Windows: Use-after-free in Direct Composition enables local privilege escalation

Summary

Several supported Windows 10, Windows 11 and Windows Server versions contain a use-after-free flaw (CWE-416) in the Windows Direct Composition graphics component. A local user with low privileges can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. The attacker needs an existing local logon, no user interaction is required, and the flaw is not directly reachable from the internet. No known exploitation or public exploit code is reported.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Windows 10 21H2: 10.0.19044.7807 or later
• Windows 10 22H2: 10.0.19045.7807 or later
• Windows 11 23H2: 10.0.22631.7652 or later
• Windows 11 24H2: 10.0.26100.9711 or later
• Windows 11 25H2: 10.0.26200.9711 or later
• Windows 11 26H1: 10.0.28000.3231 or later
• Windows 11 26H2: 10.0.26300.9711 or later
• Windows Server 2022: 10.0.20348.5761 or later
• Windows Server 2025: 10.0.26100.33650 or later

Fix is provided by the cumulative update. Verify the build numbers and KB articles in the MSRC table before deployment.

Workaround

Unknown. No vendor workaround found. The fix is the cumulative update.

Exploitation

• Exploited in the wild: no evidence found.
• Public proof-of-concept: none found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score: 0.00348 (low).

Our recommendation

• Install the September/October 2026 cumulative update (MSRC KB article for each Windows version) on all affected devices.
• Windows 10 21H2 requires Extended Security Updates (ESU) enrolment; check the ESU status of each device.
• Prioritise multi-user systems such as terminal, RDS and shared workstations.
• Plan to replace Windows 10 devices that are out of support.
• Limit local accounts and untrusted code on shared machines.
• Monitor the MSRC page and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85906 msrc.microsoft.com
• vulners NVD listing: CVE-2026-85906 vulners.com
• Strix: CVE-2026-85906 www.strix.ai
• OpenCVE: CVE-2026-85906 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:45.