CVE-2026-77905

CVE-2026-77905 is a use-after-free memory corruption flaw (CWE-416) in the Windows Management Instrumentation (WMI) component of Microsoft Windows. A local, authorized attacker with low privileges can trigger the flaw, which requires a high-complexity set of conditions (likely a timing/state race in freed-memory handling) but no user interaction. Successful exploitation yields a local elevation of privilege with high impact on confidentiality, integrity, and availability, typically meaning code execution at elevated (e.g., SYSTEM-level) rights. All Windows systems running the affected WMI component are affected; the specific affected Windows versions/builds are not listed in the available data and should be confirmed against Microsoft's advisory. Exploitation status is currently quiet: no public proof-of-concept, not listed in CISA KEV, and a low ~0.2% EPSS probability of exploitation in the next 30 days.

What to do: Deploy Microsoft's Windows security update for CVE-2026-77905 from the relevant monthly cumulative update; because the available data does not list affected builds, verify the exact affected version range in Microsoft's advisory before scoping. Prioritize patching systems where low-privileged or untrusted users obtain interactive logon (workstations, RDS/terminal servers, shared kiosks), since the flaw is a local elevation of privilege. No public exploit or workaround is known; restricting local logon rights on sensitive hosts reduces practical risk while updates are rolled out.