Windows 10 1607: Use-after-free in Win32k allows local privilege escalation

Summary

A use-after-free flaw in the Win32k kernel-mode graphics subsystem of Windows 10 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker needs an existing low-privilege foothold on the system, such as a compromised account or malware, but no user interaction is required. Once exploited, the impact on confidentiality, integrity and availability is high.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2016 and Server 2016 Server Core (builds 10.0.14393.0 before 10.0.14393.9612)
• Other affected lines in the same advisory include Windows 10 1809, 21H2, 22H2, Windows 11 23H2 to 26H2 and Windows Server 2019, 2022

Fixed in

• Windows 10 1607 and Server 2016: build 10.0.14393.9612 or later
• Windows 10 1809 and Server 2019: 10.0.17763.9376 or later
• Windows 10 21H2: 10.0.19044.7807 or later
• Windows 10 22H2: 10.0.19045.7807 or later
• Windows Server 2022: 10.0.20348.5761 or later
• KB number for Windows 10 1607 and Server 2016: Unknown. Take it from the MSRC page or the Microsoft Update Catalog.

Workaround

Unknown. No vendor-documented workaround was found; patching is the only known fix.

Exploitation

• Microsoft marks the vulnerability as not exploited (Exploited: No) and rates exploit code maturity as unproven.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS is 0.00391, which is very low.
• No public proof of concept was found in the research. This is not proof that none exists.

Our recommendation

• Identify all Windows 10 1607 and Server 2016 hosts and confirm their build numbers.
• Install the October 2026 cumulative update and verify the build is 10.0.14393.9612 or later.
• Prioritise multi-user systems such as terminal servers, file servers and shared PCs.
• Confirm the KB article and the lifecycle status of Windows 10 1607 with Microsoft.
• Monitor the CISA KEV catalog and vendor updates for changes to the exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83732 msrc.microsoft.com
• Vulners CVE record (CVELIST) vulners.com
• Vulners NVD record vulners.com
• OpenCVE: CVE-2026-83732 app.opencve.io
• Qualys Patch Tuesday review, October 2026 blog.qualys.com
• Strix: CVE-2026-83732 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:12.