Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
Read the full article at Microsoft Security Response Center →
CVE-2026-105725 Windows Security App Elevation of Privilege Vulnerability
About this summary. This is a short excerpt from the description that Microsoft Security Response Center published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105725
Source attribution: headline and facts are from Microsoft Security Response Center (msrc.microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Mi Scusi, My SCSI: Abusing iSCSI Target Server
TL;DR – Enumerating the right connection strings lets you impersonate an iSCSI initiator and access whatever is stored on a shared virtual hard disk.
Fake-download campaign uses trojanized installers to deliver monetization payloads
Attack chain overview Mitigation and protection guidance Learn More Microsoft Threat Intelligence has identified an evolving fake-download campaign targeting users…
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11…
ZDI-26-868: Microsoft Windows Aero Theme Improper Handling Of Error Condition Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the…
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Classifying the vulnerability landscape Vulnerabilities exploited in the wild Where defenders should focusPatching is slow, while exploitation is fast Impact, exposure…
VOLTA, the infostealer that asks an AI which victims are worth the effort
VOLTA is an AI-powered infostealer that steals personal data, then uses LLMs to assess victims’ value and rank targets for attackers. Cisco Talos has analyzed a new…