OnlyPatch
UI Automation Manager (uiamanager.dll)

CVE-2026-45597 — Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00186 🔬 Patch diffed 2026-06 archive

Executive Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in UI Automation Manager (uiamanager.dll) allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Released Jun 9 2026
Last Updated Jun 9 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00186 — 0.08483 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00186
probability of exploitation in the next 30 days
0.08483 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

12 affected products
Product KB Article Severity Impact Restart Required
Windows 11 Version 23H2 for ARM64-based Systems 5093998 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5093998 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5094126 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5094126 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5094126 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5094126 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 26H1 for ARM64-based Systems 5095051 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5095051 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5094128 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5094128 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5094125 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5094125 (Security Update) Important Elevation of Privilege Yes

Patches

5 patches
Article Type Restart
5093998 Security Update Yes
5094126 Security Update Yes
5095051 Security Update Yes
5094128 Security Update Yes
5094125 Security Update Yes

Patch Diff

ghidriff · uiamanager.dll (KB5094126)

Race condition (CWE-362) in the Windows UI Automation Manager uiamanager.dll shared automation-connection / VAIL-container map, local EoP (low integrity -> medium integrity). uiamanager.dll brokers UI Automation connections across processes / app-container (VAIL) boundaries; it tracks automation endpoints and container named pipes in a shared map (ThreadSafeMap<GUID, wil::com_ptr<IWeakReference>>). Operations that add (UiaManagerImpl::CreateAutomationConnection), look up (GetEndpointProcessInfo) and remove (RemoveNamedPipeFromVailContainer / RemoveNamedPipe) entries ran concurrently. PRE: access to that shared map was not synchronized, so concurrent add/remove/lookup could race - corrupting the map or using a stale/invalid entry - a race exploitable by a low-integrity (e.g. sandboxed) process to elevate to medium integrity (AC:H). Diff of uiamanager.dll 10.0.26100.8521 -> .8655 (Jun 9 2026, KB5094126) confirms the fix: gated behind CFR flag Feature_2358244664, access to the shared map is serialized with a mutex - ThreadSafeMap operations now take std::_Mutex_base::lock / _Mtx_unlock, RemoveNamedPipeFromVailContainer acquires the mutex around the removal, and CreateAutomationConnection uses a critical section - so concurrent map operations no longer race.

Pre-patch version 10.0.26100.8521 Download
Post-patch version 10.0.26100.8655 Download
Function Address Change Note
UiaManagerImpl::RemoveNamedPipeFromVailContainer code change code (map removal under mutex, CFR-gated) Post (Feature_2358244664): std::_Mutex_base::lock(map_mutex) ... _Mtx_unlock around removing the named pipe / container entry from the shared map.
ThreadSafeMap<_GUID, wil::com_ptr<IWeakReference>> code change code (map access serialized) Map accessors now take std::_Mutex_base::lock / _Mtx_unlock so the shared automation-connection/container map is genuinely thread-safe.
UiaManagerImpl::CreateAutomationConnection code change code (connection creation under critical section) Uses a CRITICAL_SECTION around the connection-map insertion so add races remove/lookup safely.
UiaManagerImpl::GetEndpointProcessInfo / RemoveNamedPipe / PublishServices / ShutdownServices code change code (endpoint/service map paths updated) Related endpoint lookup / service publish-shutdown paths updated to the synchronized map access under the same gate.
Feature_2358244664 gate added (CFR gate) CFR flag gating the mutex/critical-section serialization of the shared map; the original unsynchronized path still ships when disabled.
View full diff report View RCA report

Attack Path

Concurrent add/remove/lookup on the UI Automation connection map races, corrupting shared state

Attack path for CVE-2026-45597 Concurrent add/remove/lookup on the UI Automation connection map races, corrupting shared state 01 — ENTRY A low-integrity process drives UI Automation Manager connection operations uiamanager.dll CreateAutomationConnection / GetEndpointProcessInfo / RemoveNamedPipeFromVailContainer access a shared map of automation endpoints / container pipes. AV:L/PR:L/AC:H (race). 02 — CONTROLLED INPUT Issues concurrent add/remove/lookup on the same map Two operations touch the shared ThreadSafeMap<GUID, IWeakReference> at once. 03 — MISSING CHECK Shared map access unsynchronized (CWE-362) Concurrent modification/lookup corrupts the map or uses a stale/invalid entry. 04 — PATH Corrupted/stale automation-connection state is used The race lets a low-integrity caller influence cross-process automation-connection state. 05 — PRIMITIVE Race in UI Automation Manager -> EoP (low -> medium integrity) The Jun 2026 fix (Feature_2358244664) serializes the map with a mutex / critical section.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

Detection Rules

Acknowledgments

Anonymous

On This Page