Microsoft Windows: Local privilege escalation via use-after-free in Security Center
Summary
A use-after-free flaw in the Windows Security Center component allows an attacker with local access and low privileges to elevate their privileges. The attack is considered complex and needs no user interaction. Successful exploitation could lead to high impact on confidentiality, integrity and availability.
Affected
- Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
- Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
- Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
- Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
- Windows Server and Windows 10 Version 1607: Unknown.
Fixed in
- Windows 10 Version 1809: build 10.0.17763.9487 or later
- Windows 10 Version 21H2: build 10.0.19044.7846 or later
- Windows 10 Version 22H2: build 10.0.19045.7846 or later
- Windows 11 Version 23H2: build 10.0.22631.7711 or later
- Windows 11 Version 24H2: build 10.0.26100.9974 or later
- Windows 11 Version 25H2: build 10.0.26200.9974 or later
- Windows 11 Version 26H1: build 10.0.28000.3501 or later
- Windows 11 Version 26H2: build 10.0.26300.9974 or later
- Fix provided by the November 2026 cumulative update (Patch Tuesday, 10 November 2026).
Workaround
Unknown. No vendor workaround is documented; patching is the remedy.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Rapid7: Exploitation Less Likely, not publicly disclosed.
- No public proof-of-concept or evidence of exploitation in the wild found.
Our recommendation
- Deploy the November 2026 cumulative updates on all affected Windows endpoints and servers in the normal monthly cycle.
- Review Windows 10 21H2 and 22H2 endpoints first, and isolate or upgrade any Windows 10 1809 systems, which are out of support.
- Limit local accounts to least privilege, especially on shared workstations and terminal servers.
- Verify build numbers against the MSRC advisory before rollout.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Security Center
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131085, KB5131096, KB5131087, KB5132061, KB5132043, KB5132059
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-113842 msrc.microsoft.com
- CVE.org record CVE-2026-113842 www.cve.org
- Strix: CVE-2026-113842 (fixed builds) www.strix.ai
- GBHackers: Microsoft November 2026 Patch Tuesday gbhackers.com
- Senserva: KB5132061 senserva.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:58.
Original description (NVD)
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.