Microsoft Windows Shell: Use-after-free leads to local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Windows Shell component allows a local attacker with a valid low-privilege account to elevate privileges. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability. Exploitation requires a foothold on the system, such as a phished user or a compromised session, and is not possible remotely.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
- Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
- Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
- Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
- Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
- Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
- Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
- Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
- Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
- Windows Server 2012 and Server Core installation (6.2.9200.0 to < 6.2.9200.26434)
- Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to < 6.3.9600.23470)
- Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
- Version ranges as listed in the CNA record; verify on MSRC.
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612
- Windows 10 Version 1809: build 10.0.17763.9376
- Windows 10 Version 21H2: build 10.0.19044.7807
- Windows 10 Version 22H2: build 10.0.19045.7807
- Windows 11 Version 23H2: build 10.0.22631.7652
- Windows 11 Version 24H2 and 25H2, Version 26H2: build 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
- Windows 11 Version 26H1: build 10.0.28000.3231
- Windows Server 2012 and 2012 R2: builds 6.2.9200.26434 and 6.3.9600.23470
- KB number for Windows 10 Version 1607: Unknown.
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof-of-concept exploit found in the sources reviewed.
- Not found in the CISA KEV catalog in the searches performed; recheck the catalog.
- EPSS about 0.0038 in one snapshot.
Our recommendation
- Inventory all Windows 10 Version 1607 and Windows Server 2016 hosts and confirm their build against 10.0.14393.9612.
- Install the Microsoft security update for each affected version as soon as possible; confirm the KB number on the MSRC advisory.
- Verify the Windows 10 1607 lifecycle status with Microsoft. If a host cannot be patched or upgraded, isolate it and restrict local logon rights, prioritising shared terminal servers, kiosks and multi-user workstations.
- Recheck CISA KEV and public exploit sources at the next review.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Shell
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83876 msrc.microsoft.com
- Vulners: CVE-2026-83876 vulners.com
- VulDB: CVE-2026-83876 vuldb.com
- Vulners MSCVE: MS:CVE-2026-83876 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:40.
Original description (NVD)
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.