Microsoft Windows Search Component: Local privilege escalation via use after free

Summary

A use-after-free vulnerability (CWE-416) in the Microsoft Windows Search Component allows an authenticated local user to elevate privileges. An attacker needs a valid low-privilege logon or code running as such a user on the target system. Successful exploitation can lead to full control of the affected system. Microsoft has released a fix, and no public disclosure or known exploitation was reported at release.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2016: 10.0.14393.9612
• Knowledge base number for Windows 10 Version 1607 not confirmed; obtain it from the MSRC update guide or the Windows Update Catalog.

Workaround

Unknown. No vendor-documented workaround was identified. Installing the fixed build is the remedy.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitation rated 'More Likely'.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS: low (0.00267).
• No public proof-of-concept exploit found at the time of research.

Our recommendation

• Patch affected systems in the October 2026 update cycle, prioritizing multi-user systems such as terminal servers, shared file servers and Windows Server 2012/2016 hosts.
• Treat Windows 10 Version 1607 systems as urgent: verify the patch level and check whether the build is still supported, as this may be its last update.
• Until patched, restrict local interactive and terminal server logons to trusted users and enforce least privilege.
• Keep endpoint detection and response active and monitor for unusual privilege changes.
• Re-check CISA KEV and public exploit sources for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-70156 msrc.microsoft.com
• Vulners MSCVE mirror: CVE-2026-70156 vulners.com
• Vulners NVD mirror: CVE-2026-70156 vulners.com
• VulDB: CVE-2026-70156 vuldb.com
• Qualys Patch Tuesday review, October 2026 blog.qualys.com
• OpenCVE: CVE-2026-70156 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:11.