CVE-2026-65780

You are looking at CVE-2026-65780, a double-free in Windows Autopilot affecting Windows 11 24H2. The vulnerability requires local access and executes during Autopilot's elevated provisioning phase — the window when the system installs certificates, registers MDM enrollment, and applies hardware configuration. That elevation is the attack surface: an authorized local attacker who triggers the double-free can escalate to SYSTEM, and on an Autopilot-managed device, SYSTEM means access to enrollment tokens, MDM policies, and enterprise certificates. That's not a local denial of service — it's a beachhead for lateral movement into cloud resources. The most critical question the disclosure doesn't answer: does this double-free trigger only during initial device provisioning, or does Autopilot re-enter elevated provisioning modes during policy refresh, enrollment re-registration, or diagnostic collection on already-deployed devices? If the vulnerable code path executes every time Group Policy refreshes or MDM enrollment re-cycles on a live enterprise device, the blast radius isn't limited to devices being set up — it's every Autopilot-managed device in your fleet, perpetually exposed. The 24H2-specific timing is analytically significant. This vulnerability appeared in a specific OS version, which means either new code was shipped with inadequate review, or 24H2 architectural changes reactivated a previously dormant double-free path. Provisioning subsystems across Windows have a documented history of double-free and use-after-free vulnerabilities during privilege transition phases — this is a known-bug-prone component class, not a surprise. The appropriate engineering response to any architectural change in this pipeline should trigger memory safety review as a matter of process. Your priority: determine whether any 24H2 devices in your environment have been Autopilot-provisioned since the vulnerable version landed. Devices provisioned before the patch exist in a time-indexed exposure window that cannot be recovered — they've accumulated vulnerability time that freshly reimaged devices haven't. If the double-free triggers during routine post-provisioning operations, the exposure window isn't limited to the provisioning phase at all; it's continuous. Patch immediately, and treat your Autopilot provisioning pipeline as a known-vulnerable component requiring elevated scrutiny on any future architectural changes.

Reviewed through automated stages and approved by a human before publication.