CVE-2026-45597: Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability

Synopsis

A race condition in the Windows UI Automation Manager component (uiamanager.dll) allows a local attacker with a low-privilege account to elevate their privileges on affected Windows 11 and Windows Server 2022/2025 systems. The flaw is reached locally, requires no network exposure, and is triggered by manipulating shared resources during concurrent execution, which demands precise timing but no additional credentials. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no admin credentials are needed to attempt exploitation.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is required; the attacker operates independently.

• Attack complexityDetail

  Exploitation requires winning a race condition over shared resources during concurrent execution, meaning timing and environmental factors must align for a reliable attack.

Blast Radius

• A successful attacker reads files, credentials, and sensitive data accessible only to higher-privilege accounts on the host.
• The attacker can modify or overwrite protected system files, registry entries, or application data that low-privilege users cannot normally touch.
• The attacker can crash or destabilize system services, causing denial of service on the affected host.
• Because all three impact dimensions (confidentiality, integrity, availability) are rated HIGH, the attacker effectively gains full control over the compromised system context.