Microsoft Windows Win32k: Use-after-free leads to local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Win32k kernel subsystem of Windows allows an authorized local attacker to elevate privileges. The attacker needs a local foothold, such as a low-privileged user session or malware, and the attack complexity is high. A successful attack would give full control of the affected system.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9512)
- Windows Server 2016 and Server Core (10.0.14393.0 to < 10.0.14393.9512)
- Other Windows 10, Windows 11, Server 2012 and Server 2012 R2 builds are also listed in the MSRC advisory
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9512 or later
- Cumulative update KB number: Unknown (see MSRC advisory)
Workaround
Unknown. No mitigation found in the available sources. Install the security update.
Exploitation
- No known exploitation in the wild at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found. EPSS 0.0027 (low).
Our recommendation
- Install the Microsoft security update for CVE-2026-70067 on all affected systems, starting with multi-user, terminal and file servers.
- Confirm the installed build is 10.0.14393.9512 or later for Windows 10 1607 and Server 2016.
- Check whether any systems still run Windows 10 1607 and plan an upgrade to a supported Windows version.
- Monitor for exploitation indicators and restrict local logon and untrusted code execution where possible.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Win32 Kernel Subsystem
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5122876, KB5122882, KB5122878, KB5122871, KB5124008, KB5122880
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70067 msrc.microsoft.com
- CVE List record (CNA JSON) via Vulners vulners.com
- NVD record via Vulners vulners.com
- OpenCVE CVE-2026-70067 app.opencve.io
- Strix CVE-2026-70067 www.strix.ai
- SonicWall: Microsoft October 2026 security bulletin coverage www.sonicwall.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:17.
Original description (NVD)
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.