Windows Win32k: Use-after-free in kernel allows privilege escalation

Summary

A use-after-free flaw in the Win32k kernel subsystem of Windows allows a local attacker with low privileges to elevate their rights, potentially to SYSTEM. The attacker must already have access to the system, for example through a compromised user account or service. Once exploited, the flaw can lead to full control of the affected machine, since it runs in kernel mode.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core), per the CVE record, to be confirmed in the MSRC table: builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2022: builds before 10.0.20348.5761

Fixed in

• Fix released by Microsoft on October 13, 2026 (Patch Tuesday).
• Fixed builds per the CVE record are listed above as the first build without the flaw. Exact fixed builds and KB numbers must be checked in the MSRC table, since one research source reports a different fixed build (10.0.26100.33650) for Windows 11 24H2.
• No KB number is confirmed for Windows 10 1607 or Server 2016.

Workaround

Unknown.

• No workaround was identified in the sources. Check the Mitigations and Workarounds sections on the MSRC page.

Exploitation

• Microsoft rates exploit code maturity as Unproven, and no exploitation in the wild has been found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalogue according to a third-party tracker; re-check the catalogue.
• EPSS about 0.3 percent at the time of research.
• No public proof of concept found, which does not rule one out.
• Cisco Talos published Snort detection rules for this CVE.

Our recommendation

• Install the October 2026 Microsoft security update on all affected systems, starting with multi-user terminal servers and shared workstations.
• Confirm in the MSRC table whether your Windows 10 1607 or Server 2016 systems are affected and which fixed build applies.
• Check Microsoft's lifecycle status for Windows 10 1607 and plan an upgrade if the version is out of support.
• Limit local logon rights and review accounts with local access to critical systems.
• Monitor EPSS and the CISA KEV catalogue; raise the priority if a public exploit appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70176 msrc.microsoft.com
• NVD mirror on Vulners: CVE-2026-70176 vulners.com
• Cisco Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com
• Strix CVE overview: CVE-2026-70176 (third party, verify builds) www.strix.ai
• GitHub vulnerability tracker issue for CVE-2026-70176 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:05.