Windows 10 1607: Use after free in Windows Kernel-Mode Drivers

Summary

A use-after-free vulnerability (CWE-416, with a related race condition, CWE-367) in the Windows Kernel-Mode Drivers component of Windows 10 version 1607 allows a local attacker to elevate privileges to SYSTEM. The attacker needs a low-privileged account on the affected system, and the attack complexity is high. The flaw is not reachable from the internet. Windows 10 1607 has reached end of support, so the October 2026 fix may be the last security update for this branch.

Affected

• Windows 10 Version 1607: builds below 10.0.14393.9612
• Windows Server 2016 (including Server Core): builds below 10.0.14393.9612 (per CNA record; verify on the Microsoft advisory page)
• The CNA record also lists other Windows 10, Windows 11 and Windows Server 2019/2022 builds; this entry covers 1607 and Server 2016 only.

Fixed in

• Build 10.0.14393.9612 (KB5126868, October 13, 2026)
• Build 10.0.14393.9615 (KB5134123, out-of-band, October 26, 2026). Treat as the current build to deploy; whether it adds fixes beyond 9612 is unconfirmed.

Workaround

• No official workaround known. Patching is the only effective measure.

Exploitation

• Microsoft: not publicly disclosed, not known to be exploited; exploitation rated 'More Likely'.
• CISA SSVC: exploitation none, not automatable.
• Conflict: a PacketStorm entry dated 15 October 2026 describes a public proof of concept for a use-after-free in Windows Kernel-Mode Drivers. It does not clearly name this CVE and is unverified. Assume a public PoC may exist.
• No evidence of in-the-wild exploitation found.

Our recommendation

• Inventory all Windows 10 1607 and Server 2016 systems and verify their build numbers.
• Deploy build 10.0.14393.9615 (at least 9612) and verify the installation.
• Plan migration off 1607, as this is likely the last security branch.
• Until patched, restrict local logon on shared systems and terminal servers and monitor for unusual SYSTEM-level activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  wkpwn/CVE-2026-83834

Research sources

• Microsoft Security Update Guide: CVE-2026-83834 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-83834 msrc.microsoft.com
• KB5126868: Windows 10 1607 security update (October 2026) support.microsoft.com
• KB5134123: Windows 10 1607 update (October 2026, out-of-band) support.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 status learn.microsoft.com
• PacketStorm PACKETSTORM:235837 (unverified PoC claim) vulners.com
• OpenCVE: CVE-2026-83834 app.opencve.io
• VulDB: CVE-2026-83834 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:12.