Microsoft Windows TCP/IP: Local privilege escalation via use-after-free

Summary

A use-after-free vulnerability (CWE-416) in the Windows TCP/IP stack allows an attacker with low privileges on the system to elevate their privileges. The attack requires local access and a high-complexity condition, so it is a second-stage escalation after an attacker has already gained a foothold, for example through a compromised user account or malware. The CVSS 3.1 base score is 7.0 (HIGH). Several Windows client and server versions are affected, not only Windows 10 1607.

Affected

• Microsoft Windows 10 Version 1607 (build 10.0.14393.0 to below 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (build 10.0.17763.0 to below 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (build 10.0.19044.0 to below 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (build 10.0.19045.0 to below 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2 (build 10.0.22631.0 to below 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2 (build 10.0.26100.0 to below 10.0.26100.9711)
• Microsoft Windows 11 Version 25H2 (build 10.0.26200.0 to below 10.0.26200.9711)
• Microsoft Windows 11 Version 26H1 (build 10.0.28000.0 to below 10.0.28000.3231)
• Microsoft Windows 11 Version 26H2 (build 10.0.26300.0 to below 10.0.26300.9711)
• Microsoft Windows Server 2012 and 2012 R2 (including Server Core installations)
• Microsoft Windows Server 2016 (build 10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 1607: build 10.0.14393.9612 or later (KB number: unknown, obtain from the MSRC Security Update Guide)
• Windows 10 1809: build 10.0.17763.9376 or later (KB5126651)
• Windows 10 21H2: build 10.0.19044.7807 or later
• Windows 10 22H2: build 10.0.19045.7807 or later (one secondary source lists 19044.7807, probably a typo)
• Windows 11 23H2: build 10.0.22631.7652 or later
• Windows 11 24H2 and Windows Server 2025: build 10.0.26100.9711 or later per the CNA record (a secondary source cites 10.0.26100.33650 for Server 2025; verify on MSRC)
• Windows 11 25H2 and 26H2: build 10.0.26200.9711 / 10.0.26300.9711 or later
• Windows 11 26H1: build 10.0.28000.3231 or later
• Windows Server 2012 and 2012 R2: builds 6.2.9200.26434 and 6.3.9600.23470 or later
• Windows Server 2016: build 10.0.14393.9612 or later

Workaround

Unknown. No vendor workaround was found in the sources. Apply the update.

• Compensating controls (not from a vendor source): restrict local interactive and remote logon to trusted administrators and enforce least privilege on shared or multi-user systems.

Exploitation

• No evidence of exploitation in the wild was found in the research. The CISA KEV catalogue was not verified.
• No public proof-of-concept exploit was found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• EPSS score: 0.00286.

Our recommendation

• Apply the October 2026 cumulative update to all affected Windows systems, prioritising Windows 10 1607 and Windows Server 2016.
• Inventory all Windows versions in your environment, not only Windows 10 1607, and check each against the affected build ranges.
• Retire any remaining Windows 10 1607 hosts or upgrade them to a supported version. A secondary research note states, without verification, that Windows 10 Enterprise LTSB 2016 support ends on 13 October 2026.
• Restrict local logon and administrative rights to trusted accounts and monitor systems for unusual privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide (CVE-2026-83682) msrc.microsoft.com
• Vulners: CNA record (CVELIST) vulners.com
• Vulners: CIRCL record (fixed build 17763.9376) vulners.com
• Vulners: NVD record (status and EPSS) vulners.com
• Strix: CVE-2026-83682 (CVSS and CWE) www.strix.ai
• OpenCVE: CVE-2026-83682 app.opencve.io
• Vulners: Positive Technologies record PT-2026-112487 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:36.