CVE-2026-65783

Analyzed Analyzed - Analysis Complete

Use After Free in Windows Autopilot Allows Local Privilege Escalation

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: Microsoft Corporation

Description

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-65783

EUVD

EUVD-2026-56594

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_11_24h2	to 10.0.26100.9106 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9106 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9106 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9106 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in Windows Autopilot. It allows an authorized attacker to elevate their privileges locally by exploiting memory corruption after it has been freed.

Detection Guidance

Detection of this vulnerability requires monitoring for unusual privilege escalation events in Windows Autopilot. Check Windows Event Logs for Event ID 4624 (successful logons) and Event ID 4672 (special privileges assigned). Use PowerShell commands like Get-WinEvent -LogName Security -MaxEvents 1000 to review recent security events.

Impact Analysis

An attacker could gain higher-level access on your system, allowing them to install programs, view or delete data, or create new accounts with full user rights.

Compliance Impact

The vulnerability allows local privilege escalation in Windows Autopilot, which could enable unauthorized access to sensitive data or systems. This may impact compliance with standards requiring strict access controls, such as GDPR (data protection) or HIPAA (health information security), by increasing the risk of unauthorized data exposure or modification.

Mitigation Strategies

Apply the latest security updates from Microsoft for Windows Autopilot to address the use-after-free vulnerability and prevent privilege escalation.

Hi! I’m here to help you understand CVE-2026-65783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70