CVE-2026-32159: 
vulnerability analysis and mitigation

CVE-2026-32159 is a race condition and use-after-free vulnerability in the Windows Push Notifications service that allows a low-privileged, authenticated local attacker to escalate privileges. Disclosed on April 14, 2026, as part of Microsoft's Patch Tuesday release, it affects a broad range of Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, 2022 23H2, and Windows Server 2025. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC, GitHub Advisory).

The vulnerability is rooted in improper synchronization of concurrent execution using a shared resource within the Windows Push Notifications service, classified as CWE-362 (Race Condition) and CWE-416 (Use After Free). A timing window exists in which a shared resource can be modified by a concurrently executing code sequence, enabling an attacker to trigger a use-after-free condition. Exploitation requires local access with low privileges and no user interaction, but the attack complexity is rated High, indicating that the race condition must be won within a specific timing window. The scope is marked as Changed, meaning successful exploitation can affect resources beyond the vulnerable component itself (Microsoft MSRC, GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to escalate privileges to SYSTEM level, resulting in complete compromise of the affected Windows system. The impact is rated High across confidentiality, integrity, and availability — an attacker could access sensitive data, modify or delete system files, and disrupt system functionality. The Changed scope indicates that the privilege escalation can extend beyond the Push Notifications service itself, potentially enabling lateral movement or persistence on the compromised host (Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Microsoft MSRC). The EPSS score is approximately 0.036–0.047%, placing it in the lower percentiles for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Microsoft released security patches on April 14, 2026, addressing this vulnerability across all affected Windows versions. Administrators should apply the relevant cumulative updates to reach the following patched build numbers: Windows 10 1809 (10.0.17763.8644), Windows 10 21H2 (10.0.19044.7184), Windows 10 22H2 (10.0.19045.7184), Windows 11 23H2 (10.0.22631.6936), Windows 11 24H2 (10.0.26100.8246), Windows 11 25H2 (10.0.26200.8246), Windows 11 26H1 (10.0.28000.1836), Windows Server 2019 (10.0.17763.8644), Windows Server 2022 (10.0.20348.5020), Windows Server 2022 23H2 (10.0.25398.2274), and Windows Server 2025 (10.0.26100.32690). As a defense-in-depth measure, organizations should enforce the principle of least privilege for local user accounts to reduce the attack surface (Microsoft MSRC).

The vulnerability was covered as part of broader April 2026 Patch Tuesday roundups by security vendors including Rapid7, Sophos, and NSFOCUS, which highlighted it among the high-severity elevation-of-privilege issues addressed that month (Rapid7 Blog, Sophos Blog, NSFOCUS Advisory). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard Patch Tuesday coverage.