CVE-2026-72958 in Windows
Summary
by MITRE • 09/09/2026
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a double free error within the Microsoft Windows Credential Guard subsystem represents a critical memory corruption flaw that can be exploited by authenticated local attackers to achieve arbitrary code execution with elevated system privileges. This specific type of heap-based buffer overflow occurs when the software incorrectly handles deallocation operations, specifically allowing two separate pointers to reference and subsequently release the same block of allocated memory. In the context of Windows Credential Guard, which relies on hardware-assisted virtualization technologies such as Intel Virtualization-Based Security or AMD Secure Encrypted Virtualization to isolate sensitive credentials from the host operating system, this flaw undermines the integrity of the isolation boundary. The vulnerability arises during the cleanup phase of credential processing operations where memory management routines fail to verify whether a pointer has already been freed before attempting to release it again. This logical error leads to undefined behavior within the kernel-mode execution environment, potentially corrupting heap metadata structures that govern how memory blocks are allocated and tracked by the operating system's memory manager.
From an operational perspective, this vulnerability allows an attacker who possesses valid local credentials on a vulnerable Windows machine to escalate their privileges from standard user rights to those of SYSTEM or NT AUTHORITY\SYSTEM. By carefully crafting malicious input that triggers the double free condition during credential validation processes, such as when interacting with Kerberos tickets or other authentication protocols managed by Credential Guard, the attacker can manipulate heap metadata to gain control over execution flow. This typically involves overwriting function pointers or object vtables stored in adjacent memory regions, thereby redirecting program execution to shellcode injected into the process space. The impact is severe because it bypasses many standard security controls that rely on user-level isolation, effectively neutralizing one of Windows' primary defenses against credential theft and lateral movement attacks. Systems running affected versions of Windows are at significant risk during periods where users authenticate using network credentials or when automated services interact with identity providers, as these scenarios frequently invoke the vulnerable code paths within the Credential Guard infrastructure.
Industry standards classify this flaw under CWE-415, which denotes Double Free vulnerabilities, a category of memory safety issues that consistently lead to privilege escalation and remote code execution in complex software systems like operating system kernels. The exploitation technique aligns with MITRE ATT&CK tactic T1068, specifically the subtechnique for Exploitation for Privilege Escalation, where attackers leverage specific application or OS flaws to gain higher-level access than initially granted. Furthermore, this vulnerability impacts the confidentiality and integrity aspects of security as defined by common frameworks, potentially allowing adversaries to extract stored credentials such as NTLM hashes or Kerberos tickets from memory if they can achieve code execution within the isolated environment before the double free causes a crash or further corruption. The presence of such flaws in core authentication components highlights the complexity of maintaining secure boundaries between user-mode applications and kernel-mode services that handle sensitive identity data.
Mitigation strategies primarily involve applying vendor-supplied security patches as soon as they become available, which correct the memory management logic to ensure proper pointer validation before deallocation. Organizations should prioritize patching systems where Credential Guard is enabled or where local administrative privileges are granted to untrusted users, particularly in environments handling high-value intellectual property or sensitive government data. In addition to timely patching, implementing strict application whitelisting and restricting user rights can reduce the attack surface by limiting who can trigger authentication processes that interact with vulnerable components. Security teams should also monitor for anomalous process creation events originating from system-level services such as lsass.exe or svchost.exe hosting Credential Guard modules, as these may indicate attempted exploitation of this vulnerability. Regular auditing of patch compliance and enforcing least-privilege principles remain essential defenses against memory corruption exploits that target core operating system functionalities.