CVE-2026-85911
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Risk Assessment
This flaw allows an attacker with valid credentials to escalate privileges, potentially leading to system and data compromise.
Recommendation
Apply Microsoft patches for Windows StateRepository API and enforce least privilege for local accounts.
Other vulnerabilities in Windows StateRepository API
See all- CVE-2026-85910Medium
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. The vulnerability may result in leakage of memory data.
- CVE-2026-70218High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-102216High
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-49170High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS