CVE-2026-21235
Published: 10 February 2026
Summary
CVE-2026-21235 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in graphics component directly enables local privilege escalation (T1068) by a low-privileged attacker.
NVD Description
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-21235 is a use-after-free vulnerability (CWE-416) in the Microsoft Graphics Component. It affects Microsoft Windows systems that utilize this component and was published on 2026-02-10 with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). The flaw enables an authorized attacker to elevate privileges locally by exploiting the use-after-free condition.
A local attacker with low privileges (PR:L) can exploit this vulnerability, which requires low attack complexity (AC:L) and user interaction (UI:R). Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), primarily through local privilege escalation without changing the scope of impact (S:U).
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21235 provides guidance on available patches and mitigation measures for this vulnerability.
Details
- CWE(s)