Microsoft Windows: Use-after-free in Windows Kernel allows local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Windows kernel allows an authorized local user to elevate privileges. Affected are Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025, according to the CNA data. An attacker needs local access and low privileges, and the attack complexity is high. Exploitation is not confirmed, and CISA SSVC lists exploitation as none.
Affected
- Windows 11 Version 24H2: builds 10.0.26100.0 to below 10.0.26100.9711 (CNA data)
- Windows 11 Version 25H2: builds 10.0.26200.0 to below 10.0.26200.9711
- Windows 11 Version 26H1: builds 10.0.28000.0 to below 10.0.28000.3231
- Windows 11 Version 26H2: builds 10.0.26300.0 to below 10.0.26300.9711
- Windows Server 2025 (including Server Core): builds 10.0.26100.0 to below 10.0.26100.33650
- Note: the exact build line for 24H2 is not fully verified; check the MSRC advisory.
Fixed in
- October 2026 security updates for the listed Windows versions. Fixed builds according to the CNA data: 24H2 from 10.0.26100.9711, 25H2 from 10.0.26200.9711, 26H1 from 10.0.28000.3231, 26H2 from 10.0.26300.9711, Server 2025 from 10.0.26100.33650.
- Third-party reports name KB5127648 (Windows 11) and KB5126646 (Server 2025) as the update packages. These KB numbers are not confirmed by the vendor here.
Workaround
Unknown. No vendor-documented workaround was found; patching is the only known fix.
Exploitation
- Not listed in CISA KEV.
- Microsoft temporal vector E:U (exploit code maturity unproven).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS below 1 percent.
- A public proof of concept for a similar Windows kernel use-after-free was reported on October 15, 2026, but it has not been linked to this CVE.
Our recommendation
- Install the October 2026 Windows security update on all affected endpoints and servers within the normal patch cycle; prioritise shared PCs, terminal and RDP servers and multi-user systems.
- Verify the fixed build for each Windows branch on the MSRC advisory before rollout.
- Limit local logon rights and remove unneeded local accounts.
- Keep EDR active and monitor for privilege escalation activity.
- Patch sooner if a public exploit for this CVE is confirmed.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide (CVE-2026-83675) msrc.microsoft.com
- CNA data (vulners CVELIST) vulners.com
- OpenCVE app.opencve.io
- Strix CVE summary www.strix.ai
- Tenable plugin 365473 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:37.
Original description (NVD)
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.