Windows Modern Device Management: Use-after-free leads to local privilege escalation

Summary

Microsoft Windows Modern Device Management (MDM) contains a use-after-free vulnerability (CWE-416) that allows an authorized local attacker to elevate privileges on the host. The attacker needs local access and low privileges, so the main risk comes from users or malware that already have a foothold on a workstation or server. Successful exploitation can lead to a full loss of confidentiality, integrity and availability on the affected system. Microsoft rates the CVSS base score at 7.8 (High).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376

Fixed in

Unknown.

• Fixed build numbers could not be verified from the sources. Check the MSRC Security Update Guide for the October 2026 security update of each affected product.

Workaround

None found.

• No vendor workaround was identified. Systems that cannot be patched need individually assessed compensating controls.

Exploitation

• No exploitation in the wild found.
• CISA SSVC: Exploitation none, Automatable no.
• Microsoft exploit maturity: Unproven (E:U).
• No public exploit code found.

Our recommendation

• Install the October 2026 Windows security update on all affected systems, starting with shared and multi-user machines.
• Replace Windows 10 Version 1607 and Windows Server 2016 systems, as they are likely out of support. Confirm the end-of-support dates first.
• Compare the affected versions with your asset inventory.
• Review local security controls and monitor for unexpected privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85833 msrc.microsoft.com
• VulnCheck/NVD mirror on Vulners: CVE-2026-85833 vulners.com
• OpenCVE: CVE-2026-85833 app.opencve.io
• VulDB: CVE-2026-85833 vuldb.com
• Strix: CVE-2026-85833 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:02.