Microsoft Fixes Windows COM Privilege Escalation Flaw CVE-2026-105533

Microsoft released a fix for CVE-2026-105533, a Windows COM elevation-of-privilege vulnerability that could allow an attacker with low privileges to elevate privileges locally. Microsoft rates the flaw Important, with a CVSS v3.1 base score of 7.0. Exploitation requires high attack complexity but no user interaction, with potentially high impacts on confidentiality, integrity, and availability. At initial publication, Microsoft reported no public disclosure or observed exploitation and assessed exploitation as less likely.

The vulnerability involves an invalid pointer or reference release, classified as CWE-763. MITRE describes this weakness as releasing memory with an incorrect function or using a valid release function incorrectly, potentially causing memory corruption, crashes, or unauthorized code execution. Security teams should consult Microsoft's advisory to identify affected Windows versions and applicable updates, then deploy the official fix through their patch-management process; the supplied advisory details do not specify affected versions or update packages.