Microsoft Windows: Elevation of privilege in Kernel-Mode Drivers

Summary

A flaw in the Windows Kernel-Mode Drivers allows an authorized local user to elevate privileges on the affected system. Successful exploitation can give an attacker full control of the host, because kernel-mode drivers run in the core of the operating system. Access to a local account with low privileges is required, and the vulnerability cannot be exploited over the network.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to below 6.2.9200.26434, fixed build unverified)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to below 6.3.9600.23470, fixed build unverified)
• Windows Server 2016 and Server Core installation (10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to below 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to below 10.0.20348.5761)

Fixed in

• Windows 10 Version 1607 and Server 2016: 10.0.14393.9612
• Windows 10 Version 1809 and Server 2019: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2012 and 2012 R2: fixed build not confirmed by the vendor data available

Workaround

Unknown. No workaround is documented in the sources. Installing the security update is the remedy.

Exploitation

• Not known to be exploited in the wild (Microsoft: Exploited: No).
• Microsoft assesses exploitation as less likely and the vulnerability as not publicly disclosed.
• Exploit code maturity is Unproven; no public proof of concept was found.
• Not listed in the CISA KEV catalogue. CISA SSVC: exploitation none, not automatable.
• EPSS is very low (about 0.3%).

Our recommendation

• Install the October 2026 Windows security update on all affected systems, prioritizing hosts with shared use or untrusted users.
• Replace or upgrade Windows 10 Version 1607 and 1809 systems and Windows Server 2012 and 2012 R2 if they are still in production and out of support; verify their support status with Microsoft.
• Check that local accounts use least privilege and that endpoint protection is active, since an attacker needs a local foothold.
• Restart systems after patching and confirm the installed build number.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83837 msrc.microsoft.com
• Vulners: CVE-2026-83837 (fixed builds) vulners.com
• OpenCVE: CVE-2026-83837 app.opencve.io
• VulDB: CVE-2026-83837 vuldb.com
• Vulners: CVE list record CVE-2026-83837 vulners.com
• Vulners: NVD record CVE-2026-83837 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:54.