Microsoft Windows Search: Local privilege escalation via use-after-free

Summary

A use-after-free vulnerability in the Windows Search Service allows an authorized local attacker to elevate privileges. An attacker needs an existing foothold on the system, such as a user account or malware running as a user, and the attack is not directly reachable from the internet. Successful exploitation can grant SYSTEM rights, which is most relevant on shared terminal servers, multi-user PCs and systems exposed to phishing.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Microsoft Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Microsoft Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Microsoft Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Microsoft Windows Server 2012 incl. Server Core (6.2.9200.0 to before 6.2.9200.26434)
• Microsoft Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to before 6.3.9600.23470)
• Microsoft Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Build 10.0.14393.9612 or later for Windows 10 1607 and Windows Server 2016
• Build 10.0.17763.9376 or later for Windows 10 1809
• Build 10.0.19044.7807 or later for Windows 10 21H2
• Build 10.0.19045.7807 or later for Windows 10 22H2
• Build 10.0.22631.7652 or later for Windows 11 23H2
• Build 10.0.26100.9711 or later for Windows 11 24H2 and Windows Server 2025
• Build 10.0.26200.9711 or later for Windows 11 25H2
• Build 10.0.28000.3231 or later for Windows 11 26H1
• Build 10.0.26300.9711 or later for Windows 11 26H2
• Build 6.2.9200.26434 or later for Windows Server 2012
• Build 6.3.9600.23470 or later for Windows Server 2012 R2

Note: Some third-party sources list different builds. Verify the build numbers in the MSRC Security Update Guide.

Workaround

Unknown.

• No vendor-documented workaround was found. Installing the security update is the only documented remediation.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitation assessed as less likely.
• Not listed in CISA KEV. EPSS below 1 percent.
• No public proof of concept found in research. This does not prove that none exists.

Our recommendation

• Install the October 2026 Microsoft cumulative update on all affected systems via Windows Update, WSUS or the Microsoft Update Catalog.
• Prioritize multi-user PCs and terminal or RDS servers.
• Check whether Windows 10 1607/1809 and Windows Server 2012/2016 systems still receive security updates or ESU coverage. Replace unsupported systems.
• Verify the fixed build numbers in the MSRC Security Update Guide before relying on them.
• Review the inventory, as the CPE listed only Windows 10 1607 and many more versions are affected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83575 msrc.microsoft.com
• Vulners NVD listing: CVE-2026-83575 vulners.com
• OpenCVE: CVE-2026-83575 app.opencve.io
• VulDB: CVE-2026-83575 vuldb.com
• Strix: CVE-2026-83575 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:43.