Microsoft Windows SSTP: Use-after-free leads to local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authorized attacker to elevate privileges on the local system. The attacker needs an existing low-privilege account on the affected machine, and exploitation is rated high complexity. SSTP is used for VPN tunnels, so servers acting as SSTP VPN endpoints are of particular interest.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Note: Third-party trackers list additional ranges (e.g. Windows Server 2025), which are unverified. Check the MSRC entry for the authoritative list.

Fixed in

• Microsoft security updates released on November 10, 2026 (builds listed as the first fixed version above)
• Specific KB numbers: Unknown.

Workaround

• No vendor-stated workaround found. Patching is the fix.
• Interim step (not confirmed for this CVE): disable the SSTP service on servers where it is not required.

Exploitation

• Exploited in the wild: none found in the sources checked. The CISA KEV catalogue was not checked.
• Public proof of concept: none found.
• CVSS exploit maturity: Unproven (E:U).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Install the Microsoft security updates of November 10, 2026 on all affected Windows clients and servers, prioritising servers that run SSTP VPN endpoints (including RRAS and Always On VPN).
• Where SSTP is not needed, disable it until the patch is applied.
• Verify the exact affected builds in the MSRC Security Update Guide, as third-party lists differ.
• Review local accounts and restrict logon rights, since exploitation requires an existing low-privilege account.
• Monitor for unusual privilege changes and process activity on SSTP servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105510 msrc.microsoft.com
• CVE.org record CVE-2026-105510 www.cve.org
• VulDB entry CVE-2026-105510 vuldb.com
• Richard Hicks: Always On VPN security updates, November 2026 directaccess.richardhicks.com
• Strix.ai CVE-2026-105510 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:46.