IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Search Component: Use-after-free allows privilege escalation

CVE-2026-105010Critical 9.8

← All vulnerabilities

Summary

A use-after-free vulnerability (CWE-416) in the Windows Search Component allows privilege elevation on affected Windows 10, Windows 11 and Windows Server systems. The NVD record states that an unauthorized attacker can exploit it over the network, while the Zero Day Initiative review describes an authorized local attacker, so the attack prerequisites are not settled. Microsoft's October 2026 update fixes the issue. No public exploitation was found during research.

Affected

  • Windows 10 Version 1607 and Windows Server 2016: builds below 10.0.14393.9612
  • Windows 10 Version 1809 and Windows Server 2019: builds below 10.0.17763.9376
  • Windows 10 Version 21H2: builds below 10.0.19044.7807
  • Windows 10 Version 22H2: builds below 10.0.19045.7807
  • Windows 11 Version 23H2: builds below 10.0.22631.7652
  • Windows 11 Version 24H2, 25H2 and 26H2: builds below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
  • Windows 11 Version 26H1: builds below 10.0.28000.3231
  • Windows Server 2012 R2: builds below 6.3.9600.23470
  • Note: build boundaries for some products are provisional, as sources conflict.

Fixed in

  • Windows 10 Version 1607 / Windows Server 2016: KB5126868 (build 10.0.14393.9612), per third-party mirror, to be verified
  • Windows Server 2022: KB5126655 (build 10.0.20348.5761), per third-party mirror
  • Other products: Unknown. Check the MSRC Security Update Guide.

Workaround

Unknown. No vendor-documented workaround was found. Install the update.

Exploitation

  • No public proof of concept or exploitation reports were found; this is not a confirmed absence.
  • Not listed in CISA KEV according to a third-party source; verify against the KEV catalogue.
  • EPSS 0.00893 (low likelihood of exploitation in the next 30 days), as reported by Vulners.
  • CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

  • Inventory all Windows devices by build and identify affected versions.
  • Prioritise file servers and domain-joined servers running Windows Search.
  • Install the October 2026 cumulative update and verify the fixed build on each device.
  • Restrict SMB and RPC from untrusted networks and do not expose these hosts to the internet.
  • Check support status and ESU eligibility for Windows 10 1607 and Server 2012 R2.
  • Recheck MSRC and CISA KEV before the next Patch Tuesday on 10 November 2026.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Microsoft Windows Search Component
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126836, KB5126868, KB5126651, KB5126657, KB5126655, KB5126653

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:54.

Original description (NVD)

Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed