Windows 11 26H1: Use-after-free in Kerberos allows local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Windows Kerberos component of Windows 11 version 26H1 allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account and local access, and the attack complexity is high. Successful exploitation can compromise confidentiality, integrity and availability of the affected machine.
Affected
- Microsoft Windows 11 version 26H1 (ARM64-based and x64-based systems, according to CNA data)
- Versions 10.0.28000.0 up to but not including 10.0.28000.3231
- Note: Wikipedia lists 26H1 as ARM-only, so verify which builds are actually in use.
- Unknown: whether other Windows versions are affected.
Fixed in
- Build 10.0.28000.3231 (KB5127646), part of the October 2026 security update for version 26H1
Workaround
- None documented. The vendor fix is the patch.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, automatable no. Not listed in KEV.
- No public proof of concept found at the time of research.
Our recommendation
- Check whether any devices run Windows 11 26H1 (build 28000.x).
- Install KB5127646 (build 10.0.28000.3231) on affected devices in the normal monthly patch cycle.
- Prioritise shared or privileged devices.
- No emergency measures required.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Kerberos
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows
- Updates (KB)
- KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- OpenCVE CVE record app.opencve.io
- CNA data mirror (affected versions) vulners.com
- Build 28000.3231 / KB5127646 details pureinfotech.com
- Windows Update release notes x.com
- Senserva KB5127646 page senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:27.
Original description (NVD)
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.