Microsoft Windows Win32k: Local privilege escalation via race condition
Summary
A race condition (CWE-362) in the Win32k graphics subsystem of Windows allows a local attacker with low privileges to gain higher privileges, potentially up to SYSTEM. The attacker must already be able to run code on the affected machine, for example through phishing, malware or stolen credentials. The CVSS 3.1 base score is 7.0 (HIGH), and CISA SSVC lists no known exploitation and no automation.
Affected
- Windows 10 Version 1809 (builds 10.0.17763.0 to below 10.0.17763.9376)
- Windows 10 Version 21H2 (builds below 10.0.19044.7807)
- Windows 10 Version 22H2 (builds below 10.0.19045.7807)
- Windows 11 Version 23H2 (builds below 10.0.22631.7652)
- Windows 11 Version 24H2 (builds below 10.0.26100.9711)
- Windows 11 Version 25H2 (builds below 10.0.26200.9711)
- Windows 11 Version 26H1 (builds below 10.0.28000.3231)
- Windows 11 Version 26H2 (builds below 10.0.26300.9711)
- Windows Server 2019 including Server Core (builds below 10.0.17763.9376)
- Windows Server 2022 (builds below 10.0.20348.5761)
- Windows Server 2025 including Server Core (builds below 10.0.26100.33650)
Fixed in
Install the Microsoft security update for CVE-2026-83841 from the MSRC Security Update Guide. Fixed builds per the CNA record:
- Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376
- Windows 10 Version 21H2: 10.0.19044.7807
- Windows 10 Version 22H2: 10.0.19045.7807
- Windows 11 Version 23H2: 10.0.22631.7652
- Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
- Windows 11 Version 26H1: 10.0.28000.3231
- Windows Server 2022: 10.0.20348.5761
- Windows Server 2025: 10.0.26100.33650
A reboot is required after installation.
Workaround
Unknown. No specific workaround was found. Only generic detection guidance exists: enable auditing of privilege escalation events and monitor system logs for abnormal privilege escalations.
Exploitation
- No known exploitation in the wild; not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
- EPSS is very low (about 0.2%).
Our recommendation
- Install the Microsoft update for CVE-2026-83841 on all affected Windows 10, 11 and Server systems and reboot them. Verify the build numbers in the MSRC Security Update Guide before rollout.
- Prioritise unpatched Windows 10 Version 1809 and Windows Server 2019 hosts, which are often legacy or specialised machines. Check whether these builds are still supported.
- Enable auditing of privilege escalation events and monitor logs for abnormal activity.
- Limit local accounts and admin rights, and keep endpoint protection and phishing defences up to date, since exploitation requires a local foothold.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Win32K
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-83841 msrc.microsoft.com
- NVD mirror (Vulners): CVE-2026-83841 vulners.com
- CVE List mirror (Vulners): CVE-2026-83841 vulners.com
- VulDB: CVE-2026-83841 vuldb.com
- OpenCVE: CVE-2026-83841 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:11.
Original description (NVD)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.