CVE-2026-50454: Public PoC Shows Windows AppResolver Elevation of Privilege to SYSTEM
Do Son 
- CVE: CVE-2026-50454
- CVSS: 7.8 (High · CVSSv3)
- Product: Microsoft Windows 11 Version 24H2
- Affected: 10.0.26100.0, 10.0.26200.0, 10.0.28000.0
- Impact: Windows User Interface Core Elevation of Privilege Vulnerability
- Status: No confirmed exploitation yet
- Patched in: 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525, 10.0.26100.33158
- EPSS: 0.4% (30-day)
- Action: Update to 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525, 10.0.26100.33158 now
TL;DR
A researcher has published a write-up and proof-of-concept code for the Windows AppResolver LPE. The chain abuses a missing capability check in Windows.UI.Storage.dll to bypass UAC and reach a SYSTEM shell. Microsoft fixed the underlying component in the July 2026 update, tracked in part as CVE-2026-50454.
Why it matters
UAC is a core trust boundary on Windows, and many attacks stall at it. A clean UAC bypass removes that hurdle. It lets code run with full admin rights and no consent prompt. From there, the jump to SYSTEM is short.
Researcher David Carliez disclosed the flaw and released the proof-of-concept on GitHub. Because the code is public, defenders and attackers can both study it. Public exploit code usually shortens the path to real-world abuse. So far, though, no one has confirmed exploitation in the wild.
One caveat matters a lot. This is not a standard-user-to-SYSTEM bug. The starting account must already sit in the local Administrators group. It runs with its normal filtered token, which UAC would otherwise hold in check.
How the attack works
The weakness sits in a private WinRT class that builds AppResolver objects. On vulnerable builds, a zero-capability AppContainer could call this factory without the required check. The security boundary crossed is the AppContainer capability check. In this chain, that primitive works as a UAC bypass rather than a fresh grant of admin rights.
The attacker registers a protocol handler, then makes it the protected default for ms-settings. Next, the auto-elevated fodhelper.exe resolves that protocol. As a result, the attacker’s handler runs at High integrity without a prompt.
From there, the High-integrity process creates a short-lived service. Windows starts that service as SYSTEM. The PoC then places an interactive command prompt in the user’s desktop session. The researcher shares the mechanism only, and this report does not repeat the exploit steps.
Affected versions
The Windows AppResolver LPE affects Windows 11 25H2 before the July 2026 cumulative update. The researcher confirmed the flaw on build 26100.8737. The patched build 26100.8875 returns an access-denied error and blocks the trigger.
A note on CVE attribution
Attribution here is not clean. Microsoft‘s public record for CVE-2026-50454 describes relative path traversal and file deletion. The proof-of-concept does neither. Instead, it shows a missing AppResolver capability check in the same component, fixed by the same update. The researcher therefore presents it as an AppResolver issue closed by the July 2026 update, not as proof of the advisory’s stated root cause.
Patch and mitigation steps
Install the July 2026 Windows security update or a later cumulative update. On the systems tested, build 26100.8875 contains the fix. Application control policies add further protection. They can block PowerShell, AppContainer creation, or service creation in the chain.
Given the public PoC, teams should patch without delay.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
