CVE-2026-78457: Windows Security Health Use After Free Flaw

CVE-2026-78457 Overview

CVE-2026-78457 is a use-after-free vulnerability [CWE-416] in the Windows Security Health Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows host. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Successful exploitation grants the attacker higher privileges than initially assigned, potentially reaching SYSTEM-level access. The attack requires local access and low privileges, but exploitation complexity is high due to the timing conditions inherent in memory reuse flaws.

Critical Impact
A low-privileged local user can leverage freed memory reuse in the Security Health Service to gain elevated privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows (Security Health Service component)
Specific affected builds are enumerated in the Microsoft CVE-2026-78457 Advisory
Consult the MSRC update guide for the definitive product and build list

Discovery Timeline

2026-09-08 - CVE-2026-78457 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78457

Vulnerability Analysis

The Windows Security Health Service manages the reporting and health state of Windows security features. A use-after-free condition occurs when the service continues to access an object in memory after that object has been released. An attacker who wins the timing race between the free operation and the reuse of the memory can influence subsequent operations that dereference the stale pointer.

Because the Security Health Service runs with elevated privileges, controlling execution flow through the freed object translates directly into privilege escalation. The attacker must already have valid local credentials on the target system.

Root Cause

The underlying defect is a lifetime management error classified under [CWE-416]. Code paths within the Security Health Service release an object while another code path retains and later dereferences a pointer to that same memory. Reallocation of the freed region with attacker-controlled data enables manipulation of function pointers, virtual tables, or other control structures reachable by the service.

Attack Vector

Exploitation is local. The attacker executes code as a standard authenticated user and interacts with the Security Health Service through its exposed interfaces. Triggering the race condition reliably requires precise timing, which accounts for the high attack complexity rating. No user interaction beyond the attacker's own actions is required.

No public proof-of-concept exploit code is available for CVE-2026-78457 at the time of publication. Refer to the Microsoft CVE-2026-78457 Advisory for authoritative technical details.

Detection Methods for CVE-2026-78457

Indicators of Compromise

Unexpected crashes or restarts of the Windows Security Health Service (SecurityHealthService.exe) recorded in the Application or System event logs
New processes spawned by SecurityHealthService.exe that do not match expected child process patterns
Sudden token elevation events (Event ID 4672) associated with accounts that should not hold administrative privileges

Detection Strategies

Monitor for anomalous behavior originating from SecurityHealthService.exe, including unusual memory access patterns and process injection attempts
Correlate low-privileged user sessions with subsequent SYSTEM-level activity on the same host within short time windows
Alert on repeated service crashes that may indicate failed exploitation attempts against the race condition

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging across managed endpoints
Forward Security Health Service crash telemetry to a centralized log platform for baseline analysis
Track privilege assignment events (Event IDs 4672, 4673, 4674) and investigate deviations from established baselines

How to Mitigate CVE-2026-78457

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-78457 Advisory as soon as testing permits
Prioritize patching on multi-user systems, jump hosts, and workstations where non-administrative users hold interactive access
Audit local account membership and remove unnecessary standard user access from sensitive hosts

Patch Information

Microsoft has issued an update through the standard Patch Tuesday distribution channel. Consult the MSRC update guide for the specific Knowledge Base (KB) article numbers matching each supported Windows build. Deploy the update via Windows Update, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Intune according to organizational patch management processes.

Workarounds

No official workaround has been published by Microsoft; installing the security update is the recommended remediation
Restrict interactive and remote logon rights to trusted users to reduce the local attacker population
Enforce application control policies such as Windows Defender Application Control (WDAC) to limit execution of unauthorized binaries that could stage the exploit

bash

# Verify installed updates on a Windows host
wmic qfe list brief /format:table

# Query the Security Health Service status
sc query SecurityHealthService