Windows 11: Use-after-free in Bind Filter Driver allows local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Windows Bind Filter Driver allows an authorized local attacker to elevate privileges. An attacker needs a foothold on the affected machine and an account with low privileges, such as a standard user account. Successful exploitation can give full control of the system (CVSS 3.1: 7.0, high complexity).
Affected
- Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
- Windows Server 2025 (incl. Server Core): 10.0.26100.0 to < 10.0.26100.33650
Fixed in
- Windows 11 Version 24H2: 10.0.26100.9711 (October 2026 security update, according to the CNA record)
- Windows 11 Version 25H2: 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.9711
- Windows Server 2025: 10.0.26100.33650
- KB number for Windows 11 24H2: Unknown. Confirm in the MSRC Security Update Guide.
Workaround
Unknown. No workaround was found in the sources. Rely on the patch.
Exploitation
- Publicly disclosed: No (according to Microsoft).
- Exploited in the wild: No (according to Microsoft).
- Exploitability assessment by Microsoft: Exploitation Unlikely.
- Not listed in the CISA KEV catalogue.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept was found at the time of research.
Our recommendation
- Install the October 2026 security update on all Windows 11 24H2 endpoints and check that it is installed, including on machines that are updated rarely.
- Prioritise shared terminal servers, RDS hosts and systems where users have shell or script access.
- Confirm the fixed build for your version in the MSRC Security Update Guide before rollout.
- Monitor for unusual privilege changes on endpoints.
- Standard patch cycle is sufficient, as exploitation is rated unlikely.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft MSRC Security Update Guide msrc.microsoft.com
- OpenCVE (CVSS, SSVC, KEV status) app.opencve.io
- CVE/CNA data via Vulners vulners.com
- Vulners NVD mirror vulners.com
- Strix version table www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:06.
Original description (NVD)
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.