# CVE-2026-45592 — Windows WinINet `wininet.dll` Cache-Server Reference-Count Integer Overflow → Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `wininet.dll` (WinINet; Internet Extensions for Win32) |
| **CVE ID** | CVE-2026-45592 |
| **Impact** | Elevation of Privilege |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-190: Integer Overflow → CWE-416: Use After Free |
| **Delivery** | Local — driving the WinINet cache-server reference count to overflow |
| **KB / Fixed build** | KB5094126 — `wininet.dll` 11.00.26100.8655 (Win11 24H2 x64) |
| **Patch Date** | June 9, 2026 (2026-Jun) |
| **Pre-patch binary** | `wininet.dll` 11.00.26100.8521 — SHA256 `ad38732ec46ee9f3ffe7eeabd8cfdcda30473738ed22f15c8220c5ce63a529fd` |
| **Post-patch binary** | `wininet.dll` 11.00.26100.8655 — SHA256 `cf280341b2118571a7021861bab524b3fcc20f83db3d45baf27cec386ee819a1` |
| **Feature flag** | `Feature_3431463225` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

> Version note: `wininet.dll` uses the IE-heritage version scheme (`11.00.26100.x`),
> not `10.0.26100.x` — the `26100.8521 → 26100.8655` pair is the May→June 24H2 build
> (KB5089573 → KB5094126).

---

## Product Description

`wininet.dll` is the WinINet library. Its global HTTP/URL **cache server**
(`CCacheServer`) is reference-counted through process-global counters
(`g_ulStrongReferences`, `g_ulWeakReferences`).
`CCacheServer::StrongReferenceGlobalCacheServer` / `WeakReferenceGlobalCacheServer`
increment them; `StrongReleaseGlobalCacheServer` / `WeakReleaseGlobalCacheServer`
decrement them and **free** the `CCacheServer` when the strong count reaches 0.

---

## Vulnerability Summary

Pre-patch, the reference counters were **32-bit** and incremented **without an
overflow check** (`g_ulStrongReferences = g_ulStrongReferences + 1`). A caller taking
a very large number of references could therefore **wrap the 32-bit counter back to
0** (CWE-190). A subsequent `Release` then observes the count as `0` and **frees the
still-referenced `CCacheServer`**, while other references remain outstanding — a
use-after-free of the cache server (CWE-416), exploitable locally for elevation of
privilege (`AC:H` reflects the effort to drive the overflow / win the resulting
window).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H`: repeatedly reference the WinINet
  global cache server to overflow the 32-bit counter.
- Result: a `Release` frees the cache server while references are still held → UAF.

---

## Vulnerability Details

### Root Cause

The cache-server reference counters were 32-bit and incremented unchecked, so the
count could wrap to 0 and a `Release` would free an object that was still referenced.

### The patch (confirmed — diff, .8521 → .8655)

Gated behind `Feature_3431463225`, the reference counters are **widened to 64-bit**
(`g_ullStrongReferences` / `g_ullWeakReferences`) and the increment is **saturated**
so it cannot wrap, with the counter access serialized under `AutoCritSec`:

```c
// CCacheServer::StrongReferenceGlobalCacheServer (11.00.26100.8655) — PATCHED (from the diff)
AutoCritSec::Lock(&lock);
// pre : g_ulStrongReferences = g_ulStrongReferences + 1;           // 32-bit, unchecked
if (!Feature_3431463225__private_IsEnabled()
        || g_ullStrongReferences != 0xffffffffffffffff) {           // *** saturating, 64-bit ***
    g_ullStrongReferences = g_ullStrongReferences + 1;
}
AutoCritSec::Unlock(&lock);

// WeakReferenceGlobalCacheServer — same widening + saturation for g_ullWeakReferences
// Strong/WeakReleaseGlobalCacheServer — decrement the widened g_ull* counters
```

With 64-bit counters that saturate at their maximum instead of wrapping, the strong
count can no longer erroneously reach 0 while references are outstanding, so the
cache server is not prematurely freed — closing the overflow-to-use-after-free.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3431463225`.** The 64-bit saturating reference counting
runs only when the flag is enabled; the original 32-bit unchecked increment still
ships when disabled. Verify `Feature_3431463225` is enabled to confirm the fix is
live.

---

## Detection Guidance

**Behavioural.** Processes taking anomalously large numbers of WinINet cache-server
references; use-after-free / heap-corruption crashes in
`wininet!CCacheServer::StrongReleaseGlobalCacheServer` /
`StrongReferenceGlobalCacheServer` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_3431463225` is enabled.

---

## References

- MSRC advisory — CVE-2026-45592 (Windows WinINet Elevation of Privilege), released 2026-06-09, KB5094126.
- Full binary diff: `/data/patch_diffs/wininet_dll-cve-2026-45592-ghidriff.md`