CVE-2026-20923
Published: 13 January 2026
Summary
CVE-2026-20923 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-20923 is a use-after-free vulnerability (CWE-416) in Windows Management Services that allows an authorized attacker to elevate privileges locally. It affects Windows operating systems and was published on 2026-01-13T18:16:18.837 with a CVSS v3.1 base score of 7.8 (High), reflecting local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), changed scope (S:C), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
A local attacker with low-level privileges can exploit this vulnerability through a use-after-free condition in Windows Management Services. Exploitation requires high complexity but no user interaction, enabling the attacker to achieve privilege escalation on the affected system.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20923.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2121
Vulnerability details
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Windows Management Services directly enables local privilege escalation by an authorized low-privileged attacker.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in Windows Management Services by identifying, reporting, and applying vendor-provided patches from the Microsoft advisory.
Implements memory protection mechanisms such as ASLR, DEP, and control-flow integrity that directly mitigate exploitation of use-after-free conditions.
Enforces least privilege on accounts and processes, limiting the scope and impact of local privilege escalation even if the vulnerability is exploited.