CVE-2026-85795
7.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
A local attacker with an existing user account can gain SYSTEM privileges. No user interaction or network exposure is needed.
Root cause
A use-after-free bug in the Windows Text Services Framework mishandles memory references during text processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for Windows Text Services Framework referenced in the MSRC advisory; no viable workaround is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85795Vendor AdvisoryPatch