Microsoft Fixes Use-After-Free Kernel Bug (CVE-2026-50393) in Windows 11, Server 2025 — Here’s How to Patch

Microsoft on July 14, 2026, released security updates that patch a high-severity privilege escalation vulnerability in the Windows kernel. The flaw, tracked as CVE-2026-50393, could allow a low-privileged attacker to gain system-level control on affected Windows 11 and Windows Server 2025 systems. With a CVSS score of 7.0 and no user interaction required, the fix is especially urgent for servers and shared workstations where a local foothold can be escalated.

A Use-After-Free Hiding in the Kernel

At its core, CVE-2026-50393 is a use-after-free memory corruption bug in a Windows kernel-mode driver. This class of vulnerability occurs when a program continues to reference a memory location after it has been freed, potentially allowing an attacker to manipulate the contents of that memory to redirect execution or elevate privileges.

Microsoft’s advisory classifies the issue as CWE-416 and assigns it an “Important” severity rating. The CVSS 3.1 vector highlights high attack complexity, meaning an exploit would likely require careful manipulation of kernel memory layout or timing — but it also carries high impact for confidentiality, integrity, and availability. In plain terms: once exploited, an attacker can read, modify, or disable virtually anything on the machine.

The company has not publicly named the specific driver or the kernel object involved, a common practice at initial disclosure to slow weaponization. What is known is that the attack surface is local — an adversary must already be able to execute code on the target system, even from a restricted account. That makes this a classic second-stage tool: useless for breaking in, but devastating for breaking out of limited privileges.

Which Windows Versions Need Patching?

Microsoft’s affected-software list is unusually narrow, centering on its newest operating system branches:

• Windows 11 24H2 (all editions, x64 and Arm64)
• Windows 11 25H2 (x64 and Arm64)
• Windows 11 26H1 (x64 and Arm64)
• Windows Server 2025 (Standard, Datacenter, including Server Core, x64 only)

Notably absent are Windows 11 23H2, Windows 10, and older Windows Server releases. Those systems are not listed as vulnerable to this specific CVE, though they require their own July Patch Tuesday fixes for unrelated issues.

The table below breaks down the fixed build numbers and the corresponding update packages:

\* For Windows 11 26H1, the June cumulative update (KB5095051) already contained the fix. However, July’s KB5101649 (build 28000.2525) supersedes it and includes additional security patches. Administrators should deploy the July update to stay current.

The Escalation Path: From Limited Access to System Control

To exploit CVE-2026-50393, an attacker first needs local access and the ability to run arbitrary code — for example, through a compromised service account, a malicious document, or a prior vulnerability that grants a foothold. No additional user interaction is required once that foothold is established, which distinguishes this from phishing-based attacks that rely on tricking a user into clicking a link.

The CVSS vector confirms the attacker needs low privileges (think guest or standard user). The high attack complexity may reduce the number of adversaries capable of crafting a reliable exploit, but kernel bugs of this nature are prized by sophisticated actors for post-intrusion lateral movement and persistence.

System administrators should consider the risk in context: a workstation shared by multiple users, a developer machine with broad software installed, or a Remote Desktop Services host could all present opportunities for an attacker to land on a box with limited rights, then use this bug to seize full control. Servers are especially tempting targets because “local” can mean code execution through a web application, SQL injection, or even a compromised monitoring agent.

Why Kernel Flaws Demand Fast Action

Privilege escalation vulnerabilities in the kernel bypass every user-mode security boundary. A standard user account normally cannot alter protected system files, inspect other users’ data, or disable endpoint protection. Kernel-level execution changes that entirely — an attacker can install rootkits, steal credentials from memory, or tamper with security software to go undetected.

While Microsoft rates this as Important rather than Critical, the distinction reflects the local-only nature and high complexity. It does not diminish the post-exploitation damage. In well-segmented networks, a compromised server with kernel access can quickly become a launchpad for deeper penetration.

There is no public proof-of-concept code at the time of writing, but that should not slow patching. The CVSS Report Confidence metric is “Confirmed,” meaning Microsoft has verified the vulnerability exists — not that exploit activity has been observed. History shows that kernel use-after-free bugs are routinely reverse-engineered once patches ship, and working exploits often appear within days or weeks.

How to Patch and Verify Your Systems

For Home Users

Windows Update will automatically download and install the July cumulative updates. You can speed up the process by navigating to Settings > Windows Update and clicking “Check for updates.” After installation, verify your OS build by typing winver in the Start menu search and pressing Enter. Compare the displayed build number against the table above to confirm you are protected.

For IT Administrators

• Deploy the updates: Use your existing patch management tool (Microsoft Intune, Configuration Manager, WSUS, or third-party solution) to approve and push the relevant KBs to affected endpoints and servers.
• Prioritize servers: Windows Server 2025 systems — especially those hosting remote access or public-facing services — should be patched first. The risk of a low-privilege foothold is higher on machines that accept connections from untrusted users.
• Validate with PowerShell: Run Get-ComputerInfo -Property OsBuildNumber on a representative sampling of devices after the deployment window to confirm they meet the minimum build numbers.
• Handle 26H1 carefully: For Windows 11 26H1, if you deferred the June update, you must install either KB5095051 (build 28000.2269) or, preferably, the July KB5101649 (build 28000.2525). The July update includes the fix and additional security hardening.

For Developers

If you maintain test machines or build servers running affected Windows versions, apply the same patches. There are no code changes required in your applications; this is an operating system-level fix. Nevertheless, kernel modifications can occasionally surface hidden driver bugs, so run your test suites after updating.

Workarounds and Mitigations

Microsoft has not provided any CVE-specific workarounds or registry key mitigations. General security hygiene — restricting local admin membership, applying application control policies (e.g., WDAC), and limiting interactive logon rights — can raise the bar for an attacker, but they do not close the kernel flaw. Patching is the only definitive action.

What Comes Next

Expect security researchers to accelerate their analysis of the July patches, hunting for the root cause of CVE-2026-50393. While Microsoft’s reticence about the driver is understandable, it also means that defenders lack the detail needed to write detection rules. Organizations with mature security operations should monitor for any newly published IOCs or YARA rules from trusted threat intelligence providers in the coming weeks.

The good news: patch rates for supported Windows versions have been high in recent cycles, and deployment tools make it easier than ever to push updates quickly. If your systems are set to auto-update, you are likely already protected. If you manage a fleet, take the time this week to verify build numbers — because a kernel escalation bug with a CVSS of 7.0 is not something you want lingering on your network.