Windows: Local privilege escalation through use-after-free in kernel

Summary

A use-after-free vulnerability (CWE-416) in the Windows kernel allows a locally authorized user to elevate privileges. An attacker first needs code execution or a local logon, for example through a phishing payload or a compromised account, and can then gain SYSTEM rights and full control of the machine. Microsoft rates the CVSS 3.1 score at 7.8 (High), and NVD analysis was still pending at publication. No in-the-wild exploitation is known.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 before 10.0.19045.7846; listed by a third-party tracker only, unverified)
• Windows 11 Version 23H2 (builds 10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2, 25H2, 26H1 and 26H2 (builds listed in the CVE record; not verified against MSRC)
• Windows Server 2016, including Server Core (builds 10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds 10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 before 10.0.20348.5870)
• Windows Server 2025: unverified, reported by a third-party tracker only

Fixed in

• Security update of November 2026 (cumulative update) for the builds listed above, according to the CVE record
• Exact fixed builds per product: verify on the MSRC Security Update Guide before rollout

Workaround

Unknown. No documented workaround was found. The security update is the only known remedy.

Exploitation

• No in-the-wild exploitation found.
• A third-party tracker lists the CVE as not exploited. CISA KEV status not confirmed.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• The CVE record uses the temporal metric E:U (exploit code maturity Unproven).
• No public proof of concept found.

Our recommendation

• Verify the affected products and fixed build numbers on the MSRC Security Update Guide.
• Install the November 2026 cumulative update on all affected Windows systems, starting with servers, terminal servers and shared endpoints.
• Check each machine for missing updates and follow up on installation failures.
• Confirm the support status of Windows 10 systems on older builds (1607, 1809, 21H2) and plan upgrades or extended security updates.
• Re-check MSRC, NVD and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108403 msrc.microsoft.com
• CVE Record CVE-2026-108403 (Microsoft CNA) www.cve.org
• Strix AI: CVE-2026-108403 (third-party, unverified versions) www.strix.ai
• Senserva: exploitation status tracker (third-party) senserva.com
• Senserva: November 2026 update tracker (third-party, unverified) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:27.