Microsoft Windows: Use after free in Smart Card allows local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Smart Card component allows a local user with low privileges to elevate their privileges. An attacker first needs a foothold on the system, for example through a phished user account or malware running as a normal user, and can then gain SYSTEM or administrator rights. The CNA rates the issue 7.0 (High); NVD analysis was still pending at the time of research.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Install the current Microsoft security update for each affected edition, which provides the fixed builds listed above (for example 10.0.14393.9688, 10.0.17763.9487, 10.0.19045.7846, 10.0.22631.7711, 10.0.20348.5870).
• Confirm the exact KB numbers and fixed builds in the MSRC advisory, as the KB numbers were not verified.

Workaround

• Unknown. No vendor workaround has been identified; patching is the fix.
• Until patched, limit local interactive logon to trusted users and review which hosts use smart-card logon. This is general advice, not from the vendor.

Exploitation

• No evidence of exploitation in the wild found.
• Not listed in the CISA KEV catalog in the sources checked.
• No public proof of concept found.
• The CVE record is recent (published 10 November 2026), so this may change.

Our recommendation

• Apply the Microsoft security update to all affected Windows clients and servers, starting with servers, terminal servers and shared multi-user systems.
• Check the MSRC advisory for the exact KB numbers and confirm that each system reaches the fixed build.
• Restrict local logon to trusted users and review which hosts use smart-card logon until patched.
• Monitor for new KEV listings or public exploit code and re-check NVD once analysed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record (Microsoft CNA) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• Strix.ai mirror (third-party) www.strix.ai
• CISA KEV alert, 10 Nov 2026 www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:43.