Microsoft Windows Kernel: Use-after-free allows local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows kernel allows an authorized local user to elevate privileges. The CNA rates it CVSS 7.8 (High), with high impact on confidentiality, integrity and availability. An attacker needs an existing low-privilege foothold and local access, so this is a follow-on step after an initial compromise, not a remote entry point.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 before 6.2.9200.26434; 6.3.9600.0 before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)

Fixed in

• Install the Windows security update that brings the build to or above the fixed build listed for each affected version in the MSRC Update Guide.
• Exact KB numbers: check the MSRC advisory, as the vendor page could not be verified for this entry.

Workaround

• Unknown. No vendor-documented workaround was found.
• Restrict local logon and code execution (least privilege, application control) as a general risk reduction.

Exploitation

• Not known to be exploited at the time of writing.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found. The CNA vector rates exploit code maturity as Unproven (E:U).

Our recommendation

• Patch affected Windows 10, 11 and Server systems in the normal cycle, with priority for multi-user servers, RDP/terminal servers and workstations used by many staff.
• Check whether Windows 10 1607, 1809, 21H2 and 22H2 hosts still receive updates, or whether Extended Security Updates are needed.
• Limit local accounts and admin rights, and monitor for exploit reports and a CISA KEV entry, as the CVE was published on 10 November 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-114170 msrc.microsoft.com
• CVE Record CVE-2026-114170 www.cve.org
• VulDB: CVE-2026-114170 (conflicting CVSS score) vuldb.com
• Strix: CVE-2026-114170 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:05.