Microsoft Windows Win32k: Use after free allows local privilege escalation

Summary

A use-after-free vulnerability in the Win32k kernel subsystem of Windows allows an authorized local attacker to elevate privileges to a higher level. The attacker needs local access and low privileges, and exploitation is rated as high complexity. Microsoft rates the flaw as Important with a CVSS 3.1 base score of 7.0, and no exploitation has been observed.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761

Fixed in

• Install the October 2026 Windows security update for your edition (MSRC lists the fixed builds).
• Windows 10 1607 and Server 2016: 10.0.14393.9612 or later (per CVE record)
• Windows 10 1809 and Server 2019: 10.0.17763.9376 or later
• Windows 10 21H2: 10.0.19044.7807 or later; Windows 10 22H2: 10.0.19045.7807 or later
• Windows 11 23H2: 10.0.22631.7652 or later
• Windows 11 24H2 and 25H2, 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 or later; 26H1: 10.0.28000.3231 or later
• Windows Server 2022: 10.0.20348.5761 or later
• KB numbers for Windows 10 1607 and Server 2016 are unknown; check the MSRC page.

Workaround

Unknown. Microsoft documents no workaround. As general hardening, restrict legacy applications that trigger Win32k operations and enforce least privilege for user accounts.

Exploitation

• No evidence of exploitation in the wild.
• MSRC exploit code maturity: Unproven.
• Not listed in CISA KEV; a third-party tracker reports an EPSS score of 0.30%.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.

Our recommendation

• Identify all Windows 10 1607 and Server 2016 hosts and check whether they are still supported.
• Patch all affected systems with the October 2026 update; verify the exact fixed build on the MSRC page.
• Where 1607 is out of support, plan replacement or isolate these systems and limit local user accounts.
• Reduce local administrator rights and restrict interactive logon to legacy systems.
• Monitor for unusual privilege escalation on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-70253 msrc.microsoft.com
• NVD record via OpenCVE mirror app.opencve.io
• NVD record via Vulners vulners.com
• Tracker with KEV and EPSS data github.com
• Third-party build table (unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:56.