CVE-2026-61357 Overview
CVE-2026-61357 is a use-after-free vulnerability [CWE-416] in the Windows Application Information Service (appinfo.dll). The flaw allows an authorized local attacker to elevate privileges on affected Microsoft Windows systems. Microsoft published the advisory on 2026-08-11 and the affected products include Windows 11 24H2, 25H2, 26H1, and Windows Server 2025.
The Application Information Service brokers elevation requests for User Account Control (UAC) and runs with SYSTEM privileges. A successful exploit yields full control of the host, including installation of programs, data modification, and creation of new privileged accounts.
Critical Impact
A local, authenticated attacker can escalate to SYSTEM by triggering the use-after-free condition in Application Information Services, achieving full confidentiality, integrity, and availability compromise.
Affected Products
- Microsoft Windows 11 24H2 (ARM64, x64)
- Microsoft Windows 11 25H2 (ARM64, x64)
- Microsoft Windows 11 26H1 (ARM64, x64)
- Microsoft Windows Server 2025 (x64)
Discovery Timeline
- 2026-08-11 - CVE-2026-61357 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61357
Vulnerability Analysis
The vulnerability resides in the Application Information Service (AIS), the Windows service responsible for facilitating elevated application launches through UAC. The service handles inter-process communication (IPC) requests from lower-privileged callers and manages object lifetimes for elevation contexts.
A use-after-free condition [CWE-416] occurs when the service frees an object referenced by a request while another code path still holds a pointer to the freed memory. When the dangling pointer is subsequently dereferenced, an attacker who has groomed the heap can force execution against attacker-controlled data.
Because AIS runs as NT AUTHORITY\SYSTEM, successful exploitation transitions the attacker from a standard user context to full kernel-adjacent privilege. Exploitation requires local access and low-privilege authentication, with no user interaction beyond triggering the vulnerable IPC path.
Root Cause
The root cause is improper lifetime management of a heap-allocated object within the Application Information Service. The service releases the object without invalidating outstanding references, permitting reuse of freed memory during a subsequent operation on the same handle or context.
Attack Vector
An authenticated local user issues a crafted sequence of elevation-related requests to AIS. By racing operations or manipulating request ordering, the attacker triggers the free while retaining a stale reference. Reclaiming the freed allocation with controlled contents enables privilege escalation to SYSTEM.
No verified public proof-of-concept exists at time of writing. Refer to the Microsoft Security Update Guide CVE-2026-61357 for authoritative technical detail.
Detection Methods for CVE-2026-61357
Indicators of Compromise
- Unexpected crashes or restarts of the AppInfo service (svchost.exe hosting appinfo.dll) recorded in the System event log.
- Creation of processes under consent.exe or elevated child processes spawned by standard user accounts without a corresponding legitimate UAC prompt.
- New local administrator accounts, scheduled tasks, or services created shortly after AIS anomalies.
Detection Strategies
- Hunt for standard user sessions spawning processes with SYSTEM integrity via the AIS elevation path.
- Correlate Windows Error Reporting entries for appinfo.dll faults with subsequent privileged process creation on the same host.
- Monitor Sysmon Event ID 1 (process create) for elevation of non-admin users combined with Event ID 10 (process access) against the AIS host process.
Monitoring Recommendations
- Enable process creation auditing (Event ID 4688) with command-line logging across Windows 11 and Server 2025 endpoints.
- Forward AIS crash telemetry and UAC elevation events to a centralized SIEM or data lake for correlation with identity events.
- Alert on privilege escalations that originate from interactive standard user sessions rather than administrative logon types.
How to Mitigate CVE-2026-61357
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-61357 to all Windows 11 24H2/25H2/26H1 and Windows Server 2025 systems.
- Prioritize patching of multi-user hosts, jump servers, and virtual desktop infrastructure where local access by standard users is expected.
- Audit local group memberships and remove unnecessary interactive logon rights to reduce the population of potential attackers.
Patch Information
Microsoft has issued cumulative updates addressing CVE-2026-61357 for all affected builds. Consult the Microsoft Security Update Guide CVE-2026-61357 for the specific KB identifiers matching each supported Windows 11 and Windows Server 2025 release.
Workarounds
- No official workaround has been published by Microsoft; installing the security update is the supported remediation.
- Restrict local logon rights via Group Policy (Deny log on locally) for non-essential accounts on high-value systems until patches are deployed.
- Enforce application allowlisting with Windows Defender Application Control (WDAC) to limit attacker tooling that could stage a use-after-free exploit.
# Verify installed cumulative update and AppInfo service state on Windows
wmic qfe list brief /format:table
Get-Service -Name Appinfo | Format-List Name,Status,StartType
# Deploy updates via WSUS or Microsoft Update after approval
UsoClient StartScan; UsoClient StartDownload; UsoClient StartInstall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
