Windows Kernel: Use-after-free allows local privilege escalation
Summary
A use-after-free weakness in the Windows Kernel affects Windows 11 version 23H2 and Windows Server 2025, including Server Core installations. An attacker who already has a low-privilege local account can exploit it to gain SYSTEM privileges. Remote exploitation is not described, and the attack complexity is high.
Affected
- Windows 11 version 23H2 (x64 and ARM64): builds 10.0.22631.0 before 10.0.22631.7652
- Windows Server 2025 and Server Core installations: builds 10.0.26100.0 before 10.0.26100.33650
Fixed in
- Windows 11 version 23H2: KB5126653 (OS build 22631.7652), released 13 Oct 2026
- Windows Server 2025: KB5126646 (OS build 26100.33650), released 13 Oct 2026
- Verify the KB details on Microsoft's support pages, as the KB information used here could not be checked directly.
Workaround
- Unknown. No published workaround was found.
- Until patching is complete, limit local code execution, for example with standard user accounts, EDR and application control.
Exploitation
- Microsoft marks the vulnerability as not exploited.
- CISA SSVC data lists exploitation as none and automatable as no.
- The vulnerability is not in the CISA KEV catalogue.
- No public proof of concept was found in our searches, which does not prove that none exists.
Our recommendation
- Install the October 2026 cumulative update (KB5126653 or KB5126646) in the normal patch cycle.
- Prioritise multi-user PCs, terminal servers and Server 2025 hosts.
- Check that the update is installed on all affected systems and monitor for unusual privilege changes.
- This is not an emergency outside the regular update cycle.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70243 msrc.microsoft.com
- Vulners Rapid7 advisory: Microsoft Windows CVE-2026-70243 vulners.com
- Vulners NVD record: CVE-2026-70243 vulners.com
- OpenCVE: CVE-2026-70243 app.opencve.io
- Tenable plugin for KB5126653 bundle www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:57.
Original description (NVD)
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.