Windows: Use-after-free in Camera Frame Server Monitor allows privilege escalation

Summary

A use-after-free flaw in the Windows Camera Frame Server Monitor component allows an attacker to elevate privileges. According to the CNA record, the attacker needs adjacent network access, no privileges and no user interaction, which is an unusual combination for an elevation-of-privilege bug and should be confirmed on MSRC. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability.

Affected

• Windows 11 version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650
• Windows 10 and Windows Server 2016/2019: not listed in the sources reviewed; status unknown.

Fixed in

• Fixed in Microsoft's October 2026 security update.
• Windows 11 23H2: build 10.0.22631.7652 or later (KB5126653 per a third-party plugin title, to be confirmed on MSRC)
• Windows 11 24H2, 25H2, 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later
• Windows 11 26H1: build 10.0.28000.3231 or later
• Windows Server 2022: build 10.0.20348.5761 or later
• Windows Server 2025: build 10.0.26100.33650 or later (KB5126646 per a third-party plugin title, to be confirmed on MSRC)

Workaround

• Apply the October 2026 security updates first; no other vendor workaround is confirmed in the sources reviewed.
• Temporary measure only, not from Microsoft: if an update cannot be applied and the Camera Frame Server Monitor service is not needed, it may be disabled. This is an inference from a third-party site and should be verified.

Exploitation

• No known exploitation in the wild at the time of review.
• CISA SSVC data in the CVE record: exploitation none, automatable no.
• No CISA KEV listing and no public proof-of-concept found.

Our recommendation

• Deploy the October 2026 Windows security updates through the normal patch cycle, prioritising servers and shared or kiosk-style systems where an adjacent attacker is more plausible.
• Verify the affected builds and KB numbers for each operating system on the MSRC Security Update Guide.
• Check whether Windows 10 and Windows Server 2016/2019 are affected, as the sources do not confirm this.
• Confirm the prerequisites in the MSRC FAQ, as the CVSS vector seems unusual for an elevation-of-privilege bug.
• Do not confuse this with CVE-2026-85803, a separate Camera Frame Server Monitor vulnerability with a different rating.
• Monitor for updated exploitation information.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83771 msrc.microsoft.com
• OpenCVE: CVE-2026-83771 app.opencve.io
• Vulners NVD: CVE-2026-83771 vulners.com
• Strix: CVE-2026-83771 www.strix.ai
• Qualys: Microsoft Patch Tuesday October 2026 blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:33.