CVE-2026-65780 in Windows
Summary
by MITRE • 08/12/2026
Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical heap corruption issue within the Windows Autopilot feature that enables authenticated attackers to achieve local privilege escalation through a double free memory corruption flaw. The vulnerability stems from improper memory management during the autopilot provisioning process where the system fails to properly validate or track memory allocations, leading to situations where the same memory block can be freed twice. This type of vulnerability falls under CWE-415 which specifically addresses double free conditions in memory management, making it a classic example of heap corruption that can be exploited for privilege escalation.
The technical exploitation of this vulnerability requires an attacker to first obtain valid user credentials since Autopilot provisioning typically operates with elevated privileges during device setup and configuration phases. During the autopilot process, when certain provisioning parameters are processed or validated, the system may encounter scenarios where memory allocated for processing these parameters gets freed from one location in memory while simultaneously being referenced from another location, creating a race condition that allows attackers to manipulate the heap state. This manipulation can result in arbitrary code execution within the context of the privileged Autopilot process, which typically runs with SYSTEM level privileges.
The operational impact of this vulnerability extends beyond simple privilege escalation as it provides attackers with persistent access to systems during the critical provisioning phase when devices are being configured for enterprise deployment. Attackers can leverage this vulnerability to inject malicious code that persists across reboots or system updates, potentially compromising entire device fleets managed through Autopilot. The exploitation typically follows a pattern where the attacker triggers the vulnerable code path through specially crafted provisioning requests or configuration files that force the system into the double free condition. This vulnerability is particularly concerning in enterprise environments where Autopilot is widely used for deploying Windows 10 and Windows 11 devices at scale, as it could enable attackers to compromise multiple devices during their initial provisioning cycle.
Mitigation strategies should focus on immediate patching of affected Windows versions through Microsoft security updates that address the heap management issues within Autopilot. Organizations should also implement network segmentation and access controls to limit which users can initiate Autopilot provisioning processes, reducing the attack surface for exploitation. Monitoring systems should be configured to detect unusual Autopilot activity or provisioning requests that might indicate exploitation attempts. Additionally, implementing application control measures such as Windows Defender Application Control or similar technologies can prevent unauthorized code execution during the provisioning process. From a defensive perspective, this vulnerability aligns with ATT&CK technique T1068 which covers local privilege escalation through heap corruption, and represents a significant threat to enterprise security posture during device deployment phases where proper authentication and authorization controls may be temporarily relaxed.