CVE-2026-56173

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free memory safety flaw in Windows WebView. An attacker who already has local authenticated access can trigger unsafe reuse of freed memory in a WebView-related component to execute code with elevated privileges. Successful exploitation can compromise confidentiality, integrity, and availability of the affected Windows system, potentially allowing the attacker to bypass normal user privilege boundaries and gain high-privilege execution.

Why it matters to the business

If exploited, this flaw can turn an initial low-privilege foothold into full control of a workstation or server. That can enable credential theft, security tool tampering, lateral movement, data access, malware deployment, and operational disruption. The issue affects multiple supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, so remediation may require broad endpoint and server patch coverage. It is not currently listed in CISA KEV and no public exploit maturity is reported, but the high impact and recent publication make timely patching important.

How an attack unfolds

An attacker first needs local access as an authenticated, low-privileged user or must obtain code execution through another technique such as phishing, malware delivery, stolen credentials, or exploitation of a separate remote vulnerability. Once running locally, the attacker invokes functionality that causes Windows WebView to mishandle object lifetime, freeing memory while it can still be referenced. By shaping process memory and triggering the stale reference, the attacker attempts to redirect execution or corrupt privileged state. If successful, the attacker’s code runs with elevated privileges, allowing them to install persistence, dump credentials, disable defenses, modify protected files, or pivot to other systems.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions: Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019, 2022, and 2025. Because no fixed build numbers were provided in the input, use Microsoft Update, Windows Update for Business, WSUS, Configuration Manager, or the Microsoft Update Catalog to deploy the applicable cumulative update for the July 2026 security release or later. Prioritize internet-facing servers, shared-user systems, developer workstations, jump hosts, VDI images, and systems where low-privileged users can execute code. If immediate patching is not possible, reduce exposure by limiting local logon rights, enforcing least privilege, restricting untrusted code execution through application control, monitoring for suspicious WebView child processes and privilege escalation behavior, and ensuring endpoint protection is active and tamper-protected.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative security update that includes the fix, using Windows Update history, enterprise patch management reporting, or PowerShell inventory of installed hotfixes and OS build numbers. Validate that vulnerable Windows 10, Windows 11, and Windows Server versions are at or above the patched cumulative update level published by Microsoft for this issue. Reboot systems where required and verify the update is not pending. For gold images, VDI templates, and server baselines, confirm the patched image is the source for future deployments. Where vulnerability scanners support this CVE, run authenticated scans and ensure the finding is no longer reported.

Typical attack path

1. Gain initial access to a Windows workstation or server using valid credentials, malware, phishing, or another exploit.
2. Run code locally as a low-privileged authenticated user.
3. Trigger the vulnerable Windows WebView code path that mishandles freed memory.
4. Manipulate process memory so the use-after-free condition results in attacker-controlled behavior.
5. Escalate from low-privileged execution to elevated local privileges.
6. Use elevated access to steal credentials, disable security controls, persist, deploy additional payloads, or move laterally.

How to detect it

There are no public exploit-specific indicators provided for this vulnerability, and use-after-free privilege escalation activity may leave limited direct evidence. Hunt for signs of post-exploitation rather than the memory corruption itself. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, application control logs, and EDR process lineage around WebView-related processes. Look for low-privileged users suddenly launching elevated processes, unexpected child processes from WebView components, credential access tools, security tool tampering, creation of new local administrators, suspicious scheduled tasks or services, LSASS access, abnormal token privileges, and writes to protected system paths. Useful Windows events include logon events, privileged logon activity, process creation, service creation, scheduled task creation, local group membership changes, Windows Defender configuration changes, and PowerShell script block activity. Correlate these behaviors with unpatched systems and with any preceding initial-access alerts.

What your security team should do

• Prioritize deployment of the relevant Microsoft cumulative security update across affected Windows endpoints and servers.
• Use authenticated vulnerability scanning or patch compliance tooling to identify unpatched Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems.
• Treat this as a post-compromise privilege escalation risk: review alerts where low-privileged users spawned elevated processes or modified protected locations.
• Harden endpoints with least privilege, application control, attack surface reduction rules, credential protection, and endpoint detection controls to reduce exploit usefulness.
• Increase monitoring for suspicious activity involving WebView-related processes, unusual child processes, token elevation, credential dumping, security control tampering, and persistence creation.
• Patch shared workstations, VDI pools, jump servers, and systems used by administrators early because local privilege escalation flaws are especially valuable after initial access.
• If patch rollout must be delayed, restrict interactive logon and local code execution to trusted users only.