, stolen credentials, malware, or insider misuse. On servers, this could allow attackers to tamper with applications, access sensitive data, install persistence, or move laterally. The vulnerability is not listed in CISA KEV, is not currently associated with ransomware use, has low EPSS, and has no known exploit maturity, so urgency is lower than actively exploited issues; however, the high CVSS impact means it should still be included in normal Windows patch cycles across affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems.

How an attack unfolds

An attacker first obtains authenticated local access to an affected Windows system, such as through stolen user credentials, malware execution, remote desktop access, or compromise of a low-privileged account. The attacker then runs a specially crafted local program or script that interacts with the vulnerable Windows SDK component and forces a use-after-free condition. By manipulating memory layout, the attacker attempts to reuse freed memory in a controlled way so that execution flow or object state is corrupted. If successful, the exploit executes attacker-controlled logic with elevated privileges on the same host. The attacker can then create privileged accounts, dump credentials, disable endpoint protections, install services or scheduled tasks, access protected files, and use the system as a platform for lateral movement.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or other enterprise patch tooling. No specific fixed build or package version was provided in the input, so remediation should be validated against the official Microsoft advisory and the installed Windows build/patch level. Prioritize servers, administrator workstations, developer systems, jump hosts, shared workstations, and systems where untrusted users can execute code. Where immediate patching is not possible, reduce exposure by restricting interactive logon, limiting local user privileges, enforcing application control, blocking unsigned or untrusted executables, enabling endpoint protection, and monitoring for suspicious local privilege escalation behavior.

How to confirm the fix worked

Confirm that each affected system has received the Microsoft security update associated with this vulnerability and is running a Windows build level that Microsoft identifies as fixed. Use enterprise patch management reporting, Windows Update history, Microsoft Defender Vulnerability Management, Configuration Manager, Intune, or authenticated vulnerability scanning to verify remediation. Validate coverage across Windows 10 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2019, 2022, and 2025 where present. For mitigation validation, confirm that standard users cannot install or run unapproved binaries, that local administrator membership is tightly controlled, and that endpoint telemetry captures process creation, privilege changes, service creation, scheduled task creation, and security control tampering.

Typical attack path

1. Gain a low-privileged foothold on an affected Windows endpoint or server.
2. Transfer or execute a local exploit payload on the host.
3. Trigger the vulnerable Windows SDK code path that results in a use-after-free condition.
4. Manipulate memory reuse so the freed object is replaced with attacker-controlled data.
5. Achieve code execution or security context manipulation with elevated local privileges.
6. Use the new privileges to disable defenses, access sensitive data, install persistence, dump credentials, or move laterally.

How to detect it

There are no public, vulnerability-specific indicators supplied for this issue, and local privilege escalation exploitation often leaves weak or indirect evidence. To determine whether it may have been exploited, review endpoint detection and Windows logs for suspicious sequences where a low-privileged user process unexpectedly gains administrative or SYSTEM-level behavior. Useful sources include Windows Security logs, Sysmon, Microsoft Defender for Endpoint advanced hunting, EDR process telemetry, PowerShell logs, service control manager logs, scheduled task logs, application crash logs, and memory-corruption alerts. Look for unsigned or recently dropped executables running from user-writable paths, unexpected process integrity level changes, abnormal child processes spawning with elevated privileges, new local administrators, credential access attempts shortly after an unknown binary runs, new services or scheduled tasks created by non-administrative users, and security tooling being disabled. Correlate any suspicious local privilege escalation events with patch status and interactive logon activity. Because no threat actors or campaigns are identified for this CVE, detection should focus on behavioral evidence of local elevation and follow-on activity rather than static CVE-specific artifacts.

What your security team should do

• Track the official Microsoft advisory and patch release notes to identify the exact fixed build numbers or cumulative updates for each affected Windows version.
• Patch affected Windows servers and high-value workstations first, especially systems used by administrators, developers, and remote access users.
• Use vulnerability management tooling to identify unpatched Windows 10, Windows 11, and Windows Server assets and assign remediation owners.
• Harden local privilege boundaries by removing unnecessary local administrators, enforcing least privilege, and using privileged access workstations for administration.
• Enable or review application control policies such as Windows Defender Application Control or AppLocker to reduce execution of untrusted local exploit binaries.
• Monitor for post-exploitation activity such as unusual child processes from user-writable directories, new services, new scheduled tasks, credential dumping behavior, and endpoint protection tampering.
• Because there is currently no KEV listing, no ransomware association, low EPSS, and no known mature exploit, handle this through the normal high-severity patch process unless exploit activity emerges.