Windows: Local privilege escalation via double free in Wired AutoConfig Service

Summary

A double free (CWE-415) in the Windows Wired AutoConfig Service allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account or code already running on the affected system. Successful exploitation would give full control over the affected confidentiality, integrity and availability, according to the CVSS vector.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711 (sources conflict on this build, verify at MSRC)
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012 and Server Core: 6.2.9200.0 to < 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: 6.3.9600.0 to < 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to < 10.0.14393.9612

Fixed in

• Install the October 2026 cumulative update for the affected branch (fixed builds per the CNA record as listed above).
• Windows 10 Version 1809 / Windows Server 2019: KB5126651 (per a third-party tracker, verify at MSRC).
• Windows Server 2025: KB5126646 (per a third-party tracker, verify at MSRC).
• Windows 10 Version 1607: Unknown. No KB number was found, and it is unconfirmed whether 1607 still receives updates or ESU coverage.

Workaround

Unknown. No Microsoft-published workaround was found. Patching is the primary control.

Exploitation

• No evidence of in-the-wild exploitation found.
• No public proof of concept found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Per a secondary source, Microsoft rates exploitation as less likely.
• EPSS about 0.3%.

Our recommendation

• Patch all affected Windows systems in the next maintenance window, prioritising multi-user PCs, terminal/RDS hosts and any endpoint running unsupported builds.
• Treat Windows 10 Version 1607 as high risk: confirm its support or ESU status before relying on a patch.
• Verify the exact fixed build for each branch on the MSRC update guide before rollout.
• Check whether Wired AutoConfig (dot3svc) is needed on your endpoints, since it is only relevant where wired IEEE 802.1X is used.
• Monitor for exploitation and proof-of-concept publications and recheck CISA KEV.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-85829 msrc.microsoft.com
• Vulners: NVD record CVE-2026-85829 vulners.com
• Vulners: Microsoft CVE record MS:CVE-2026-85829 vulners.com
• Vulners: VulnRichment CVE-2026-85829 vulners.com
• VulDB: CVE-2026-85829 vuldb.com
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:04.