CVE-2026-32165
Published: 14 April 2026
Summary
CVE-2026-32165 is a high-severity Race Condition (CWE-362) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses use-after-free vulnerabilities by enforcing memory safeguards like address space layout randomization and data execution prevention in the Windows User Interface Core.
Requires timely identification, reporting, and patching of flaws such as CVE-2026-32165 to prevent local privilege escalation exploitation.
Enforces least privilege to limit the impact and scope of privilege escalation from low-privilege local attackers exploiting the use-after-free vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free (CWE-416) race condition in Windows UI Core directly enables local privilege escalation (AV:L, PR:L) by an authenticated attacker, matching T1068 Exploitation for Privilege Escalation.
NVD Description
Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-32165 is a use-after-free vulnerability in the Windows User Interface Core component, published on 2026-04-14T18:17:19.077. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-362 (race condition) and CWE-416 (use after free).
The vulnerability can be exploited by an authorized local attacker with low privileges (PR:L) who has physical or logical access to the target system. Exploitation requires high attack complexity (AC:H) but no user interaction (UI:N), enabling the attacker to achieve privilege escalation with high impacts on confidentiality, integrity, availability, and a changed scope (S:C).
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32165.
Details
- CWE(s)