CVE-2026-20810

Published: Jan 13, 2026Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Affected (5)

Products: Microsoft: Windows 10 1809, Windows 10 21h2, Windows 10 22h2, Windows Server 2019

4 products

Windows 10 1809

Windows 10 21h2

Windows 10 22h2

Windows Server 2019

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 10 1809	Before 10.0.17763.8276
Microsoft Windows 10 1809	Before 10.0.17763.8276
Microsoft Windows 10 21h2	Before 10.0.19044.6809
Microsoft Windows 10 22h2	Before 10.0.19045.6809
Microsoft Windows Server 2019	Before 10.0.17763.8276

Related CWEs

Free of Memory not on the Heap

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20810

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.