Windows Winsock: Elevation of privilege via double free

Summary

A double free vulnerability (CWE-415) in the Windows Winsock networking interface allows an authorized local attacker to elevate privileges. The attacker needs local access and low privileges, and the attack complexity is high, so the bug is not directly reachable from the internet. If exploited, the attacker could gain full control of the affected host, as confidentiality, integrity and availability are all rated High.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (builds before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Fixed builds according to the CVE record: the first build listed as not affected for each version above (for example 10.0.26100.9974 for Windows 11 24H2).
• Confirm the exact fixed builds on the MSRC Security Update Guide before deployment.

Workaround

Unknown. No documented workaround is known; applying the Microsoft update is the remedy.

Exploitation

• No evidence of exploitation in the wild for this CVE.
• No public proof of concept found at the time of research.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• CVSS temporal vector indicates exploit code maturity Unproven.

Our recommendation

• Apply the Microsoft security update for the affected Windows versions in the next regular Patch Tuesday cycle; deploy earlier on multi-user servers, terminal servers and jump hosts.
• Prioritise systems with older builds (Windows 10 1607 and 1809, Windows Server 2016 and 2019) and check their support status.
• Restrict local logons and standard user rights on shared or BYOD workstations where possible.
• Monitor for suspicious privilege escalation and re-check for public exploit reports, as the CVE is still awaiting NVD analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-105526 msrc.microsoft.com
• CVE.org record CVE-2026-105526 www.cve.org
• Strix AI summary CVE-2026-105526 (third party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:44.