Microsoft Windows: Use-after-free in Windows Hello allows privilege escalation

Summary

A use-after-free flaw in Windows Hello allows an authorized attacker to elevate privileges locally. An attacker with a low-privilege account on the affected device could gain higher privileges, potentially up to full control of the system. The attack requires local access and a high-complexity condition, and the vulnerability is not reachable from the internet.

Affected

• Windows 10 Version 21H2: builds 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: builds 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: builds 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to below 10.0.26300.9711
• Note: the NVD CPE entry lists only Windows 10 21H2; the CNA record lists the versions above.

Fixed in

• Install the October 2026 Windows security update for each affected version.
• Fixed builds per the CNA record: 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2).
• Verify the fixed builds in the MSRC advisory before rollout.

Workaround

Unknown. No vendor workaround or interim mitigation was found in the sources. Patching is the stated remedy.

Exploitation

• Not listed in the CISA Known Exploited Vulnerabilities catalog.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• EPSS score: 0.00252 (below 1%).
• No public proof-of-concept exploit found.
• No known in-the-wild exploitation as of 4 November 2026.

Our recommendation

• Patch all affected Windows versions with the October 2026 security update, prioritising laptops and shared workstations.
• Check the build number of each device before assuming the update applies.
• For Windows 10 21H2, verify whether the device is still covered by an extended security update plan.
• Review standard-user rights and Windows Hello/PIN policies.
• Monitor for a CISA KEV listing or a public proof-of-concept exploit.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-83853 msrc.microsoft.com
• OpenCVE: CVE-2026-83853 app.opencve.io
• Vulners: CVE-2026-83853 vulners.com
• Vulners (Rapid7): CVE-2026-83853 (EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:07.