Windows Clipboard User Service: Use-after-free allows local privilege escalation

Summary

A use-after-free flaw in the Windows Clipboard User Service allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account on the affected machine, and the attack complexity is high. Successful exploitation could give the attacker full control over the system, which is most relevant on shared, multi-user or special-purpose devices.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2016 (including Server Core): 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2019 (including Server Core): 10.0.17763.0 to below 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5761

Fixed in

• Install the Microsoft security update for the affected version (Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612 or later; Windows 10 1809 and Windows Server 2019: 10.0.17763.9376 or later; Windows 10 21H2: 10.0.19044.7807 or later; Windows 10 22H2: 10.0.19045.7807 or later; Windows 11 23H2: 10.0.22631.7652 or later; Windows 11 24H2: 10.0.26100.9711 or later; Windows 11 25H2: 10.0.26200.9711 or later; Windows 11 26H1: 10.0.28000.3231 or later; Windows 11 26H2: 10.0.26300.9711 or later; Windows Server 2022: 10.0.20348.5761 or later)
• The KB number for Windows 10 1607 is unknown.

Workaround

Unknown. No vendor workaround is documented; patching is the remedy.

Exploitation

• No known exploitation in the wild. The CVE is not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score: 0.00242.
• No public proof of concept found in our searches; this was not an exhaustive check.

Our recommendation

• Inventory all Windows 10 and Windows Server 2016/2019/2022 systems and apply the security update for the affected build as soon as possible.
• Prioritise shared, multi-user, kiosk, POS, thin client and HMI devices.
• Windows 10 Enterprise LTSB 2016 (1607) reaches end of extended support on October 13, 2026, the same day this fix was released. Plan migration now, or verify with Microsoft whether Extended Security Updates (ESU) are required to receive this fix on 1607.
• Limit local logons and local administrator rights to trusted users.
• Monitor for unexpected crashes or restarts of the Clipboard User Service (cbdhsvc) in user sessions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85861 msrc.microsoft.com
• SentinelOne Vulnerability Database: CVE-2026-85861 www.sentinelone.com
• Vulners: MSCVE MS:CVE-2026-85861 vulners.com
• Vulners: NVD CVE-2026-85861 vulners.com
• OpenCVE: CVE-2026-85861 app.opencve.io
• VulDB: CVE-2026-85861 vuldb.com
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com
• Insentra: Windows 10 LTSB is ending www.insentragroup.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:56.