Microsoft Windows COM: Local privilege escalation via invalid pointer release

Summary

Microsoft Windows COM contains a flaw in which an invalid pointer or reference is released (CWE-763). NVD also lists CWE-122 (heap-based buffer overflow), which should be checked in the MSRC advisory. An authorized local attacker with low privileges can exploit it to elevate privileges, potentially to full control of the machine. Exploitation requires high complexity and an existing foothold on the system, and the flaw is not reachable over the network.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Fixed in the builds from the vendor ranges listed above (the official CVE list is incomplete for later versions; verify each build in the MSRC Security Updates table).
• Microsoft has released fixes according to a third-party report; KB article numbers were not verified.

Workaround

Unknown. No workaround was found for this CVE; patching is the mitigation.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• CVSS temporal metrics indicate no known exploit code at publication (E:U) and high report confidence (RC:C).
• No CISA KEV entry, public proof of concept or active exploitation was found at the time of research.

Our recommendation

• Install the November 2026 security update on all affected Windows systems, starting with shared systems such as Remote Desktop or terminal servers.
• Check the MSRC Security Updates table for the exact fixed build for each system.
• Confirm that older builds (1607, 1809, Server 2016) are still supported; plan upgrades if they are not.
• Restrict interactive logons to necessary users and monitor for unusual privilege changes.
• Review CISA KEV and public exploit sources before the next review cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105533 msrc.microsoft.com
• CVE.org record CVE-2026-105533 www.cve.org
• Strix CVE-2026-105533 (third-party tracker) www.strix.ai
• Mallory write-up (third-party, weak evidence) mallory.ai
• Rescana: Patch Tuesday November 2026 analysis www.rescana.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:42.