CVE-2026-49798

Windows has a central “core” area that everything depends on. This bug is a memory handling mistake (use-after-free) in that core, which can let someone who already has a way onto the machine gain much higher control than they should.

This matters if you run Windows 10, Windows 11, or the specified Windows Server versions listed with this CVE. Because the weakness is local, it’s primarily a risk for devices where an attacker can already get local access (for example, someone physically at the computer, someone who can log on locally, or malware already present). The risk is meaningful only if the attacker can reach the machine locally; otherwise remote access alone isn’t indicated by the findings.

This should be treated as urgent because it’s a kernel-level privilege escalation issue that can lead to full control of the affected Windows machine. Even though there’s no clear report of real-world exploitation in the provided articles, the impact is severe and a fix is already available.