Microsoft Windows COM: Use-after-free leads to local privilege escalation

Summary

A use-after-free vulnerability in the Windows COM (Component Object Model) component allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege logon on the affected machine, and the attack complexity is rated high. The CVSS 3.1 base score from Microsoft is 7.0; VulDB lists 8.8, and Microsoft's score is the authoritative one for patching.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 to < 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 to < 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5870)

Fixed in

• Microsoft's cumulative updates of November 10, 2026 for each affected product
• Fixed builds are the first builds at or above the upper limits listed above
• KB numbers: see the MSRC update guide (not verified here)

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild.
• No public proof of concept known.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Rapid7 rates exploitation as less likely.

Our recommendation

• Install the November 2026 security updates on all affected Windows systems within your normal patch window.
• Prioritise terminal servers, shared PCs and systems with many local users.
• Keep users on standard accounts rather than administrator accounts.
• Check whether machines still run Windows 10 1607 or 1809 and whether they are covered by Extended Security Updates.
• Monitor for unusual privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-112968 msrc.microsoft.com
• CVE Record CVE-2026-112968 www.cve.org
• VulDB: CVE-2026-112968 vuldb.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:08.