Windows 11: Elevation of privilege in RPC Runtime (use after free)
Summary
A use-after-free flaw in the Windows RPC Runtime allows an authorized local attacker to elevate privileges. An attacker needs a low-privilege foothold on the system, such as a user account or malware, and cannot exploit it directly from the internet. CVSS 3.1 base score is 7.0 (High).
Affected
- Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9711 (per third-party mirror)
- Windows Server and other editions: Unknown.
Fixed in
- Install the November 2026 security update for the affected Windows 11 versions. Build numbers are listed under affected.
- Cumulative update KB numbers: Unverified (reported as KB5127648 and KB5127646 by a third-party mirror; confirm on MSRC or Microsoft Update Catalog).
Workaround
- No workaround known. Vendor-documented workarounds: Unknown.
Exploitation
- Microsoft advisory data (secondary source, verify on MSRC): not exploited, not publicly disclosed, exploitability less likely.
- Not listed in CISA KEV according to a third-party source.
- No public proof of concept found at the time of writing.
Our recommendation
- Patch affected Windows 11 systems in the regular November 2026 update cycle, prioritising multi-user systems, Remote Desktop and terminal servers.
- Limit local logon to necessary users and make sure EDR is active.
- Check MSRC for the full product list, including Server editions, and monitor for changes in exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-83894 www.cve.org
- Microsoft Security Update Guide CVE-2026-83894 msrc.microsoft.com
- Strix CVE-2026-83894 www.strix.ai
- Zero Day Initiative November 2026 Security Update Review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:14.
Original description (NVD)
Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.