Windows exFAT File System: Use-after-free allows local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows exFAT File System allows an authorized local attacker to elevate privileges, for example from a standard user account to SYSTEM. The attacker needs local access and low privileges, and must get the system to process a crafted exFAT volume, such as a USB stick or SD card. The vulnerability is not network-exposed; the CVSS 3.1 base score is 7.0 (High).

Affected

• Windows 10 Version 1809: before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2: before 10.0.26100.9974
• Windows 11 Version 25H2: before 10.0.26200.9974
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows 11 Version 26H2: before 10.0.26300.9974
• Windows Server 2019 (including Server Core): before 10.0.17763.9487
• Windows Server 2022: before 10.0.20348.5870
• Windows Server 2025 (including Server Core): before 10.0.26100.33822
• Other versions, including Windows Server 2016: Unknown; check the MSRC advisory

Fixed in

• Microsoft security update of 10 November 2026; fixed in the builds listed above
• KB article numbers: Unknown
• Confirm the installed build number after patching

Workaround

• No vendor workaround known.
• Until patched, avoid mounting exFAT media from untrusted sources.

Exploitation

• No known exploitation in the wild.
• No public proof of concept known.
• Microsoft assesses exploit code maturity as Unproven (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the November 2026 Windows security update on all affected systems, prioritising file servers and endpoints with shared or unmanaged USB media.
• Check the installed build number against the fixed versions above using Windows Update, WSUS or Intune.
• Check the MSRC advisory for the complete product list, including Windows Server 2016.
• Until patched, restrict mounting of exFAT media from untrusted sources.
• Monitor for exploitation news and recheck the open items within a few days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-112766 msrc.microsoft.com
• CVE Record CVE-2026-112766 (cve.org) www.cve.org
• Third-party mirror with fixed builds (strix.ai) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:15.