Microsoft Windows Kernel: Use-after-free allows local privilege escalation
Summary
A use-after-free flaw (CWE-416) in the Windows kernel allows an authorized local user to elevate privileges to SYSTEM. An attacker needs a local foothold, such as malware or a phished user session, plus low privileges. Successful exploitation gives full control over the affected host, but the flaw cannot be used for a direct remote attack.
Affected
- Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
- Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
- Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
- Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
- Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
- Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
- Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
- Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5761)
- Windows Server 2025 and Server Core installation (10.0.26100.0 to < 10.0.26100.33650)
Fixed in
- Fixed builds per the CNA record. Windows 10 21H2 is fixed in 10.0.19044.7807 (corroborated by a third-party aggregator). Other fixed builds conflict between sources, so confirm them on the MSRC page.
- Fix is part of the October 2026 Windows security update.
Workaround
Unknown. The CVE record lists no workaround. Installing the security update is the fix.
- Optional hardening only, not vendor guidance: enable Exploit Protection for the Windows kernel.
Exploitation
- No exploitation known to be in the wild. CISA SSVC data lists exploitation as none and automatable as no.
- No public proof-of-concept confirmed for this CVE.
- Microsoft has not published further technical details.
Our recommendation
- Patch Windows 10 21H2 and other affected hosts in the October 2026 update cycle, starting with shared, multi-user and Remote Desktop systems.
- Verify the exact fixed build and KB number for each Windows edition on the MSRC page.
- Check whether Windows 10 21H2 still receives updates for your editions (Enterprise/Education LTSC) and plan upgrades for unsupported systems.
- Limit local logon rights and monitor for unusual SYSTEM-level process activity.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Kernel
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126655, KB5126657, KB5126646, KB5127648, KB5126653, KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-83913 msrc.microsoft.com
- Vulners: CVE List record CVE-2026-83913 vulners.com
- Vulners: NVD record CVE-2026-83913 vulners.com
- OpenCVE: CVE-2026-83913 app.opencve.io
- Strix.ai: CVE-2026-83913 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:36.
Original description (NVD)
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.