Windows: Use-after-free in Direct Composition allows local privilege escalation

Summary

A use-after-free weakness (CWE-416) in the Windows Direct Composition component allows an authorized local user with low privileges to elevate their privileges. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected system. An attacker needs an existing account or foothold on the machine, so the flaw is not remotely exploitable. Microsoft has released fixes and reports no known exploitation.

Affected

• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5761)
• Windows Server 2025, including Server Core installation (10.0.26100.0 to before 10.0.26100.33650)

Fixed in

• Install the October 2026 security update for each edition (Windows 10 21H2: build 10.0.19044.7807 or later).
• Windows 10 22H2: build 10.0.19045.7807 or later.
• Windows 11 23H2: build 10.0.22631.7652 or later.
• Windows 11 24H2 and 25H2, Windows 11 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later.
• Windows 11 26H1: build 10.0.28000.3231 or later.
• Windows Server 2022: build 10.0.20348.5761 or later.
• Windows Server 2025: build 10.0.26100.33650 or later.
• For Windows 10 21H2, third-party sources name KB5126657; verify the KB number on the MSRC page before rollout.

Workaround

Unknown.

Exploitation

• Microsoft marks the vulnerability as not exploited.
• Microsoft's temporal vector uses Exploit Code Maturity 'Unproven', meaning no public exploit code was known at publication.
• CISA SSVC data: exploitation 'none', automatable 'no', technical impact 'total'.
• EPSS is about 0.34 percent.
• No public proof of concept found.

Our recommendation

• Install the October 2026 cumulative update on all affected Windows 10 and Windows 11 systems and Windows Server installations, prioritising multi-user systems, terminal servers and kiosks.
• Confirm the Windows edition and support status, especially Windows 10 21H2 (Pro/Enterprise versus LTSC, or whether ESU applies).
• Reduce the impact of a low-privileged foothold: enforce least privilege, enable phishing protection and MFA, and monitor for suspicious privilege changes.
• Verify the installed build after patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83922 msrc.microsoft.com
• NVD record via Vulners mirror vulners.com
• OpenCVE record incl. CISA SSVC data app.opencve.io
• Tenable plugin for the October 2026 Windows update www.tenable.com
• Senserva summary of KB5126657 senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:32.