Windows Direct Composition: Elevation of privilege via use-after-free

Summary

A use-after-free vulnerability (CWE-416) in the Windows Direct Composition component allows an authorized local user to elevate privileges. An attacker needs a valid low-privileged account or code already running on the host. The vulnerability is not reachable from the internet, but it is a practical second step after phishing, malware or stolen credentials. NVD rates it CVSS 3.1 7.8 (High).

Affected

• Windows 10 Version 1607 (32-bit and x64): builds below 10.0.14393.9612\n- Windows 10 Version 1809: builds below 10.0.17763.9376\n- Windows 10 Version 21H2: builds below 10.0.19044.7807\n- Windows 10 Version 22H2: builds below 10.0.19045.7807\n- Windows 11 Version 23H2: builds below 10.0.22631.7652\n- Windows 11 Version 24H2: builds below 10.0.26100.9711\n- Windows 11 Version 25H2: builds below 10.0.26200.9711\n- Windows 11 Version 26H1: builds below 10.0.28000.3231\n- Windows 11 Version 26H2: builds below 10.0.26300.9711\n- Windows Server 2012 (incl. Server Core): builds below 6.2.9200.26434\n- Windows Server 2012 R2 (incl. Server Core): builds below 6.3.9600.23470\n- Windows Server 2016: builds below 10.0.14393.9612

Fixed in

• Install the October 2026 security update for the affected Windows version. The fixed build is the value listed as 'below' above, e.g. 10.0.14393.9612 for Windows 10 Version 1607.\n- Vulners lists KB5126651 (Windows 10 1809 / Server 2019) and KB5126646 (Server 2025). These KB assignments are not confirmed by Microsoft in the sources reviewed.\n- No KB article for Windows 10 1607 was found in the sources reviewed.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.\n- CISA SSVC data: exploitation 'none', automatable 'no', technical impact 'total'.\n- No public proof of concept found.\n- Not found in the CISA KEV catalog in the sources reviewed; check the catalog directly.\n- Mirrored EPSS values are low (about 0.26 to 0.33 percent).

Our recommendation

• Check the MSRC Security Update Guide for the final list of affected products and fixed builds before planning the patch.\n- Install the October 2026 security update on all affected Windows systems, prioritising multi-user hosts and servers.\n- Confirm whether Windows 10 Version 1607 devices still receive security updates; if not, plan an upgrade.\n- Until patched, limit local logons and standard-user rights, keep EDR active and remove unneeded sessions on shared hosts.\n- Monitor for unusual privilege changes or new local processes on affected hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83912 msrc.microsoft.com
• Vulners: CVELIST CVE-2026-83912 (CNA data) vulners.com
• Vulners: MS:CVE-2026-83912 vulners.com
• Vulners: NVD:CVE-2026-83912 vulners.com
• OpenCVE: CVE-2026-83912 app.opencve.io
• Strix: CVE-2026-83912 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:35.