CVE-2026-65783: Windows 11 24h2 Privilege Escalation Flaw

CVE-2026-65783 Overview

CVE-2026-65783 is a use-after-free vulnerability [CWE-416] in Windows Autopilot affecting Microsoft Windows 11 24H2 and 25H2 on both x64 and arm64 architectures. An authorized local attacker can exploit the flaw to elevate privileges on the affected host. Successful exploitation grants high impact to confidentiality, integrity, and availability of the compromised system.

Microsoft published the advisory through the MSRC update guide and released fixes as part of the associated security update cycle. The issue requires local access and low privileges, but exploitation carries high attack complexity due to the timing conditions inherent to freeing and reusing kernel-managed memory.

Critical Impact
Local privilege escalation through kernel-mode memory reuse in the Windows Autopilot component, enabling an authenticated user to gain SYSTEM-level control on Windows 11 24H2 and 25H2.

Affected Products

Microsoft Windows 11 24H2 (x64 and arm64)
Microsoft Windows 11 25H2 (x64 and arm64)
Windows Autopilot provisioning component

Discovery Timeline

2026-08-11 - CVE-2026-65783 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65783

Vulnerability Analysis

The flaw resides in Windows Autopilot, the zero-touch provisioning subsystem used to deploy and configure Windows 11 devices. A use-after-free condition occurs when a component within Autopilot references a memory object after that object has already been released. An authorized local attacker who triggers the specific code path can reclaim the freed allocation with attacker-controlled data.

When the dangling pointer is dereferenced, execution follows attacker-influenced structures, allowing manipulation of function pointers or object metadata. The end result is arbitrary code execution in the security context of the Autopilot process, which operates with elevated privileges during provisioning and policy evaluation.

EPSS currently rates the probability of near-term exploitation at 0.204%. No public proof-of-concept, exploit code, or in-the-wild activity has been reported, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper lifetime management of a heap-allocated object inside the Autopilot component. Code paths release the object without invalidating all references, leaving a dangling pointer that later operations dereference. This class of defect [CWE-416] is common where reference counting or state transitions between asynchronous provisioning tasks are handled incorrectly.

Attack Vector

Exploitation requires local access with valid low-privilege credentials on the target Windows 11 host. The attacker triggers the vulnerable Autopilot workflow, races the free operation, and reallocates the freed region with a crafted payload. Because the attack depends on precise timing between allocation, free, and reallocation, the complexity is high and reliable exploitation typically demands controlled memory pressure.

No verified exploitation code is publicly available. See the Microsoft Security Update Guide for vendor-provided technical detail.

// No public proof-of-concept is available for CVE-2026-65783.
// Refer to the Microsoft Security Response Center advisory for authoritative technical detail.

Detection Methods for CVE-2026-65783

Indicators of Compromise

Unexpected child processes spawned by Windows Autopilot or its provisioning services on already-enrolled devices.
Anomalous token elevation or SYSTEM-level activity originating from a standard user session interacting with Autopilot components.
Crash reports referencing access violations in Autopilot-related modules, particularly on Windows 11 24H2 or 25H2 builds prior to the security update.

Detection Strategies

Monitor for process integrity level transitions from Medium to System that trace back to Autopilot workflows outside of legitimate device enrollment windows.
Correlate Windows Event Log entries for Autopilot service faults with subsequent privileged process creation on the same host.
Baseline expected Autopilot activity during initial device provisioning and alert on invocations occurring outside that lifecycle.

Monitoring Recommendations

Enable and forward Sysmon Event IDs 1 (process create), 10 (process access), and 11 (file create) to your SIEM to reconstruct exploitation chains.
Track Microsoft Defender for Endpoint or equivalent EDR telemetry for kernel-mode anomaly signals on 24H2 and 25H2 endpoints.
Alert on non-administrative accounts invoking Autopilot APIs or performing repeated allocation-heavy operations against provisioning services.

How to Mitigate CVE-2026-65783

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide to all Windows 11 24H2 and 25H2 systems.
Prioritize patch deployment on multi-user endpoints, shared workstations, and virtual desktop hosts where local users are less trusted.
Audit local account membership and remove standing low-privilege access that is no longer required on affected hosts.

Patch Information

Microsoft has released a security update addressing CVE-2026-65783 through the standard Windows Update channel. Consult the Microsoft Security Update advisory for the specific KB article, package identifiers, and per-architecture binaries covering x64 and arm64 builds of Windows 11 24H2 and 25H2.

Workarounds

No official workaround exists; installing the Microsoft security update is the supported remediation.
Restrict interactive logon on affected devices to trusted administrators until the update is deployed.
Enforce application control policies such as Windows Defender Application Control to limit which binaries a low-privilege user can execute against Autopilot components.

bash

# Verify patch status on Windows 11 24H2 / 25H2 endpoints
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm the OS build to determine applicability
[System.Environment]::OSVersion.Version