Microsoft Windows 10 1607: Use-after-free in Win32k allows privilege escalation

Summary

Windows 10 Version 1607 contains a use-after-free flaw (CWE-416) in the Win32k kernel component. A logged-on user with an ordinary account can exploit it to gain higher, SYSTEM-level privileges on the same machine. Network access is not required, but an attacker first needs a local foothold, for example through phishing or malware running as a normal user.

Affected

• Windows 10 Version 1607 (x86 and x64) with builds below 10.0.14393.9612
• Windows Server 2016 uses the same build range (10.0.14393), per the CNA record

Fixed in

• Build 10.0.14393.9612 or later, included in the Microsoft security update released on 13 October 2026
• KB number for 1607: Unknown. Check the MSRC Security Update Guide entry for the KB.

Workaround

• No vendor workaround. The fix is the security update.
• If patching is delayed (not vendor guidance): restrict local interactive and RDP logon to trusted users, remove unneeded local accounts, and monitor for unexpected SYSTEM-level processes.

Exploitation

• Not listed in CISA KEV.
• Microsoft's temporal vector marks exploit maturity as unproven.
• EPSS about 0.4%.
• No public exploit code found in the research. This does not prove that none exists.

Our recommendation

• Install the October 2026 security update on all Windows 10 1607 and Windows Server 2016 systems as a priority, especially shared PCs, RDS/terminal servers and workstations with many local users.
• Verify the support status of 1607 on Microsoft's lifecycle page. The product is end-of-life, and the LTSB 2016 extended support date is believed to be 13 October 2026 (unverified). If the build is no longer serviced, plan an upgrade or replacement.
• Monitor for unexpected SYSTEM-level processes and review local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83883 msrc.microsoft.com
• Vulners NVD record: CVE-2026-83883 vulners.com
• OpenCVE: CVE-2026-83883 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:43.