Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

Use-after-free (CWE-416) via a race (CWE-362) in the Windows Work Folders service workfolderssvc.dll SyncShare partnership-manager connection point, local EoP to SYSTEM. workfolderssvc.dll exposes CSyncSharePartnershipManagerInternal, a COM connection point (IConnectionPointImpl) whose clients Advise (register a notification sink) and Unadvise (unregister). PRE: access to the connection point's sink list in Advise/Unadvise was not synchronized against concurrent Advise/Unadvise or notification dispatch, so a racing Unadvise could free a sink while another path (a concurrent Advise, or a notification being delivered) still referenced it - a use-after-free of the sink/partner object. Because the service runs as SYSTEM and the Advise/Unadvise interface is reachable by a local user, winning the race is a local EoP-to-SYSTEM primitive. Diff of workfolderssvc.dll 10.0.26100.8972 -> .9168 (Aug 11 2026, KB5121003) confirms the fix: gated behind CFR flag Feature_4078422328, CSyncSharePartnershipManagerInternal::Advise and ::Unadvise are reworked to serialize access to the connection-point sink list with an exclusive lock (a lock_exclusive / SRW-lock guard is introduced and used, with associated RAII lock wrappers added) before registering/unregistering the sink, so a sink cannot be freed while another Advise/Unadvise or dispatch path is using it, closing the race/UAF.

Concurrent Advise/Unadvise on the Work Folders sync connection point frees a sink while another path uses it

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Jongseong Kim (nevul37), SEC-agent team
Hwiwon Lee (hwiwonl), SEC-agent team
Younggi Park (grill66), SEC-agent team
Dongjun Kim (smlijun), SEC-agent team