Microsoft Windows Kernel: Use-after-free leads to local privilege escalation
Summary
A use-after-free vulnerability (CWE-416) in the Windows kernel allows a local attacker with low privileges to elevate their privileges to a higher level, with a CVSS score of 7.8. It affects Windows 10 version 1809 and Windows Server 2019, among other Windows versions. Exploitation requires an existing local foothold, such as a compromised user account on the affected system. Microsoft has released fixed builds, and no public exploit or CISA KEV listing is known.
Affected
- Windows 10 Version 1809: builds 10.0.17763.0 to below 10.0.17763.9376
- Windows Server 2019 (including Server Core): builds 10.0.17763.0 to below 10.0.17763.9376
- Other affected branches per CVE record: Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2 and 26H1/26H2, Windows Server 2022 and 2025
Fixed in
- Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later
- Windows 10 21H2 / 22H2: build 10.0.19044.7807 / 10.0.19045.7807 or later
- Other branches: see the Microsoft Security Update Guide for the fixed builds
Workaround
Unknown. No vendor workaround is documented.
Exploitation
- Not listed in the CISA KEV catalogue.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Microsoft has not published technical details. No public proof-of-concept was found in the research.
- EPSS was low (around 0.003).
Our recommendation
- Install the October 2026 cumulative update (build 10.0.17763.9376 or later for Windows 10 1809 and Windows Server 2019) in the next patch window, starting with shared, terminal and multi-user systems.
- Restrict local logon on shared PCs and Remote Desktop or Terminal Server hosts.
- Check exposure: identify all Windows 10 1809 and Server 2019 systems and verify their build numbers.
- Monitor for unusual local privilege changes and unexpected administrative activity.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Kernel
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83690 msrc.microsoft.com
- Vulners: NVD record CVE-2026-83690 vulners.com
- Vulners: CVE list record CVE-2026-83690 vulners.com
- Vulners: Microsoft MSCVE record MS:CVE-2026-83690 vulners.com
- OpenCVE: CVE-2026-83690 app.opencve.io
- Tenable Nessus plugin 365467 www.tenable.com
- Vulners: Rapid7 record CVE-2026-83690 vulners.com
- GitHub: theori-io xint-public-bug-tracker issue 90 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:22.
Original description (NVD)
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.