Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
In plain language
Written by AI from the record
CVE-2026-50329 is a Windows-only local bug that can let someone with low-level access raise their privileges to take over the system; if you’re a typical small business, you should patch because Windows systems are often targeted after an attacker gets a foothold.
CVE-2026-50329 is a local privilege-escalation issue (CWE-416 use-after-free) in the Microsoft DWM Core Library that an authorized attacker with low-level access can exploit to gain higher system privileges on Windows 10/11 and supported Windows Server versions.
If you're affected
Full system takeover
Malware can run as admin
Business operations disrupted
Data theft after escalation
What is it
This is a mistake in a Windows system library (part of the desktop window manager components). If an attacker already has some access on the same machine, they may be able to trigger the bug and gain higher privileges—like “admin-level” control. Think of it like a locked door that’s supposed to keep low-level users out, but there’s a flaw that lets them break the lock and enter the control room.
Who is affected
This matters if you run Microsoft Windows 10, Windows 11, or the supported Windows Server versions (2019, 2022, 2025). The bug is local, meaning it requires an attacker to already have local access and low-level privileges on the device; it also requires no user interaction once local access is present. Treat it as a risk mainly for machines where an attacker could get a foothold locally (for example, via compromised accounts, malware already on the device, or weak local access controls).
How urgent is it
This is marked RED because it enables attackers to elevate privileges on a compromised Windows machine—so once an attacker gets any foothold, this can help them take full control. Even though there’s no confirmed KEV listing in the provided findings, the patch availability across multiple Windows branches makes it actionable now. Prioritize fixing it on systems that may be exposed to compromised accounts or malware already present.
What to do — in detail
Identify affected systems and current builds
On each device, determine the Windows version and build number (for example, via system information or your management console).
Confirm whether the device is Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025.
Determine whether the device is already fixed
Compare your build number against the fixed builds for CVE-2026-50329:
Windows 10 is fixed when at least one of these is met: 10.0.17763.9020 OR 10.0.19044.7548 OR 10.0.19045.7548.
Windows 11 is fixed when at least one of these is met: 10.0.26100.8875 OR 10.0.26200.8875 OR 10.0.28000.2269.
Windows Server 2019 is fixed when at least: 10.0.17763.9020.
Windows Server 2022 is fixed when at least: 10.0.20348.5386.
Windows Server 2025 is fixed when at least: 10.0.26100.33158.
Upgrade/patch
Install the latest available Windows security updates for your branch until the build number meets or exceeds the fixed version above.
Reboot and re-check the build number to verify the update actually took effect.
If patching is delayed (temporary containment)
Reduce the chance that an attacker can get local, low-level access:
Review local account access and remove unused accounts.
Ensure strong passwords and account protections for any users who can log onto the device.
Restrict who can obtain local access (including limiting helpdesk-style accounts if they can log on locally).
Assume the device could already be compromised if you have any signs of suspicious activity, and treat patching as part of a broader incident response.
What to monitor after patching
Confirm patch compliance (build number) across endpoints.
Watch for unusual local admin activity, new user creation, and repeated login failures on systems that were at risk.
KEV / CISA due date
No KEV entry was provided in the findings, so no CISA due date is available here.
Documentation
Record the before/after build numbers for each updated system and the reboot date/time.
Technical context
Severity and type: This is a local privilege-escalation vulnerability (CWE-416: use-after-free) in the Microsoft DWM Core Library. The reported capability is privilege elevation on a compromised system; exploitation requires an authorized attacker with local access and low-level privileges, with no user interaction. Exploitation status: The provided findings do not list CVE-2026-50329 in CISA KEV and do not include a clear dated press exploitation claim; no public exploit code was found in the provided findings. Patch coverage: The vulnerability is fixed in multiple Windows branches, with specific fixed build numbers listed for Windows 10, Windows 11, and Windows Server 2019/2022/2025.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
