Windows Software Protection Platform: Use-after-free enables local privilege escalation

Summary

A use-after-free vulnerability in the Software Protection Platform (SPP) component of Windows allows an authorized local user to elevate privileges. The attack requires a local account with low privileges and is harder to carry out reliably (high attack complexity). An attacker who already has a foothold on a multi-user system could gain full control of the host.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025: affected per third-party sources, build data unconfirmed

Fixed in

• Fixed in the October 2026 security updates (build numbers per CNA data, to be confirmed on MSRC):
• 10.0.14393.9612 (Windows 10 1607, Server 2016)
• 10.0.17763.9376 (Windows 10 1809, Server 2019)
• 10.0.19044.7807 (Windows 10 21H2)
• 10.0.19045.7807 (Windows 10 22H2)
• 10.0.22631.7652 (Windows 11 23H2)
• 10.0.26100.9711 (Windows 11 24H2)
• 10.0.26200.9711 (Windows 11 25H2)
• 10.0.28000.3231 (Windows 11 26H1)
• 10.0.26300.9711 (Windows 11 26H2)
• 10.0.20348.5761 (Windows Server 2022)
• KB numbers: unknown for most builds; third-party sources cite KB5126651, KB5126653 and KB5126646, not confirmed by Microsoft.

Workaround

Unknown. No mitigation or workaround was found in the sources. Installing the fixed update is the remedy.

Exploitation

• Exploited in the wild: no evidence found; CISA SSVC lists exploitation as none.
• Public proof of concept: none found.
• EPSS: low (sources report 0.00252 and 0.28%).
• CISA SSVC: automatable no, technical impact total.
• Microsoft's exploitability assessment could not be retrieved.

Our recommendation

• Apply the October 2026 cumulative update to all affected Windows hosts, prioritising multi-user systems, terminal/RDS servers and shared workstations.
• Verify the fixed build numbers on the MSRC Security Update Guide, since sources disagree on some values.
• Identify Windows 10 1607 and Server 2016 systems; Windows 10 LTSB 2016 support was scheduled to end on 13 October 2026, so check whether a fix is available for your version.
• Limit local logons to trusted users and monitor for unusual privilege changes.
• Confirm CISA KEV status regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide (CVE-2026-108464) msrc.microsoft.com
• MSRC Security Update Guide, en-US msrc.microsoft.com
• Vulners NVD record vulners.com
• Vulners CVELIST record vulners.com
• Vulners MSCVE record vulners.com
• Strix CVE page (third-party mirror) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:41.