CVE-2026-85936

Executive Summary

CVE-2026-85936 is a double free vulnerability in the Windows Shell that allows an unauthorized attacker to execute code over a network. Successful exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8), as the attack is delivered remotely and triggered when the target user performs a shell-related action. No public proof-of-concept, exploit code, or Nuclei template exists, and no vendor patch or advisory has been identified — the vulnerability is currently UNPATCHED.

Technical Analysis

The NVD description states the flaw is a double free in the Windows Shell, classified as CWE-122 (Heap-based Buffer Overflow). A double free is a memory-safety condition in which the same allocated memory region is released more than once. In heap-based memory management, this corrupts allocator bookkeeping metadata: after the first free, the allocation may be returned to a free list and later reallocated for a different purpose; the second free then either double-inserts the region into a free list or releases memory that is already in active use. An attacker who can influence the allocation pattern can use this corruption to achieve overlapping allocations, arbitrary write, or controlled reuse of freed heap memory, which is the standard path from heap corruption to code execution in the context of the affected process.

The CNA title and NVD description provided do not specify which Windows Shell component contains the defect — for example, no specific DLL, COM object, shell extension, file handler, or rendering subsystem is named. Consequently, no function names, class names, file paths, or parameter names can be asserted here; none appear verbatim in the supplied description. What is established by the description is the following: the defect is reachable from the Windows Shell, the attack vector is network-based, and interaction by a user is required (per the CVSS vector's UI:R metric), which typically means the victim must open, preview, or otherwise engage a shell-rendered artifact delivered by the attacker.

The AV:N metric with UI:R is consistent with the shell being induced to parse attacker-controlled content that arrives over a network channel — for instance, content referenced from a remote location or a network share — rather than the attacker requiring prior local access. The heap-corruption primitive (double free) is then exercised in the process hosting the shell code; depending on which process resolves the memory corruption, execution may occur at the privilege level of the interactive user (S:U denotes the scope is unchanged across security authorities). Because exploitation depends on heap layout and allocator state, reliability is generally attack-specific and version-dependent, but the impact when successful is total compromise of the running context (C:H/I:H/A:H).

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred strictly from the vulnerability class (double free in Windows Shell, network vector, user interaction required) and the CVSS metrics; no component-specific identifiers are asserted because none are present in the description.

1. Reconnaissance / target identification. The attacker identifies systems exposing shell-supported network interfaces or file-sharing services (e.g., SMB on port 445) and selects a target user who can be induced to interact with shell-rendered content. Because the vector is AV:N, the attacker does not need prior access to the target host.
2. Delivery and trigger. The attacker delivers shell content that the victim must engage with (UI:R) — the description does not identify the specific content type or handler, so the trigger is characterized at the class level: user interaction with attacker-supplied content processed by the Windows Shell. This could be content pulled from a network location in the course of a shell operation.
3. Trigger of the flaw class. Interaction causes the Windows Shell to process the content and execute operations that result in the same heap allocation being freed twice (CWE-122 context). The double free corrupts heap metadata. No specific code path, object, or structure name can be provided — this level of detail is absent from the supplied data.
4. Payload / execution at the vulnerability-class level. The attacker leverages the heap corruption to obtain overlapping or attacker-influenced allocations, and uses that primitive to redirect the shell's execution flow toward attacker-controlled data, yielding code execution in the shell's running context. The exact technique is not derivable from the description.
5. Post-exploitation impact. Per CVSS, confidentiality, integrity, and availability impacts are all High within the scope of the vulnerable component. The attacker gains code execution as the interactive user, enabling credential access, persistence, lateral movement, and data theft commensurate with the victim's privileges. Successful exploitation of the shell context may also be chained with privilege-escalation techniques to extend access.

Impact Assessment

With a base score of 8.8 (High) and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the vulnerability has network reachability, low attack complexity, no privilege requirement, and only a user-interaction precondition. The only factor tempering the score is UI:R; every impact metric is High. Because the affected component is the Windows Shell, the blast radius covers any supported Windows endpoint or server where a user can be induced to interact with attacker-supplied shell content. The scope metric S:U indicates the security authority is not expected to change across the exploit, meaning an attacker typically achieves code execution at the level of the invoking user; the full business impact (credential theft, ransomware staging, domain lateral movement) then depends on what that user can reach. From an operational standpoint: a user-interaction-gated heap-corruption RCE in a ubiquitous Windows subsystem is a high-value target for initial-access brokers. However, EPSS has not yet been scored by FIRST.org, no CISA KEV entry exists, and there is no observed exploit-in-the-wild evidence in the supplied data — prioritizing by exposure, not by current exploitation activity, is appropriate.

Detection Guidance

The description does not name specific processes, paths, or network artifacts, so the rules below target the vulnerability class generically: anomalies in shell-adjacent process behavior following interaction with externally sourced content, unusual memory-related crash telemetry, and SMB/network content delivery to shell-handling processes. Detect engineers should tune process names and paths to their environment; the placeholders below intentionally reference only widely standardized process names (e.g., explorer.exe) rather than any identifier from a CVE description.

Sigma Rule

title: Potential Windows Shell Heap Corruption - Suspicious Child Process from Shell Context
id: 8a4b6c2e-1f3d-4e9a-9c07-5d2b7a1f9e44
status: experimental
description: Detects a shell-host process spawning a non-standard child process shortly after network content access, consistent with post-exploitation behavior for a shell heap-corruption RCE. Tune to environment - no component-specific indicators are available for CVE-2026-85936.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85936
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\dllhost.exe'
      - '\runtimebroker.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate administrative scripts executed from the interactive shell
  - Software installers and update mechanisms
level: medium
tags:
  - attack.t1203
  - attack.execution

YARA Rule

rule CVE_2026_85936_Windows_Shell_Heap_Corruption
{
    meta:
        description = "Heuristic detection for artifacts consistent with a double free condition in Windows Shell content handling. High false-positive risk; use for hunting only. No component-specific indicators available for CVE-2026-85936."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85936"
        date = "2026-01-01"
        cwe = "CWE-122"
        severity = "high"
    strings:
        $mz = { 4D 5A }
        $shell_ctx1 = "shell32" ascii nocase
        $shell_ctx2 = "SHCreateItem" ascii nocase
        $heap_pair = { FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 }
    condition:
        $mz at 0 and
        filesize < 5MB and
        2 of ($shell_ctx*) and
        $heap_pair
}

Note: this rule is heuristic and does not identify the vulnerable code, because no component, function, or file path is specified in the supplied NVD description. Treat hits as triage leads, not proof of exploit.

Suricata IDS Rule

alert smb any any -> any any (msg:"CVE-2026-85936 Potential Windows Shell Exploit - Suspicious Content Retrieval to Shell Host"; flow:established,to_client; content:"|FF|SMB"; depth:4; app-layer-protocol:smb; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-user; sid:90085936; rev:1; reference:cve,2026-85936; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

This rule is a broad volumetric aid for unusual high-frequency content delivery toward shell-handling clients over SMB; it does not match a specific exploit signature because none is published.

Elastic Detection

sequence by host.id with maxspan=30s
  [ network where network.direction == "inbound" and destination.port == 445 ]
  [ process where event.type == "start" and
      process.parent.name in ("explorer.exe", "dllhost.exe", "runtimebroker.exe") and
      process.name in ("powershell.exe", "cmd.exe", "mshta.exe", "rundll32.exe") ]

Splunk SPL Query

index=windows (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent,"%\\explorer.exe") OR like(parent,"%\\dllhost.exe") OR like(parent,"%\\runtimebroker.exe"))
    AND (like(child,"%\\powershell.exe") OR like(child,"%\\cmd.exe") OR like(child,"%\\mshta.exe") OR like(child,"%\\rundll32.exe") OR like(child,"%\\regsvr32.exe"))
| table _time, host, User, parent, child, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,cve-2026-85936,">
  <rule id="100936" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">\\\\explorer\.exe$</field>
    <field name="win.eventdata.image">\\\\(powershell|cmd|mshta|rundll32|regsvr32)\.exe$</field>
    <description>CVE-2026-85936: Suspicious child process spawned from Windows Shell context - possible post-exploitation activity.</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, affected-version list, or OSV package mapping has been identified by any tracked source, and no fixed version exists to upgrade to.

1. Immediate mitigations. Because exploitation requires user interaction with network-delivered shell content, reduce the trigger surface: enforce attachment and download controls at the email and web gateways; block or restrict SMB (TCP 445) and other network content channels at the perimeter where business needs permit; apply Windows Attack Surface Reduction (ASR) rules that block execution of potentially obfuscated scripts and untrusted executables launched from shell contexts; restrict standard users from administrative roles to bound post-exploitation impact; and improve EDR telemetry for memory-corruption crashes in shell-adjacent processes.
2. Patch/upgrade steps. No patch is available. Monitor Microsoft's security update guidance and advisory channels for a Windows Shell security update addressing CVE-2026-85936, and treat any release as emergency-priority. Until then, treat the exposure as unmitigated and rely on compensating controls and monitoring above.
3. Long-term hardening. Maintain a rapid patch cadence for operating-system and shell components; segment networks to prevent direct endpoint access over file-sharing protocols; apply least privilege so shell-context code execution does not translate into administrative compromise; instrument endpoint memory-crash telemetry for shell processes as a leading indicator; and subscribe to NVD and Microsoft vulnerability notifications so remediation begins the moment a fixed build is published.

References

• NVD — CVE-2026-85936: https://nvd.nist.gov/vuln/detail/CVE-2026-85936
• CWE-122, Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• FIRST.org EPSS (CVE not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-85936): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1203, Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/

No threat actor campaigns, exploit-in-the-wild evidence, public proof-of-concept, or Nuclei template have been identified for CVE-2026-85936 at the time of writing.