Elevation of Privilege Vulnerability in Windows WalletService by Microsoft
CVE-2026-32080

7HIGH

Key Information:

Vendor

Microsoft
Status
Windows Server 2016
Windows Server 2016 (server Core Installation)
Windows Server 2019
Windows Server 2019 (server Core Installation)
Vendor
CVE Published:
14 April 2026

What is CVE-2026-32080?

The Windows WalletService contains a vulnerability that allows an attacker with authorized access to escalate their privileges locally. This issue stems from improper handling of memory, specifically a use-after-free condition that can be exploited to gain elevated permissions on the affected system. Organizations using impacted versions are advised to apply security patches to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Windows Server 2016 (Server Core installation) x64-based Systems 10.0.14393.0 < 10.0.14393.9060

Windows Server 2016 x64-based Systems 10.0.14393.0 < 10.0.14393.9060

Windows Server 2019 (Server Core installation) x64-based Systems 10.0.17763.0 < 10.0.17763.8644

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.