CVE-2026-65782: Windows 11 24h2 Privilege Escalation Flaw

CVE-2026-65782 Overview

CVE-2026-65782 is a use-after-free vulnerability [CWE-416] in Windows Autopilot affecting Microsoft Windows 11 24H2 and 25H2 on both x64 and arm64 architectures. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. Microsoft assigned a CVSS 3.1 base score of 7.0 and published the advisory on 2026-08-11. Successful exploitation requires local access and low privileges, but the attack complexity is high because the attacker must reliably win a memory reclamation race. No public exploit or proof-of-concept is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local, authenticated attacker who wins the race condition can execute code with elevated privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 11 24H2 (x64, arm64)
Microsoft Windows 11 25H2 (x64, arm64)
Windows Autopilot component shipped with the above builds

Discovery Timeline

2026-08-11 - CVE-2026-65782 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65782

Vulnerability Analysis

The defect is a use-after-free in the Windows Autopilot component, the provisioning service that enrolls and configures Windows 11 devices. The affected code retains a pointer to a heap object after that object has been released. A subsequent operation dereferences the stale pointer, giving an attacker a chance to read or write memory that has been reallocated for a different purpose. Because Autopilot executes with elevated privileges during device configuration, controlled reuse of the freed allocation can be steered into privileged code paths. The result is local privilege escalation from a low-privileged user context to a higher-integrity level.

Root Cause

The root cause is improper management of object lifetime in Autopilot [CWE-416]. A reference to a heap-allocated structure remains reachable after the allocator returns the memory to its free pool. When the attacker triggers a follow-on code path that dereferences that reference, the allocator may already have handed the slab to attacker-controlled data.

Attack Vector

The attack vector is local. The attacker must already hold a valid account on the target and must trigger the vulnerable Autopilot code path while racing an allocation to control the reclaimed memory. The high attack complexity reflects this timing requirement. No user interaction is required. Microsoft has not published exploitation details; refer to the Microsoft CVE-2026-65782 Advisory for vendor guidance.

Detection Methods for CVE-2026-65782

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries referencing Autopilot binaries or the WWAHost.exe provisioning host on 24H2/25H2 endpoints.
New scheduled tasks, services, or child processes spawned by Autopilot-related processes running as SYSTEM.
Local user accounts that gain administrative group membership shortly after Autopilot activity in the event log.

Detection Strategies

Monitor process ancestry for unusual children of Autopilot and provisioning processes, especially spawns of cmd.exe, powershell.exe, or LOLBins.
Alert on token elevation events (Windows Security Event ID 4672) tied to processes that originate from a non-administrative user session.
Correlate application crash telemetry with subsequent privileged process creation on the same host within a short time window.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 10, and 11 alongside Windows Security logs into a central analytics platform to reconstruct process lineage and access attempts.
Track patch state of Windows 11 24H2 and 25H2 fleets and flag hosts missing the Microsoft update addressing CVE-2026-65782.
Baseline normal Autopilot enrollment activity so post-enrollment invocations of provisioning components stand out.

How to Mitigate CVE-2026-65782

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-65782 Advisory to all Windows 11 24H2 and 25H2 endpoints.
Prioritize patching on multi-user systems, shared workstations, and virtual desktop infrastructure where local accounts are more likely to be abused.
Audit local account inventories and remove unnecessary interactive logon rights that would satisfy the vulnerability's low-privilege prerequisite.

Patch Information

Microsoft published the fix through the Microsoft Security Response Center. Administrators should deploy the update through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune. Confirm remediation by validating the OS build after installation on both x64 and arm64 hardware. Consult the Microsoft CVE-2026-65782 Advisory for the exact KB identifiers per build.

Workarounds

No vendor-supplied workaround is documented; patching is the supported remediation.
Restrict local logon and interactive session rights on high-value hosts to reduce the population of accounts that meet the exploitation prerequisite.
Enforce application control policies (Windows Defender Application Control or AppLocker) to limit which binaries a standard user can execute against the Autopilot attack surface.

bash

# Verify Windows build and pending updates on affected hosts
Get-ComputerInfo -Property OsName,OsVersion,OsBuildNumber,OsArchitecture
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10