Windows: Local privilege escalation via TOCTOU race condition in Setup Files Cleanup

Summary

A time-of-check time-of-use race condition (CWE-367) in the Windows Setup Files Cleanup component allows an authorized local user to elevate privileges. Microsoft states that a successful attacker could gain SYSTEM privileges. Exploitation requires a local logon with low privileges and a suitable timing condition (high attack complexity); remote exploitation is not possible.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 (incl. Server Core): 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 10 21H2 and 22H2: build 10.0.19045.7807 or later (21H2: 10.0.19044.7807)
• Windows 11 23H2: build 10.0.22631.7652 or later
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711 or later (25H2/26H2: 10.0.26200.9711 and 10.0.26300.9711)
• Windows 11 26H1: build 10.0.28000.3231 or later
• Windows Server 2012: build 6.2.9200.26434 or later
• Windows Server 2012 R2: build 6.3.9600.23470 or later
• KB number for the Windows 10 1607 / Server 2016 update: Unknown.

Workaround

Unknown. Microsoft has not documented a workaround in the sources reviewed.

• As a general least-privilege measure, remove unnecessary user rights on affected systems. This is not a vendor-tested fix.

Exploitation

• Microsoft marks the vulnerability as not exploited and exploit code maturity as Unproven.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof-of-concept found in the searches performed; this is not conclusive.

Our recommendation

• Install the October 2026 Windows security update on all affected systems, checking the build number against the Microsoft Security Update Guide before rollout.
• Verify whether Windows 10 1607 and Server 2016 still receive security updates or ESU coverage, as the update may not be available otherwise.
• Prioritise Remote Desktop/terminal servers, shared PCs and hosts where contractors or untrusted staff have logon rights.
• Review local accounts and remove unnecessary logon and administrative rights.
• Monitor for unusual privilege changes and new SYSTEM-level processes on affected hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83510 msrc.microsoft.com
• Microsoft Security Update Guide (en-US) msrc.microsoft.com
• OpenCVE: CVE-2026-83510 app.opencve.io
• Vulners NVD: CVE-2026-83510 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:46.