Windows 10 1607: Local privilege escalation via use-after-free in Win32 kernel

Summary

A use-after-free flaw in the Win32 kernel subsystem of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker first needs a foothold on the host, for example through a phished user or malware, and exploitation is rated highly complex. Successful exploitation can give full control over the affected system. The flaw does not provide remote access.

Affected

• Windows 10 Version 1607: builds before 10.0.14393.9612
• Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Other products listed in the CVE record: Windows 10 1809, 21H2, 22H2, Windows 11 23H2, Windows Server 2012, 2012 R2, 2019, 2022 (see MSRC for exact build ranges)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: October 13, 2026 cumulative update KB5126868 (build 14393.9612)

Workaround

Unknown. No vendor workaround was found; patching is the only documented remedy.

Exploitation

• No evidence of exploitation in the wild found; a third-party watchlist records it as not in CISA KEV
• CISA SSVC assessment: exploitation none, not automatable, total technical impact
• No public proof of concept found
• EPSS about 0.25 percent
• A scanner flag for the October bundle KB5126868 is bundle-level and cannot be confirmed for this CVE

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2016 hosts and confirm ESU enrolment, since sources conflict on the end of support
• Deploy KB5126868 after testing Exchange servers, as Microsoft lists a known email issue with this update and a registry-based temporary workaround
• Give high priority to 1607 and Server 2016 hosts with multiple users or privileged access; lower priority to single-user endpoints on supported builds
• Plan migration off Windows 10 1607 rather than relying on patches alone
• Verify version ranges against the MSRC advisory before acting

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102208 msrc.microsoft.com
• Vulners CVE record (CNA data) vulners.com
• Microsoft release health: Windows 10 1607 and Server 2016 learn.microsoft.com
• Microsoft Update Catalog: KB5126868 catalog.update.microsoft.com
• NinjaOne KB catalog: KB5126868 www.ninjaone.com
• Pureinfotech: Windows 10 ESU October 2026 update pureinfotech.com
• Tenable plugin 365471 (KB5126868) www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:53.