CVE-2026-20844 — Windows Clipboard Server Elevation of Privilege Vulnerability

Executive Summary

Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally.

Overview

7.4

CVSS HIGH

Important

MS Severity

Not Exploited

MS Exploit Status

Less Likely

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-416: Use After Free

Released Jan 13 2026

Last Updated Jan 13 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

EPSS Score 0.00326 — 0.25396 percentile

NVD CVSS 7.4 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

ATTACK VECTOR

Local

ATTACK COMPLEXITY

High

PRIVILEGES REQUIRED

None

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 6.4

EPSS Score

0.00326

probability of exploitation in the next 30 days

0.25396 percentile - updated 2026-08-14

View on FIRST.org

Affected Products

25 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1607 for 32-bit Systems	`5073722 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1607 for x64-based Systems	`5073722 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for 32-bit Systems	`5073723 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for x64-based Systems	`5073723 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5073724 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5073724 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for x64-based Systems	`5073724 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5073724 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5073724 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for x64-based Systems	`5073724 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5073455 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for x64-based Systems	`5073455 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5074109 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for x64-based Systems	`5074109 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5074109 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for x64-based Systems	`5074109 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2016	`5073722 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2016 (Server Core installation)	`5073722 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019	`5073723 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019 (Server Core installation)	`5073723 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022	`5073457 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022 (Server Core installation)	`5073457 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022, 23H2 Edition (Server Core installation)	`5073450 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025	`5073379 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025 (Server Core installation)	`5073379 (Security Update)`	Important	Elevation of Privilege	Yes

Patches

8 patches

Article	Type	Restart
`5073722`	Security Update	Yes
`5073723`	Security Update	Yes
`5073724`	Security Update	Yes
`5073455`	Security Update	Yes
`5074109`	Security Update	Yes
`5073457`	Security Update	Yes
`5073450`	Security Update	Yes
`5073379`	Security Update	Yes

Patch Diff

ghidriff · clipboardserver.dll (KB5074109)

Use-after-free / race condition (CWE-416/CWE-362) in the Windows Clipboard Server clipboardserver.dll enterprise (EDP) clipboard-policy path, local EoP. The server evaluates the security policy of clipboard data WITHOUT holding the server SRW lock (at this+22) that guards the current clipboard data package (at this+25). In ClipboardServer::GetEnterpriseIdOfContent, EDPPolicyManager::GetEnterpriseIdFromDataPackage reads this+25 to extract the EnterpriseID unlocked; in GetContentInternal, UpdateEdpDataPackageLockState runs EDPPolicyManager::EvaluateClipboardReadPolicy (deciding the data lock) unlocked. If an attacker replaces the clipboard data package at the right moment, a TOCTOU/race arises between when the policy is checked and when the data is returned/released, so the server acts on the wrong (swapped/freed) package -> access without permission or invalid-pointer/UAF. IN-HOUSE ghidriff of clipboardserver.dll 10.0.26100.7309 -> .7623 (Jan 13 2026, KB5074109) confirms the fix: five locations across four functions (GetEnterpriseIdOfContent + new GetEnterpriseIdOfContentInternal, GetContentInternal, UpdateEdpDataPackageLockState) now acquire the SRW shared lock (SRWLock::LockShared / AcquireSRWLockShared on this+22) before the EnterpriseID lookup and EvaluateClipboardReadPolicy, gated behind CFR flag Feature_3404159289 (else = original unlocked path). Note: our x64 24H2 diff shows Feature_3404159289, differing from the circulated screenshots' Feature_3672594745 (build/arch difference); the lock-before-policy mechanism is identical. We ship what our diff shows.

Pre-patch version 10.0.26100.7309 Download

Post-patch version 10.0.26100.7623 Download

Function	Address	Change	Note
`ClipboardServer::GetEnterpriseIdOfContent`	`code change`	code (SRW shared lock before EnterpriseID lookup, CFR-gated)	Pre: EDPPolicyManager::GetEnterpriseIdFromDataPackage(v4,*(this+25),a2) with no lock. Post (Feature_3404159289 enabled): SRWLock::LockShared(this+22) then new GetEnterpriseIdOfContentInternal(this,a2); ReleaseSRWLockShared after. Feature-disabled path keeps the old unlocked call.
`ClipboardServer::GetEnterpriseIdOfContentInternal`	`new helper`	added (locked EnterpriseID read)	New internal helper that performs the EnterpriseID lookup while the server SRW shared lock is held, called from the patched GetEnterpriseIdOfContent.
`ClipboardServer::GetContentInternal`	`code change`	code (AcquireSRWLockShared before UpdateEdpDataPackageLockState, CFR-gated)	Post: AcquireSRWLockShared(this+22) before GetContentDetails and the UpdateEdpDataPackageLockState call, with ReleaseSRWLockShared after; gated by Feature_3404159289. Pre-patch the EDP read-policy path ran without the server lock.
`ClipboardServer::UpdateEdpDataPackageLockState`	`code change`	code (EvaluateClipboardReadPolicy under lock, CFR-gated)	Runs EDPPolicyManager::EvaluateClipboardReadPolicy on the computed EnterpriseID to decide the data lock; patched (Feature_3404159289) so it executes under the server SRW lock.
`Feature_3404159289`	`gate`	added (CFR gate)	CFR flag gating the SRW-lock-before-policy paths across the four functions; the original unlocked paths still ship in .7623.

View full diff report View RCA report

Attack Path

Clipboard Server evaluates EDP policy without its lock, so a swapped data package desyncs the policy check from the data use

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

No known exploits have been linked for this CVE yet. When available, exploit references will be sourced from public repositories and may be unverified, incomplete, or non-functional. Always review code carefully before use in any environment.

Acknowledgments

Anonymous

References

MSRC Advisory MITRE NVD