Microsoft Windows COM Objects Inbox Use-After-Free Vulnerability Leading to Local Remote Code Execution

A use-after-free vulnerability has been identified in Inbox COM Objects, allowing an unauthorized attacker to execute code locally. This vulnerability arises from improper memory management, which can be exploited by sending a malicious file to the user and convincing them to open it. The issue requires navigating a race condition, adding to the complexity of successful exploitation.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users can apply the security update for this vulnerability, which is included in the October 2025 Monthly Rollup, available through the Microsoft Update Catalog.