Microsoft Windows Security App: Use-after-free allows local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Windows Security App allows an authorized local user to elevate privileges. The CVSS 3.1 base score is 7.0 (High). Exploitation requires a local foothold with low privileges and high attack complexity, and no user interaction is needed. The component is not internet-facing, so the risk is mainly as a second-stage escalation step on shared or weakly managed endpoints.
Affected
- Microsoft Windows Security App from 1000.0.0.0 before 1000.27840.1000.0 (per CNA data; verify the build range on the MSRC advisory)
Fixed in
- Build 1000.27840.1000.0 or later appears to contain the fix, but this is not confirmed by the vendor page. KB number: Unknown.
Workaround
Unknown.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- CISA KEV: not listed in the snapshot reviewed; re-check the KEV catalog.
- Public proof of concept: none found.
- In-the-wild exploitation: Unknown.
- EPSS: about 0.003.
Our recommendation
- Install the Microsoft security update for CVE-2026-105725 through the normal monthly Windows update cycle.
- Verify the installed build against the MSRC advisory after patching.
- Prioritise endpoints with shared logins or weak local account hygiene.
- Review local administrator rights and monitor for unusual privilege changes on endpoints until patched.
- Re-check KEV status and public exploit availability before the next review.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105725 msrc.microsoft.com
- vulners: NVD record CVE-2026-105725 vulners.com
- vulners: CVE List record CVE-2026-105725 vulners.com
- FSTEC BDU:2026-16721 via vulners vulners.com
- Strix: CVE-2026-105725 www.strix.ai
- CVE mirror: CVE-2026-105725 (imfht) cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:47.
Original description (NVD)
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.