CVE-2026-20859
Published: 13 January 2026
Summary
CVE-2026-20859 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the use-after-free vulnerability by requiring timely patching of the affected Windows kernel-mode drivers as specified in the Microsoft advisory.
Implements memory protection controls such as address space layout randomization and data execution prevention to mitigate exploitation of use-after-free flaws in kernel-mode drivers.
Enforces least privilege on local low-privilege accounts required to trigger the vulnerability, limiting the potential for successful local privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Windows kernel-mode drivers directly enables local privilege escalation (T1068) from low-privileged context.
NVD Description
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-20859 is a use-after-free vulnerability (CWE-416) affecting Windows Kernel-Mode Drivers. Published on 2026-01-13, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with local attack vector, low attack complexity, and low privileges required.
A local attacker with low-level privileges can exploit this vulnerability without user interaction. Successful exploitation allows privilege escalation, enabling the attacker to gain higher-level access and potentially compromise confidentiality, integrity, and availability of the affected system.
Mitigation details and patches are outlined in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20859.
Details
- CWE(s)