Windows 10 1607: Use-after-free in Win32k allows local privilege escalation

Summary

A use-after-free weakness in the Windows Win32k kernel subsystem affects Windows 10 Version 1607 (CWE-416). An authorized attacker with local access can exploit it to elevate privileges. Exploitation requires local code execution or a logged-on low-privileged account, and the attack complexity is high. Microsoft rates the CVSS 3.1 base score at 7.0 (High).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612 (per the NVD and CVE record; confirm against the MSRC page)
• The CVE record also lists other Windows 10, Windows 11 and Windows Server releases, plus Microsoft Office for Android.

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later, delivered with the October 2026 security update (MSRC advisory)

Workaround

Unknown. No vendor-documented workaround was found. Patching is the only documented remediation.

Exploitation

• Publicly disclosed: No (MSRC, at publication)
• Exploited in the wild: No (MSRC, at publication)
• MSRC exploitability assessment: Exploitation More Likely
• Not listed in CISA KEV according to OpenCVE data; the live catalogue was not checked
• No public proof of concept found in the sources
• SonicWall lists a detection signature for an exploit file; this is not evidence of in-the-wild exploitation
• EPSS was about 0.3% at the time of research

Our recommendation

• Inventory all systems running Windows 10 Version 1607, especially multi-user, kiosk and terminal server hosts.
• Install the October 2026 Microsoft update with build 10.0.14393.9612 or later and verify the build afterwards.
• Plan the replacement of Windows 10 Version 1607, as this release is out of mainstream support; check your licensing for extended support options.
• Where patching is not possible, isolate the affected host and restrict local logon to trusted users.
• Review hosts that were unpatched for signs of local privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70271 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-70271 msrc.microsoft.com
• OpenCVE: CVE-2026-70271 app.opencve.io
• Vulners MSCVE mirror: MS:CVE-2026-70271 vulners.com
• Vulners NVD mirror: CVE-2026-70271 vulners.com
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:54.