CVE-2026-21235
Published: 10 February 2026
Summary
CVE-2026-21235 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21235 is a use-after-free vulnerability (CWE-416) in the Microsoft Graphics Component. It affects Microsoft Windows systems that utilize this component and was published on 2026-02-10 with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). The flaw enables an authorized attacker to elevate privileges locally by exploiting the use-after-free condition.
A local attacker with low privileges (PR:L) can exploit this vulnerability, which requires low attack complexity (AC:L) and user interaction (UI:R). Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), primarily through local privilege escalation without changing the scope of impact (S:U).
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21235 provides guidance on available patches and mitigation measures for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7348
Vulnerability details
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in graphics component directly enables local privilege escalation (T1068) by a low-privileged attacker.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces memory protections that block exploitation of use-after-free conditions in the graphics component.
Mandates rapid application of vendor patches that eliminate the specific use-after-free flaw before local exploitation.
Restricts initial process privileges so a low-privileged local attacker cannot reach or fully leverage the graphics-component flaw.