CVE-2026-65778 Overview
CVE-2026-65778 is a use-after-free vulnerability in Windows Autopilot affecting Microsoft Windows 11 24H2 and 25H2 on x64 and ARM64 architectures. An authorized local attacker can exploit the flaw to elevate privileges on the target system. Microsoft classifies the issue under CWE-416: Use After Free. The vulnerability requires local access and low privileges, with high attack complexity. Successful exploitation delivers high impact to confidentiality, integrity, and availability. Microsoft published guidance in the Microsoft Security Advisory.
Critical Impact
A local, authenticated attacker who wins a race condition against a freed object in Windows Autopilot can execute code in a higher-privilege context, resulting in full compromise of the affected Windows 11 endpoint.
Affected Products
- Microsoft Windows 11 24H2 (x64 and ARM64)
- Microsoft Windows 11 25H2 (x64 and ARM64)
- Windows Autopilot provisioning component
Discovery Timeline
- 2026-08-11 - CVE-2026-65778 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65778
Vulnerability Analysis
The vulnerability resides in Windows Autopilot, the zero-touch provisioning component used to configure Windows 11 devices. Autopilot handles device enrollment, policy retrieval, and identity binding during setup and post-provisioning workflows. A use-after-free condition [CWE-416] occurs when the component references heap memory after that memory has been released. An authorized attacker with local access can trigger the freed reference and reclaim the memory with attacker-controlled data. When the dangling pointer is dereferenced, the process operates on attacker-controlled structures. This enables code execution or privilege escalation in the context of the Autopilot service, which runs at a higher integrity level than a standard user.
Root Cause
The defect stems from improper lifetime management of an object in the Autopilot code path. A thread frees a resource while another code path retains a pointer to the same object. Without synchronization or reference counting, subsequent operations dereference stale memory. The high attack complexity indicated by Microsoft reflects the timing dependency required to reliably reclaim the freed allocation.
Attack Vector
Exploitation requires an authenticated local user on an affected Windows 11 host. The attacker interacts with the Autopilot component to induce the free and then races to reallocate the memory with crafted contents before the dangling pointer is used. Successful exploitation elevates privileges from a low-privileged user to a higher-privileged context. No user interaction beyond the attacker's own actions is required, and the attack does not cross a security scope boundary.
Verified proof-of-concept code is not publicly available. Refer to the Microsoft Security Advisory for authoritative technical details.
Detection Methods for CVE-2026-65778
Indicators of Compromise
- Unexpected process crashes or Windows Error Reporting entries referencing Autopilot binaries or related provisioning services.
- New child processes spawned by Autopilot service processes running with elevated tokens shortly after standard-user activity.
- Anomalous token manipulation events (Event ID 4672, 4673) tied to accounts that should not receive sensitive privileges.
Detection Strategies
- Hunt for local accounts that transition from medium to high integrity without a corresponding legitimate elevation event such as UAC consent.
- Correlate Autopilot service crashes with subsequent process creation events under SYSTEM originating from non-standard binaries or unsigned modules.
- Baseline expected Autopilot activity during enrollment windows and alert on invocations outside those periods.
Monitoring Recommendations
- Enable Windows process creation auditing with command-line logging (Event ID 4688) and forward to a central analytics platform.
- Monitor Sysmon Event IDs 1, 10, and 11 for suspicious handle access and image loads targeting Autopilot-related processes.
- Track patch state of Windows 11 24H2 and 25H2 endpoints and alert on hosts missing the vendor update.
How to Mitigate CVE-2026-65778
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Advisory to all Windows 11 24H2 and 25H2 systems.
- Prioritize patching endpoints used by users with the ability to run local code, including developer and administrative workstations.
- Review local user accounts and remove unnecessary interactive logon rights on Autopilot-managed devices.
Patch Information
Microsoft has released a security update addressing CVE-2026-65778 for Windows 11 24H2 and 25H2 on x64 and ARM64. Deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or an equivalent patch-management platform. Confirm installation by validating the corresponding KB build number on each endpoint after reboot.
Workarounds
- No official workaround is listed by Microsoft; patching is the supported remediation path.
- Restrict local logon and interactive access on provisioned endpoints to reduce the attacker population able to trigger the flaw.
- Enforce application allowlisting with Windows Defender Application Control or AppLocker to limit the binaries a local attacker can execute while staging the exploit.
# Verify patch state on a Windows 11 endpoint
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Query current Windows build to confirm 24H2 / 25H2 servicing level
Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber, WindowsVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
