Windows SMB Client: Use-after-free leads to local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows SMB Client allows an authorized local attacker to elevate privileges. The attacker needs valid low-privileged credentials on the system, for example through a compromised standard user account or malicious code running locally. Microsoft rates the impact as high for confidentiality, integrity and availability, but exploitation is considered complex.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (incl. Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (incl. Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Install the November 2026 cumulative update for your Windows version (Microsoft, Patch Tuesday, 10 Nov 2026).
• The fixed builds are the first builds listed as not affected in the affected list above.
• KB numbers: Unknown. Please take them from the MSRC advisory.

Workaround

Unknown. No vendor workaround has been published. Patching is the primary fix.

Exploitation

• No public exploit known at the time of publication (CVSS temporal rating: unproven).
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not confirmed to be in CISA KEV at the time of research.

Our recommendation

• Identify all Windows systems and their build numbers (winver or registry).
• Patch servers and file-sharing hosts first, then workstations, with the November 2026 cumulative update.
• Identify Windows 10 1607 and 1809 systems and check their support status; replace or enrol them in ESU if still in use.
• Limit local administrator rights and use least-privilege accounts to reduce the impact of local escalation.
• Re-check NVD and CISA KEV, as the NVD analysis was still pending at publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-112812 msrc.microsoft.com
• CVE.org record CVE-2026-112812 www.cve.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:12.