CVE-2026-20854
Published: 13 January 2026
Summary
CVE-2026-20854 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in LSASS directly enables remote arbitrary code execution in a privileged authentication service (T1068/T1210), facilitating credential dumping from LSASS memory (T1003.001).
NVD Description
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.
Deeper analysisAI
CVE-2026-20854 is a use-after-free vulnerability (CWE-416) in the Windows Local Security Authority Subsystem Service (LSASS). Published on 2026-01-13, it has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation allows the attacker to execute arbitrary code within the context of LSASS, potentially leading to full system compromise given the service's privileged role in Windows authentication and security policy enforcement.
For mitigation guidance, security practitioners should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20854, which details available patches and recommended actions.
Details
- CWE(s)