Windows Kerberos: Double free leads to local privilege escalation

Summary

A double free in the Windows Kerberos authentication component allows a local attacker to elevate privileges. The attacker needs a valid, low-privileged local account, so the flaw is not directly reachable from the internet. Once an attacker has a foothold on a domain-joined host, such as through a phished user or a compromised service account, they can gain higher privileges on that system. The CVSS base score is 7.0 (High).

Affected

• Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7652
• Windows Server 2016 (including Server Core): 10.0.14393.0 before 10.0.14393.9612
• Windows Server 2019 (including Server Core): 10.0.17763.0 before 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 before 10.0.26100.33650

Fixed in

• Install the Microsoft security update for each affected version, which provides the builds listed above or later.
• Verify the exact fix per version in the MSRC advisory before rollout.

Workaround

Unknown.

• No mitigation guidance could be verified. Check the MSRC Workarounds and Mitigations sections directly.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• EPSS about 0.25%.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• CISA KEV listing not confirmed; check the catalog directly.

Our recommendation

• Apply the Microsoft security update on all affected Windows clients and servers in the next patch cycle, and earlier on exposed systems.
• Prioritise Windows 10 Version 1607 and Windows Server 2016 hosts, check whether they still receive security updates, and plan upgrades if not.
• Focus on domain-joined file servers and shared workstations, and restrict local logon rights where possible.
• Monitor for unusual privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108132 msrc.microsoft.com
• Vulners: CVE record (CNA data) vulners.com
• Vulners: NVD record vulners.com
• CyStack: Windows Server 2016 vulnerability entry cystack.net
• CVE Threat Intelligence: CVE-2026-108132 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:44.