Microsoft Windows 10 1607: Use-after-free in Win32k kernel allows privilege escalation

Summary

A use-after-free flaw in the Windows Win32k kernel subsystem allows a local user with a valid low-privilege account to elevate privileges to a higher level. The CVSS base score is 7.0 (HIGH), and the attack complexity is high. The vulnerability is not reachable from the internet and requires local access.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2016, including Server Core installation (builds 10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later, provided by the security update released on 13 October 2026
• The KB number for this update is unknown; check the Security Updates table on the MSRC advisory.

Workaround

Unknown. Microsoft does not document a workaround. As an interim measure, limit local logon on unpatched hosts to trusted users (this is a suggestion, not a vendor recommendation).

Exploitation

• Microsoft's exploitability assessment: no public exploit code available and not exploited at the time of publication.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Not listed in CISA KEV. EPSS is low (about 0.3%).
• No public proof-of-concept or exploitation reports were found in the research, which does not prove that none exist.

Our recommendation

• Install the October 2026 security update on all Windows 10 1607 and Server 2016 systems.
• Verify the lifecycle status of Windows 10 1607 on Microsoft's lifecycle pages; if it is no longer supported, plan an upgrade or isolate the systems.
• Prioritise shared, terminal server and kiosk systems, and workstations where users open untrusted files or attachments.
• Limit local logon to trusted users until patching is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70249 msrc.microsoft.com
• VulnERS NVD record: CVE-2026-70249 vulners.com
• OpenCVE: CVE-2026-70249 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:56.