CVE-2026-70142
HighCVSS 7.8Summary
Untrusted search path in Windows Update Service. An authorized attacker can exploit this to elevate privileges locally.
Risk Assessment
An attacker with local access could place a malicious file in the search path and elevate privileges, potentially compromising the host.
Recommendation
Apply the Windows security updates as soon as possible and restrict write access to directories used by the update service.
Other vulnerabilities in Windows Update Service
See all- CVE-2026-70139High
Heap-based buffer overflow in Windows Update Service. An authorized attacker can exploit this to elevate privileges locally.
- CVE-2026-70056High
A use after free vulnerability exists in the Windows Update Service. An authorized attacker can exploit this flaw to elevate privileges locally.
- CVE-2026-100203High
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-100200High
A use-after-free vulnerability in the Windows Update Service allows an authorized attacker to elevate privileges locally. The flaw resides in the system component responsible for updates.
- CVE-2021-26866High
Elevation of privilege vulnerability in Windows Update Service. Allows an attacker to gain higher privileges on the system.
Original NVD description (English source)
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS