CVE-2026-24292: 
vulnerability analysis and mitigation

CVE-2026-24292 is a use-after-free vulnerability in the Windows Connected Devices Platform Service (Cdpsvc) that allows an authorized local attacker with low privileges to elevate their access to SYSTEM level. Disclosed on March 10, 2026, as part of Microsoft's Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2019, Windows Server 2022, and Windows Server 2025. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-416 (Use After Free), meaning the Connected Devices Platform Service (Cdpsvc) accesses memory after it has been freed, creating a condition that can be leveraged to corrupt memory and redirect execution flow. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has a foothold on the system. No public proof-of-concept or detailed technical write-up has been identified at this time (Microsoft MSRC).

Successful exploitation allows a low-privileged local attacker to escalate to SYSTEM-level privileges, resulting in high confidentiality, integrity, and availability impact on the affected host. This could enable an attacker to install malware, modify system configurations, access sensitive data, disable security controls, and potentially use the compromised system as a pivot point for lateral movement within the network. The broad scope of affected products — spanning consumer and server Windows editions — amplifies the potential attack surface (Microsoft MSRC).

Microsoft released patches on March 10, 2026. Administrators should apply the following updates or later versions:

• Windows 10 1809 / Windows Server 2019: 10.0.17763.8511
• Windows 10 21H2: 10.0.19044.7058
• Windows 10 22H2: 10.0.19045.7058
• Windows 11 23H2: 10.0.22631.6783
• Windows 11 24H2: 10.0.26100.7979
• Windows 11 25H2: 10.0.26200.7979
• Windows 11 26H1: 10.0.28000.1719
• Windows Server 2022: 10.0.20348.4830
• Windows Server 2022 23H2: 10.0.25398.2207
• Windows Server 2025: 10.0.26100.32463

As a defense-in-depth measure, enforce the principle of least privilege to limit the impact of low-privileged accounts, and monitor for suspicious privilege escalation activity targeting the Cdpsvc service (Microsoft MSRC).

The vulnerability was covered as part of broader March 2026 Patch Tuesday roundups by multiple security outlets. Rapid7, Sophos, Zero Day Initiative, and SANS ISC all published summaries of the March 2026 update cycle, noting the overall patch batch addressed 79 vulnerabilities including two zero-days (unrelated to this CVE). No specific researcher commentary or notable social media discussion focused exclusively on CVE-2026-24292 has been identified (Rapid7 Blog, Sophos Blog, ZDI Blog).