Windows Hello: Use-after-free allows local privilege escalation

Summary

A use-after-free vulnerability in the Windows Hello authentication component allows an attacker with local, low-privileged access to elevate privileges. The attack requires a local foothold, such as a compromised user session or malware running as a standard user, and its complexity is high. The flaw is not directly reachable from the internet, but it matters most on shared or poorly segmented workstations.

Affected

• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)

Fixed in

• Fixed in the October 2026 security updates. Fixed builds: 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2).
• Tenable lists KB5126657 for Windows 10 21H2/22H2 and KB5126653 for Windows 11 23H2. The KB numbers are not yet confirmed on MSRC.

Workaround

Unknown. No vendor workaround or mitigation has been identified; install the update.

Exploitation

• CISA SSVC data: exploitation none, not automatable, technical impact total.
• Not listed in the CISA KEV catalog according to OpenCVE.
• A Tenable plugin page marks an exploit as available and shows a KEV due date, but these fields may refer to other CVEs in the same bundle. Unverified.
• No public proof of concept identified.

Our recommendation

• Install the October 2026 cumulative update on all affected Windows 10 and Windows 11 systems, prioritising 21H2 and shared PCs.
• Verify the exact KB number and build on the MSRC advisory before rollout.
• Check whether 21H2 devices are still eligible for security updates (ESU or LTSC). Unsupported systems must be upgraded.
• Limit local administrator rights and monitor for unusual privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83790 msrc.microsoft.com
• Vulners: CVE-2026-83790 (CVELIST) vulners.com
• Vulners: CVE-2026-83790 (NVD) vulners.com
• Strix: CVE-2026-83790 www.strix.ai
• Tenable plugin 365467 www.tenable.com
• OpenCVE: CVE-2026-83790 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:14.