Microsoft Windows: Use after free in Text Services Framework

Summary

A use-after-free flaw in the Windows Text Services Framework allows an authorized local user to elevate privileges. An attacker needs a valid low-privileged account on the affected machine, so the flaw is not remotely exploitable. Successful exploitation can give full control of the system (high confidentiality, integrity and availability impact).

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: builds 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: builds 10.0.26100.0 and 10.0.26200.0 to before 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): builds 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470
• Note: the CPE in the CVE record lists only Windows 10 1607; the other editions above come from the official CVE record and the NVD mirror.

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9612 (Microsoft has not documented a 1607 package in our sources; check MSRC)
• Windows 10 1809 / Server 2019: 10.0.17763.9376 (update KB5126651 for 1809 and Server 2019)
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 / 25H2: 10.0.26100.9711 / 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2025: update KB5126646 (October 2026 package)
• Windows Server 2012 / 2012 R2: 6.2.9200.26434 / 6.3.9600.23470

Workaround

Unknown. No vendor-documented mitigation was found. The fix is the cumulative update.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• Not listed in the CISA KEV catalog (per OpenCVE).
• No public proof of concept found in our research.
• EPSS about 0.3 percent. VulDB estimates a broker price of USD 5,000 to 25,000, which is a market estimate and not evidence of exploitation.

Our recommendation

• Inventory all Windows systems now, especially Windows 10 1607 and Server 2016 machines, which may not receive a free fix for this flaw.
• Install the October 2026 cumulative update on all other listed builds and verify the installed build number.
• Decide on migration or Extended Security Updates for Windows 10 Enterprise LTSB 2016, which reaches end of support on 13 October 2026. Confirm with MSRC and your licensing before assuming a free patch.
• Prioritise workstations and terminal servers with many local user accounts, since this flaw matters most after phishing, malware or a stolen credential.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85795 msrc.microsoft.com
• VulDB entry 419212 vuldb.com
• Vulners NVD mirror: CVE-2026-85795 vulners.com
• Vulners Microsoft mirror: MS:CVE-2026-85795 vulners.com
• OpenCVE: CVE-2026-85795 app.opencve.io
• Strix AI: CVE-2026-85795 www.strix.ai
• Windows Central: Windows 10 LTSB 2016 retirement and ESU www.windowscentral.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:11.