Windows Storage: Use after free allows local privilege escalation

Summary

A use-after-free flaw in the Windows Storage component allows an attacker who is already authorized on the system to elevate privileges locally. Successful exploitation can lead to high impact on confidentiality, integrity and availability. The attack requires local access and is not possible remotely from the internet.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: builds below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows Server 2022: builds below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds below 10.0.26100.33650

Fixed in

• Install the October 2026 security update for the affected Windows version.
• Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later (a third-party listing names KB5126651; verify on the MSRC page).

Workaround

Unknown.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• No public proof-of-concept exploit found in the sources reviewed.
• No known exploitation in the wild and no CISA KEV entry found at the time of research.
• EPSS is about 0.2 percent, indicating a low predicted likelihood of exploitation.

Our recommendation

• Patch Windows 10 1809 and Windows Server 2019 hosts within the normal monthly cycle, prioritizing multi-user servers, terminal servers and hosts with logons by staff or third parties.
• Check all Windows hosts against the affected builds and identify any Windows 10 1809 machines, which are likely Enterprise LTSC or Server 2019.
• Reduce local risk by applying least privilege and limiting interactive and remote desktop logons until patches are installed.
• Keep endpoint detection and response active and monitor for suspicious privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69763 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-69763 vulners.com
• Strix: CVE-2026-69763 www.strix.ai
• The Windows Update: CVE-2026-69763 Windows Storage elevation of privilege thewindowsupdate.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:36.