Windows COM+ Event System Service: Use-after-free privilege escalation

Summary

A use-after-free flaw in the Windows COM+ Event System Service allows an authorized local attacker to elevate privileges. The attacker needs an existing local session with low privileges, the attack complexity is high and no user interaction is required. Successful exploitation would give the attacker full compromise of confidentiality, integrity and availability on the affected system.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Install the Microsoft security update for the affected build (see the MSRC advisory for the KB numbers and release).
• Fixed builds per the CVE record: Windows 10 1607: 10.0.14393.9688; 1809: 10.0.17763.9487; 21H2: 10.0.19044.7846; 22H2: 10.0.19045.7846; 11 23H2: 10.0.22631.7711; 24H2: 10.0.26100.9974; 25H2 and 26H2: 10.0.26200.9974 and 10.0.26300.9974; 26H1: 10.0.28000.3501; Server 2016: 10.0.14393.9688; Server 2019: 10.0.17763.9487; Server 2022: 10.0.20348.5870.

Workaround

Unknown. No vendor workaround or mitigation was found.

Exploitation

• Unknown for public exploit code: Microsoft's CVSS vector uses exploit code maturity E:U (Unproven).
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No report of in-the-wild exploitation or public proof of concept was found.

Our recommendation

• Inventory affected Windows 10, Windows 11 and Windows Server systems, especially terminal servers and multi-user hosts.
• Install the November 2026 cumulative update and verify the build numbers afterwards.
• Check whether Windows 10 21H2 and 22H2 systems still receive updates; unsupported systems will not get this fix.
• Restrict local interactive logon to trusted users until patched.
• Re-check the NVD entry and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-113769 msrc.microsoft.com
• CVE.org record CVE-2026-113769 www.cve.org
• Strix CVE summary (unverified against MSRC) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:02.