IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Search Component: Local privilege escalation via use-after-free

CVE-2026-70086High 7.0

← All vulnerabilities

Summary

A use-after-free vulnerability (CWE-416) in the Microsoft Windows Search Component allows an authorized local user to elevate privileges. The attack requires local access with low privileges and a high attack complexity. Successful exploitation would give an attacker full control over confidentiality, integrity and availability of the affected system.

Affected

  • Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
  • Windows 10 Version 21H2: builds before 10.0.19044.7807
  • Windows 10 Version 22H2: builds before 10.0.19045.7807
  • Windows 11 Version 23H2: builds before 10.0.22631.7652
  • Windows 11 Version 24H2: builds before 10.0.26100.9711
  • Windows 11 Version 25H2: builds before 10.0.26200.9711
  • Windows 11 Version 26H1: builds before 10.0.28000.3231
  • Windows 11 Version 26H2: builds before 10.0.26300.9711
  • Windows Server 2022: builds before 10.0.20348.5761
  • Windows Server 2025 (including Server Core): builds before 10.0.26100.33650

Fixed in

  • Apply the Microsoft security update of 13 October 2026 for your Windows version.
  • Windows 10 1809 / Server 2019: KB5126651 (according to Tenable plugin data; verify on MSRC)
  • Windows 10 21H2/22H2: KB5126657 (according to Tenable plugin data; verify on MSRC)
  • Windows Server 2025: KB5126646 (according to Vulners data; verify on MSRC)

Workaround

Unknown. No vendor-documented workaround was found. Patching is the recommended fix.

Exploitation

  • No confirmed exploitation in the wild found at the time of research.
  • No public proof-of-concept found for this CVE.
  • Not found in the CISA KEV catalog in the sources reviewed; verify on the KEV catalog.
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • EPSS score: 0.00252 (very low).

Our recommendation

  • Install the October 2026 Windows security update on all affected systems, prioritising multi-user terminal servers and shared workstations.
  • Replace or upgrade Windows 10 1809 and Server 2019 systems that are out of support or cannot be patched.
  • Check which systems have local logon or RDP access and restrict low-privilege accounts.
  • Monitor for signs of privilege escalation on systems that may already be compromised.
  • Verify the exact KB numbers and fixed builds in the MSRC advisory before rollout.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Microsoft Windows Search Component
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:15.

Original description (NVD)

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed