Loading vulnerability…
Local Privilege Escalation in Windows COM
CVE-2026-105533 is a local elevation-of-privilege vulnerability in Windows COM caused by the release of an invalid pointer or reference. An authenticated, low-privileged attacker can exploit the flaw to obtain elevated privileges without user interaction. Exploitation has high attack complexity; the specific vulnerable function, affected Windows versions, and resulting privilege level are not identified. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 7.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits local privilege escalation, with potentially high impacts on confidentiality, integrity, and availability. The exact privilege level obtainable is not specified.
Patch, then assume compromise.
Apply the applicable Microsoft security update. An official fix is available; consult Microsoft's per-CVE Security Update Guide entry to identify the appropriate update for the installed Windows version and architecture. Specific fixed versions and update package identifiers are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.