# CVE-2026-45597 — Windows UI Automation Manager `uiamanager.dll` Unsynchronized Automation-Connection Map → Race Condition

---

## Summary

| | |
|---|---|
| **Product** | Windows — `uiamanager.dll` (UI Automation Manager) |
| **CVE ID** | CVE-2026-45597 |
| **Impact** | Elevation of Privilege (low integrity → medium integrity) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-362: Race Condition (improper synchronization of a shared resource) |
| **Delivery** | Local — concurrent UI Automation connection operations (race) |
| **KB / Fixed build** | KB5094126 — `uiamanager.dll` 10.0.26100.8655 (Win11 24H2 x64) |
| **Patch Date** | June 9, 2026 (2026-Jun) |
| **Pre-patch binary** | `uiamanager.dll` 10.0.26100.8521 — SHA256 `77ecb65f6e26b8e6fc7d4c3adf7ea52a822d22ee5a9d2d09c250d3678b247d37` |
| **Post-patch binary** | `uiamanager.dll` 10.0.26100.8655 — SHA256 `cfb6356001ac7b1fb51e2224fecfdd57acf384fa8b3dfdc4b3c295fbcc787be6` |
| **Feature flag** | `Feature_2358244664` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`uiamanager.dll` is the **UI Automation Manager**, which brokers UI Automation
connections across processes and app-container (VAIL) boundaries. It tracks
automation endpoints and container named pipes in a shared map
(`ThreadSafeMap<_GUID, wil::com_ptr<IWeakReference>>`). Entries are **added** by
`UiaManagerImpl::CreateAutomationConnection`, **looked up** by
`GetEndpointProcessInfo`, and **removed** by `RemoveNamedPipeFromVailContainer` /
`RemoveNamedPipe`.

---

## Vulnerability Summary

Pre-patch, access to that shared map was **not synchronized**. Concurrent
add/remove/lookup operations could therefore run at once, racing on the map —
corrupting it or using a stale/invalid entry (CWE-362). Because the manager brokers
automation connections across integrity/container boundaries, a low-integrity (e.g.
sandboxed) process could win the race to elevate to **medium integrity** (per the
MSRC FAQ); `AC:H` reflects the need to win the race.

---

## Prerequisites and Constraints

- Local, low-privileged / low-integrity (`PR:L`, `AV:L`); `AC:H` — must win a race
  between concurrent operations on the automation-connection map.
- Drive `CreateAutomationConnection` / `RemoveNamedPipeFromVailContainer` /
  `GetEndpointProcessInfo` concurrently on the same map.
- Result: the shared map is corrupted / a stale entry is used.

---

## Vulnerability Details

### Root Cause

The shared automation-connection / container map was mutated and read by concurrent
operations without a lock, so add/remove/lookup could race.

### The patch (confirmed — diff, .8521 → .8655)

Gated behind `Feature_2358244664`, access to the shared map is **serialized with a
mutex / critical section**:

```c
// ThreadSafeMap<_GUID, com_ptr<IWeakReference>> (10.0.26100.8655) — PATCHED (from the diff)
std::_Mutex_base::lock(map_mutex);
... map insert / lookup / erase ...
_Mtx_unlock(map_mutex);

// UiaManagerImpl::RemoveNamedPipeFromVailContainer (.8655) — PATCHED
if (Feature_2358244664__private_IsEnabled()) {
    std::_Mutex_base::lock(map_mutex);          // *** serialize removal ***
    ... remove named pipe / container entry ...
    _Mtx_unlock(map_mutex);
}

// UiaManagerImpl::CreateAutomationConnection — uses a CRITICAL_SECTION around the insert
```

With the map operations taking the mutex (and connection creation under a critical
section), concurrent add/remove/lookup no longer race, closing the condition.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2358244664`.** The serialization runs only when the flag
is enabled; the original unsynchronized path still ships when disabled. Verify
`Feature_2358244664` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Rapid/concurrent UI Automation connection create/remove operations
(especially from low-integrity / app-container processes); use-after-free or
map-corruption crashes in `uiamanager!UiaManagerImpl::RemoveNamedPipeFromVailContainer`
/ `CreateAutomationConnection` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_2358244664` is enabled.

---

## References

- MSRC advisory — CVE-2026-45597 (UI Automation Manager Elevation of Privilege), released 2026-06-09, KB5094126.
- Full binary diff: `/data/patch_diffs/uiamanager_dll-cve-2026-45597-ghidriff.md`