IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows: Use-after-free in Win32 kernel subsystem allows privilege escalation

CVE-2026-83756High 7.8

← All vulnerabilities

Summary

A use-after-free flaw (CWE-416) in the Win32 kernel subsystem of Windows allows a local, authorized user to elevate privileges to a higher level, with a CVSS 3.1 score of 7.8. The attacker needs a valid low-privilege account and local access, but no user interaction. The main risk is a privilege-escalation step after phishing, stolen credentials or malware has gained a foothold on a system.

Affected

  • Windows 10 Version 21H2: builds below 10.0.19044.7807
  • Windows 10 Version 22H2: builds below 10.0.19045.7807 (one aggregator lists 19044 for this version, which appears to be a typo)
  • Windows 11 Version 23H2: builds below 10.0.22631.7652
  • Windows 11 Version 24H2: builds below 10.0.26100.9711
  • Windows 11 Version 25H2: builds below 10.0.26200.9711
  • Windows 11 Version 26H1: builds below 10.0.28000.3231
  • Windows 11 Version 26H2: builds below 10.0.26300.9711
  • Windows Server 2022: builds below 10.0.20348.5761
  • Windows Server 2025 (including Server Core): builds below 10.0.26100.33650

Fixed in

  • Security updates from the October 2026 cumulative update, for the builds listed above
  • Tenable maps the CVE to KB5126657 (Windows 10 21H2/22H2) and KB5126646 (Windows Server 2025); not verified against the Microsoft advisory

Workaround

Unknown.

Exploitation

  • Exploited in the wild: not confirmed. No CISA KEV entry was found for this CVE. A Tenable page lists a CISA KEV due date of 10/16/2026 that may refer to this CVE, but this is unclear and must be verified.
  • Public proof-of-concept code: none found.
  • EPSS score: 0.00325 (very low), according to one aggregator.
  • CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

  • Treat as high priority and install the October 2026 cumulative update within the normal monthly cycle.
  • Prioritise Windows 10 21H2 endpoints and multi-user servers, such as Remote Desktop or terminal servers.
  • Check whether Windows 10 21H2 devices are still eligible for updates through Extended Security Updates (ESU); verify this on Microsoft's lifecycle page.
  • Verify the KB and build numbers on the Microsoft Security Response Center page before rollout.
  • Re-check the CISA KEV catalog, as the exploitation status may change.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Win32 Kernel Subsystem
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126655, KB5126657, KB5126646, KB5127648, KB5126653, KB5127646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:11.

Original description (NVD)

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed