Microsoft Windows Kernel: Elevation of privilege via invalid pointer release

Summary

A local elevation of privilege vulnerability in the Windows Kernel of Windows 11 version 26H1 allows an authorized attacker to gain higher privileges on the system. The flaw is classified as CWE-763 (release of invalid pointer or reference). An attacker needs a valid local low-privilege account or existing code execution on the machine, so the realistic risk is a compromised user account, malware, or a shared multi-user host such as a terminal server.

Affected

• Microsoft Windows 11 version 26H1, x64 and ARM64
• Builds from 10.0.28000.0 up to, but not including, 10.0.28000.3231 (range from third-party trackers, verify on the MSRC page)

Fixed in

• Build 10.0.28000.3231 or later, delivered with the October 2026 security update (KB5127646 according to Tenable)

Workaround

Unknown.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC data lists exploitation as none and automatable as no.
• No public proof of concept or exploitation reports found in our research; this is not a confirmed absence.

Our recommendation

• Install the October 2026 security update KB5127646 or later on all Windows 11 26H1 systems.
• Check the build number with winver or the registry, and prioritise multi-user and shared hosts (terminal server, RDS).
• Restrict local logon rights and monitor for unusual privilege changes on endpoints.
• Patch in the next regular maintenance window (medium-high for shared hosts, medium for single-user endpoints).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85850 msrc.microsoft.com
• NVD via Vulners vulners.com
• OpenCVE: CVE record and KEV status app.opencve.io
• VulDB vuldb.com
• Strix (affected range, third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:58.