CVE-2026-20844CWE-362CWE-416

CVE-2026-20844

High · published January 13, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

🚨 A sneaky use-after-free flaw in the Windows Clipboard Server could let an unauthorized attacker elevate their privileges locally—yikes! ⚡ Think of this like a restaurant where the chef leaves the kitchen door unlocked. A hungry patron (the attacker) can just stroll in and access all the fancy chef tools, potentially making a mess of things without permission! If an attacker successfully exploits this vulnerability, they could gain elevated privileges, allowing them to access sensitive system information and perform actions they shouldn't have permission for. This could lead to data breaches or system corruption, causing absolute chaos in your environment!

Put simply

Think of this like a restaurant where the chef leaves the kitchen door unlocked. A hungry patron (the attacker) can just stroll in and access all the fancy chef tools, potentially making a mess of things without permission! This use-after-free vulnerability occurs when the Clipboard Server fails to properly manage memory, allowing an attacker to manipulate system privileges by exploiting freed memory areas. Since this flaw doesn't require authentication, it is particularly concerning for systems where user access is not tightly monitored.

What to do

If an attacker successfully exploits this vulnerability, they could gain elevated privileges, allowing them to access sensitive system information and perform actions they shouldn't have permission for. This could lead to data breaches or system corruption, causing absolute chaos in your environment! To secure your system, ensure you apply the latest patches from Microsoft as soon as they are available. Regularly audit user permissions to prevent unauthorized access, and consider implementing advanced security measures like endpoint protection. Stay vigilant! You've got this! With the right steps, you can lock down your systems and keep those sneaky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.4th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-01-13T23:16Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Clipboard Server Elevation of Privilege Vulnerability
    cvelistv5