Microsoft Windows: Use-after-free in Remote Assistance enables privilege escalation

Summary

A use-after-free vulnerability in the Windows Remote Assistance feature (msra.exe) allows an authorized local user to elevate privileges. An attacker first needs a local account with low privileges, which is usually obtained earlier through phishing or malware, and the attack complexity is high. The CVSS base score is 7.8 (High), and the impact on confidentiality, integrity and availability is rated high.

Affected

• Windows 10 Version 1607 and 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016, 2019 and 2022, including Server Core installations
• Exact builds: see the list in the vendor record below

Fixed in

• Windows 10 1607: 10.0.14393.9688 or later
• Windows 10 1809: 10.0.17763.9487 or later
• Windows 10 21H2: 10.0.19044.7846 or later
• Windows 10 22H2: 10.0.19045.7846 or later
• Windows 11 23H2: 10.0.22631.7711 or later
• Windows 11 24H2, 25H2, 26H2: 10.0.26100.9974, 10.0.26200.9974 and 10.0.26300.9974 or later
• Windows 11 26H1: 10.0.28000.3501 or later
• Windows Server 2016 and 2019: same builds as the corresponding client versions
• Windows Server 2022: 10.0.20348.5870 or later
• Per a third-party tracker, KB5131096 (November 2026) fixes Windows 10 21H2. Verify the KB numbers for all editions in the MSRC Security Update Guide before rollout.

Workaround

Unknown. No vendor workaround is documented. As general hardening, disable Remote Assistance if it is not needed (System Properties or Group Policy).

Exploitation

• Not known to be exploited in the wild.
• The CVSS temporal vector marks exploit maturity as Unproven (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.

Our recommendation

• Install the November 2026 security update on all affected Windows systems, prioritizing shared and multi-user endpoints and systems where Remote Assistance is enabled.
• Check which systems have Remote Assistance enabled and disable it where remote support is not required.
• Review local accounts and restrict unnecessary local logons.
• Monitor for unusual process activity involving msra.exe and for privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-112751 msrc.microsoft.com
• CVE Record CVE-2026-112751 www.cve.org
• Strix AI: CVE-2026-112751 (third-party tracker) www.strix.ai
• Senserva: KB5131096 (third-party KB tracker) senserva.com
• NinjaOne: Enable or disable Remote Assistance www.ninjaone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:21.