Microsoft Windows Kernel: Use-after-free leading to privilege escalation

Summary

A use-after-free flaw in the Windows kernel allows a local attacker to elevate privileges to a higher level on affected Windows 10, Windows 11 and Windows Server systems. Per the CVE record, exploitation requires physical access to the machine. The attacker would need to be able to run code on the device, for example via a stolen or unattended device or an insider.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

Fixed in the November 2026 security update for each affected build listed above. KB article numbers: Unknown. Check the MSRC advisory for the KB links.

Workaround

Unknown. Microsoft has not published a workaround in the sources reviewed. Installing the update is the fix.

• Until patched, restrict physical access to servers and shared PCs and enable full-disk encryption and a BIOS/UEFI password. These are general recommendations, not vendor guidance.

Exploitation

• No evidence of exploitation in the wild. The CVE is not listed in CISA KEV.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public proof of concept found. The CVE record marks exploit maturity as unproven (E:U).

Our recommendation

• Install the November 2026 cumulative update on all affected Windows devices, prioritising laptops and shared workstations.
• Confirm the exact Windows build on each device, as the affected ranges differ by version.
• Replace or upgrade Windows 10 21H2 and 1607 devices, which are end of support, or enrol them in Extended Security Updates.
• Enforce screen locks, full-disk encryption and physical access controls for devices that leave the office.
• Monitor for unusual local privilege escalation activity on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119918 msrc.microsoft.com
• CVE.org record CVE-2026-119918 www.cve.org
• Rapid7: November 2026 Patch Tuesday www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:35.