Windows TCP/IP: Privilege escalation via double free

Summary

A double free (CWE-415) in the Windows TCP/IP stack allows an attacker with a valid local, low-privileged account to elevate privileges locally. Successful exploitation requires local code execution or an authenticated local user, so the bug is a follow-on risk rather than an internet-facing entry point. Microsoft has released a fix, no public exploit is known, and CISA data shows no exploitation. Windows 10 1607 and Server 2016 are the most urgent because Windows 10 LTSB 2016 reached end of updates on the day the CVE was published.

Affected

• Windows 10 Version 1607 (x64 and 32-bit): builds 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2016 (including Server Core): builds 10.0.14393.0 to below 10.0.14393.9612
• Other builds listed in the CVE record: Windows 10 1809 and 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, Windows Server 2019 and 2022

Fixed in

• Windows 10 1607 and Server 2016: build 10.0.14393.9612 (October 2026 update, KB5126868 according to Microsoft release health; verify the KB on the MSRC page)
• Other versions: fixed builds as listed in the MSRC Security Update Guide

Workaround

Unknown. No vendor workaround is documented because a patch is available. Credential Guard and application control limit post-exploitation movement but do not fix this vulnerability.

Exploitation

• No public proof of concept observed.
• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS is about 0.3 percent, which is low.

Our recommendation

• Inventory all Windows 10 1607 and Server 2016 hosts, including kiosks, POS and HMI devices.
• Install the October 2026 update (build 10.0.14393.9612 or later) and check the known Exchange/OWA issue with this update first.
• Restrict local logons on shared and multi-user hosts and enable Credential Guard where supported.
• Plan migration to a supported Windows version, or Extended Security Updates, for 1607 devices that cannot be patched.
• Prioritise multi-user systems and any machine accessible to untrusted local users.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83842 msrc.microsoft.com
• Microsoft Release Health: Windows 10 1607 and Server 2016 learn.microsoft.com
• OpenCVE: CVE-2026-83842 app.opencve.io
• Vulners: CVE-2026-83842 vulners.com
• SentinelOne vulnerability database: CVE-2026-83842 www.sentinelone.com
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:11.