CVE-2026-56644

What it actually does

This is a local privilege-escalation vulnerability caused by a use-after-free condition in the Windows Kernel. An attacker who already has authorized local access can trigger unsafe reuse of freed kernel memory to corrupt kernel state, potentially gaining arbitrary kernel read/write capability or executing code in kernel context. Successful exploitation can allow the attacker to elevate from a standard or constrained account to NT AUTHORITY\SYSTEM, bypassing normal operating system privilege boundaries and enabling full control of the affected Windows host. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, this flaw can turn a limited foothold on a workstation or server into full system compromise. That can enable credential theft, security tool tampering, lateral movement, ransomware staging, data theft, or persistence on affected Windows 10, Windows 11, and Windows Server systems. It is not currently listed in CISA KEV, is not reported as used in ransomware campaigns, has low EPSS at this time, and no public exploit maturity was provided, so urgency is lower than for actively exploited vulnerabilities; however, kernel privilege-escalation bugs are commonly used after phishing, malware execution, stolen credentials, or initial access through another vulnerability.

How an attack unfolds

An attacker first obtains a valid local execution context on an affected Windows system, such as a low-privileged user session, compromised application account, malware running as a standard user, or code execution through another vulnerability. The attacker then runs a purpose-built exploit that interacts with the vulnerable Windows Kernel component in a sequence that causes a kernel object to be freed while a stale reference remains accessible. By carefully controlling memory allocation and reuse, the attacker attempts to place attacker-controlled data where the freed object used to reside. When the kernel later dereferences the stale pointer, the attacker can corrupt kernel memory or influence execution flow. A successful exploit typically converts this primitive into privilege escalation, such as modifying the current process token, spawning a SYSTEM shell, disabling protections, installing a privileged service, or injecting into a protected/high-privilege process. After elevation, the attacker may dump credentials, deploy persistence, move laterally, or stage destructive payloads. Failed attempts may cause process instability, security product alerts, or system crashes/bugchecks.

How to fix it

Apply the Microsoft security update or cumulative update that addresses this vulnerability for every affected Windows version in scope: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, and 2025. No exact fixed build or KB identifiers were provided in the input, so remediation should be validated against the official Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or the organization’s patch management tooling. Prioritize servers that allow interactive logon, virtual desktop infrastructure, jump hosts, developer workstations, shared workstations, and endpoints where users have local execution rights. If immediate patching is not possible, reduce exposure by limiting local interactive access, removing unnecessary local administrator rights, enforcing application control, blocking untrusted executables, enabling credential protection features, and ensuring EDR/antimalware protections are active and tamper-protected. Because this is a local privilege-escalation issue, network isolation alone is not sufficient once an attacker has code execution on the host.

How to confirm the fix worked

Confirm remediation by verifying that each affected system has installed the vendor-designated cumulative update or security update that supersedes this vulnerability. Use Windows Update history, WSUS/ConfigMgr/Intune compliance reports, vulnerability scanner results, or PowerShell inventory such as Get-HotFix, Get-ComputerInfo, systeminfo, and OS build checks compared against the Microsoft Security Update Guide. Validate that unsupported or out-of-service Windows builds are upgraded to supported releases, because they may not receive complete security fixes. Re-run authenticated vulnerability scans after patch deployment and confirm the vulnerability no longer appears for the host and OS build. Where patch status is ambiguous, compare the installed kernel binaries and OS build/revision against the fixed versions documented by Microsoft. Also verify compensating controls: standard users cannot install arbitrary kernel drivers, EDR is running with tamper protection, local administrator membership is limited, and application control policies prevent unsigned or untrusted local exploit binaries from executing.

Typical attack path

1. Gain initial local execution on an affected Windows 10, Windows 11, or Windows Server system using valid credentials, malware, remote code execution, phishing, or another access path.
2. Confirm the operating system build is vulnerable and that the current account has enough local privilege to reach the affected kernel interface.
3. Run a local exploit that triggers the Windows Kernel use-after-free condition.
4. Manipulate kernel memory layout so the freed object is reused with attacker-influenced data.
5. Abuse the resulting kernel memory corruption to obtain elevated privileges, commonly NT AUTHORITY\SYSTEM.
6. Use elevated access to disable defenses, access sensitive files, dump credentials, install persistence, create services or scheduled tasks, and move laterally.

How to detect it

There is no single reliable Windows event that proves exploitation of this kernel use-after-free vulnerability, and no public exploit-specific indicators were provided. Detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Collect and review Windows Security logs, Sysmon or EDR telemetry, PowerShell logs, Task Scheduler logs, Service Control Manager logs, Windows Defender/antimalware events, crash dumps, and system event logs. Look for a low-privileged user session followed shortly by processes running as NT AUTHORITY\SYSTEM that are unusual for that user or host. Investigate new or modified services, scheduled tasks, local administrator membership changes, suspicious driver loads, unsigned binaries executing from user-writable paths, credential-access tooling, attempts to disable security controls, and unexpected outbound connections after elevation. Useful Windows events include 4624 and 4672 for logon and special privilege assignment, 4688 for process creation with command line, 4697 and 7045 for service installation, 4698 and TaskScheduler Operational event 106 for scheduled task creation, 4720/4728/4732 for account and group changes, 1102 for audit log clearing, Sysmon Event ID 1 for process creation, Sysmon Event ID 6 for driver loading, Sysmon Event ID 10 for process access, and System Event ID 1001 for bugchecks that may indicate failed exploitation. Because exploitation is local, correlate detections with prior initial-access alerts such as malware execution, suspicious document activity, web shell execution, exposed service compromise, or stolen credential use.

What your security team should do

• Track this vulnerability in the normal monthly Windows patch cycle and apply the relevant Microsoft cumulative updates across all affected Windows workstation and server versions.
• Prioritize patching of high-value systems, shared systems, jump servers, VDI hosts, domain administration workstations, and servers where lower-privileged users or applications can execute code locally.
• Do not treat low EPSS or absence from KEV as a reason to ignore the issue; local kernel privilege escalation vulnerabilities often become valuable after exploit details or proof-of-concept code are released.
• Review local administrator group membership, privileged access workflows, and interactive logon permissions to reduce the number of accounts that can convert local execution into full host compromise.
• Ensure endpoint detection, tamper protection, process command-line logging, PowerShell logging, and Sysmon or equivalent telemetry are enabled on affected Windows assets.
• Hunt for signs of recent local privilege escalation, especially low-privileged user activity immediately followed by SYSTEM-level process creation, new services, new scheduled tasks, security tooling changes, or credential-dumping behavior.
• Monitor vendor advisories and threat intelligence for any change in exploit maturity, EPSS trend, public proof-of-concept availability, KEV listing, or ransomware adoption.
• For systems that cannot be patched quickly, enforce application control, restrict execution from user-writable directories, and limit access to only required users and services.