Windows COM+ Event System Service: Use after free enables local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows COM+ Event System Service allows an authorized, low-privileged local user to elevate privileges. The attack is not remotely exploitable and requires a local foothold, such as a phished user account or other malware. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability of the system.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: 10.0.19044.0 to before 10.0.19045.7807 (per CNA ranges)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: fixed builds listed in the CNA data (see MSRC for exact values)
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows Server 2012 and 2012 R2 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 / Server 2016: build 10.0.14393.9612 or later
• Windows 10 Version 1809 / Server 2019: build 10.0.17763.9376 or later
• Windows 10 Version 22H2: build 10.0.19045.7807 or later
• Patch names reported by third parties: KB5126651 (Windows 10 1809 / Server 2019) and KB5126646 (Server 2025). The KB number for Windows 10 1607 is unknown.
• Fix is included in the Microsoft October 2026 security update. Verify exact builds on the MSRC advisory before rollout, as one third-party source reports a different build for Windows 11 24H2.

Workaround

Unknown. No official workaround has been identified. Patching is the only confirmed fix.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• No evidence of exploitation in the wild found
• No public proof of concept found
• EPSS 0.00318 (low predicted exploitation probability)

Our recommendation

• Apply the Microsoft October 2026 cumulative update to all affected Windows systems
• Prioritise multi-user servers, RDS/terminal servers and shared workstations
• Confirm that Windows 10 1607 and Server 2016 systems are still receiving updates, as these versions may be near end of support
• Restrict local logon rights and monitor for unusual privilege escalation activity until patched

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83785 msrc.microsoft.com
• NVD data (mirrored) via OpenCVE app.opencve.io
• Vulners CVE record (CNA data) vulners.com
• EPSS data via Vulners vulners.com
• Qualys Microsoft Patch Tuesday October 2026 review blog.qualys.com
• Strix CVE-2026-83785 (third-party mirror, secondary) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:15.