CVE-2026-20865
Published: 13 January 2026
Summary
CVE-2026-20865 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and remediation of the use-after-free vulnerability in Windows Management Services via patching per MSRC guidance.
Implements memory protection mechanisms like ASLR, DEP, and stack canaries that directly counter use-after-free exploits enabling local privilege escalation.
Limits the scope and impact of low-privileged local attackers by enforcing least privilege, reducing the effectiveness of privilege escalation via the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Windows Management Services directly enables local privilege escalation from low-privileged context to full system control.
NVD Description
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-20865 is a use-after-free vulnerability (CWE-416) in Windows Management Services that enables local privilege escalation. Published on 2026-01-13, it carries a CVSS v3.1 base score of 7.8 (High), reflecting local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), changed scope (S:C), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
An authorized local attacker with low privileges can exploit this vulnerability through a high-complexity attack sequence, potentially achieving full privilege escalation on the affected Windows system. Successful exploitation grants the attacker high-level access, allowing unauthorized control over system resources, data modification, and disruption.
The Microsoft Security Response Center (MSRC) provides detailed guidance on mitigation and patching in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20865. Security practitioners should consult this advisory for applicable updates and workarounds.
Details
- CWE(s)