Windows: Use-after-free in Windows Update Service allows privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Update Service of several Windows 10, Windows 11 and Windows Server versions allows an attacker to elevate privileges locally. The attacker needs a valid low-privilege account on the system and must overcome a high attack complexity, but no user interaction is required. The CVSS v3.1 base score is 7.0 (High). CISA SSVC rates exploitation as none.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: builds before 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33650
• Note: the NVD CPE data lists only Windows 10 1809; the CNA data lists the entries above.

Fixed in

• Install the October 2026 cumulative security update for each affected version.
• Fixed builds per the CNA record: 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025).
• KB numbers reported by third parties (unverified): KB5126651 for 1809 and Server 2019, KB5126646 for Server 2025. Confirm on the MSRC page or in the Microsoft Update Catalog.

Workaround

Unknown. No mitigation has been identified; patching is the only known remedy.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS 0.0027 (very low predicted exploitation probability).
• No public proof-of-concept code found; no evidence of exploitation in the wild found.
• Microsoft has not published further technical details.
• The CISA KEV catalogue was not checked directly in the research.

Our recommendation

• Inventory all Windows 10 1809 and Windows Server 2019 systems and confirm their servicing status; these may not receive the fix without Extended Security Updates.
• Roll out the October 2026 cumulative update to all affected systems, prioritising shared PCs, terminal servers and systems with many standard users.
• Reduce the risk of initial access: enforce least privilege and protect accounts against phishing.
• Check the CISA KEV catalogue and the Microsoft advisory for changes.
• Priority: medium to high, not emergency-level, given no known exploitation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70056 msrc.microsoft.com
• Vulners MSCVE: CVE-2026-70056 vulners.com
• Strix: CVE-2026-70056 www.strix.ai
• OpenCVE: CVE-2026-70056 (SSVC data) app.opencve.io
• Vulners Rapid7: CVE-2026-70056 (EPSS) vulners.com
• GitHub tracker: theori-io issue 89 (third-party, indicative) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:18.