Microsoft Windows Win32 Kernel: Use-after-free leads to local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Win32 Kernel Subsystem allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account on the system and no user interaction is required. The flaw is not internet-facing, but an attacker or malware with a foothold on a workstation or server could gain SYSTEM rights.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: builds before 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 respectively
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33650

Fixed in

• Security update released with the October 2026 Patch Tuesday (13 October 2026). Install the build listed above for your version or later.
• Windows 10 Version 1809 and Windows Server 2019: October 2026 cumulative update (KB5126651 according to Tenable; verify in the MSRC advisory).

Workaround

• No Microsoft workaround known. Apply the security update.

Exploitation

• Conflicting signals. Talos mentions an exploited vulnerability in its October 2026 review and lists this CVE among prominent vulnerabilities, without stating that it is the exploited one.
• CISA SSVC data lists exploitation as "none". Listing in the CISA KEV catalogue is unverified.
• SonicWall lists the CVE under vulnerabilities with detections, which suggests exploit-related tooling was seen.
• Public proof of concept: Unknown.
• EPSS: 0.00381 (low).

Our recommendation

• Apply the October 2026 security update to all affected Windows 10 1809, Windows Server 2019 and other listed systems, prioritising multi-user terminal servers and shared workstations.
• Check whether Windows 10 1809 or Server 2019 systems are still in use and verify their lifecycle status.
• Verify the exact fixed build in the MSRC advisory and in the CISA KEV catalogue.
• Monitor EDR and threat intelligence for privilege escalation activity and treat the update as urgent if related activity is seen.
• Reduce the risk of initial access through phishing and malware protection, since this flaw requires a local foothold.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83761 msrc.microsoft.com
• Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com
• Vulners: MS:CVE-2026-83761 (Microsoft advisory data) vulners.com
• OpenCVE: CVE-2026-83761 app.opencve.io
• Vulners: RAPID7:CVE-2026-83761 (CVSS and EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:07.