Microsoft Windows Shell: Double free leads to remote code execution

Summary

A double free vulnerability in Windows Shell, the desktop and Explorer component, allows an unauthorized attacker to execute code over the network. Per the listed vector, exploitation requires user interaction and low complexity, and the impact on confidentiality, integrity and availability is rated high. The official CNA record lists many Windows 10, Windows 11 and Windows Server versions, while the CPE data and the research notes focus on Windows 10 1607 and Windows Server 2016.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612), primary focus of the research notes
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (build before 10.0.17763.9376)
• Windows 10 Versions 21H2 and 22H2 (build before 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see official CNA record for exact builds)
• Windows Server 2012 and 2012 R2 (see official CNA record for exact builds)
• The full affected-products table on MSRC could not be verified.

Fixed in

• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612 or later (per a mirror of NVD CPE data; verify on MSRC)
• Windows 10 1809: build 10.0.17763.9376 or later
• Windows 10 21H2 and 22H2: build 10.0.19044.7807 and 10.0.19045.7807 or later
• Windows 11 23H2: build 10.0.22631.7652 or later
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 or later
• Windows 11 26H1: build 10.0.28000.3231 or later
• Windows Server 2012 and 2012 R2: build 6.2.9200.26434 and 6.3.9600.23470 or later
• For Windows 10 1607 the KB number is unconfirmed. Microsoft's release-health page links build 14393.9612 to the October 2026 update KB5126868. Windows 10 1607 Enterprise LTSB 2016 reached end of updates on October 13, 2026; a fix is only available through Extended Security Updates (ESU), if ESU delivers this CVE.

Workaround

Unknown. No vendor workaround was found. The sources do not describe the network entry point, so no specific port or service can be blocked.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score: 0.56 percent (low).
• No public proof of concept found; the search was not exhaustive.
• No confirmed exploitation in the wild.

Our recommendation

• Check immediately whether any device runs Windows 10 1607 or Windows Server 2016, especially fixed-function systems such as kiosks, POS terminals and HMIs.
• Determine whether any affected device is reachable from the internet or less-trusted networks, and restrict or isolate it.
• Enrol 1607 devices in ESU and confirm with Microsoft or your licensing partner that this CVE is delivered there.
• Plan an upgrade to a supported version, for example Windows 11 Enterprise LTSC 2024, or replace the devices.
• Install the fixed build on all other affected systems and monitor affected hosts for crashes or unusual activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85936 msrc.microsoft.com
• Microsoft Learn: Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• NVD mirror on Vulners: CVE-2026-85936 vulners.com
• OpenCVE: CVE-2026-85936 app.opencve.io
• Strix: CVE-2026-85936 www.strix.ai
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com
• EPSS score reference for CVE-2026-85936 github.com
• Insentra: Windows 10 LTSB is ending www.insentragroup.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:16.