Description

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-11T17:18:57.683Z",
  "pubdate": "2026-08-11T17:18:57.683Z",
  "executiveSummary": "This vulnerability is classified as a Use After Free memory corruption flaw affecting Windows Autopilot. The flaw enables an authorized local attacker to execute arbitrary code within a privileged context, successfully achieving local privilege escalation on target systems.\nThe primary impact of this vulnerability is the compromise of operating system integrity and confidentiality, allowing a threat actor with limited user privileges to elevate access levels to those of a privileged user or system account.\nAffected systems include endpoints utilizing the Windows Autopilot deployment and provisioning framework. The risk implication is significant within enterprise environments, as compromised endpoints can be leveraged for lateral movement, credential harvesting, or full system takeover.\nExploitation requirements dictate that the attacker must already possess authorization and local access to the target machine. The attack vector relies on interacting with the vulnerable Windows Autopilot component locally, requiring precise memory manipulation to trigger the use-after-free condition and execute the malicious payload.",
  "technicalDetails": "The root cause of the vulnerability resides in memory management errors within the Windows Autopilot component, specifically exhibiting a Use After Free condition. When objects are allocated, freed, and subsequently referenced incorrectly within the application logic, a memory corruption vulnerability is introduced.\nThe vulnerable component involves the internal subsystems of Windows Autopilot responsible for handling provisioning states and object lifecycles. Due to improper pointer handling and insufficient validation following memory deallocation, dangling pointers persist, which can be manipulated by an attacker.\nThe attack flow proceeds as follows: An authorized local attacker initiates interactions with the vulnerable Windows Autopilot interface or service. Through carefully timed operations, the attacker forces the application to free a specific memory chunk while retaining a reference to it. The attacker then allocates new data into the freed memory location, a technique commonly known as heap spraying or heap grooming, ensuring controlled content occupies the target address space.\nWhen the application subsequently attempts to access the original dangling pointer, it processes the attacker-controlled data as legitimate program objects or function pointers. This behavior leads to control flow hijacking or arbitrary read and write primitives within the context of the running process.\nAuthentication and privilege requirements specify that the attacker must have local access to the system and possess authorization to interact with the targeted Windows Autopilot components. Network exposure is non-existent for this local vector, as exploitation cannot be performed remotely.\nThe post-exploitation impact allows the attacker to transition from a standard user privilege level to an elevated context, facilitating complete control over the affected Windows Autopilot processes and potentially the underlying operating system depending on the execution context of the vulnerable service."
}