CVE-2026-85911
HighCVSS 7.8Summary
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Risk Assessment
This flaw allows an attacker with valid credentials to escalate privileges, potentially leading to system and data compromise.
Recommendation
Apply Microsoft patches for Windows StateRepository API and enforce least privilege for local accounts.
Other vulnerabilities in Windows StateRepository API
See all- CVE-2026-70218High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-102216High
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-49170High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS