Use-after-free in Microsoft Windows and Windows Server - CVE-2026-105006

Vulnerability details

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the HID class driver when a physical attack targets the driver. An attacker with physical access can exploit the use-after-free through a physical attack to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

Affected software

How to mitigate CVE-2026-105006

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105006
• https://support.microsoft.com/help/5126646

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows