Windows 10 1607: Use-after-free in Windows kernel allows privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows kernel allows a local attacker with low privileges to elevate their rights. Per the NVD CVSS vector, no user interaction is required and the impact on confidentiality, integrity and availability is high. The flaw is not directly reachable from the internet and is mainly a risk when an attacker already has a foothold on the system, for example via a phishing attack, a stolen low-privilege account or a malicious application.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612), x64 and x86
• Other affected Windows versions are listed in the Microsoft advisory.

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later
• Cumulative update (KB) for Windows 10 1607: Unknown.

Workaround

• No workaround known. Installing the security update is the only reliable fix.

Exploitation

• Microsoft exploitation rating: Unproven.
• CISA SSVC: Exploitation none, automatable no.
• Not listed in CISA KEV.
• No public proof of concept confirmed.
• No exploitation in the wild known.

Our recommendation

• Identify all Windows 10 1607 systems, including legacy POS, production and shared workstations.
• Check whether these systems still receive Microsoft security updates (ESU or other); if not, plan an upgrade.
• Install build 10.0.14393.9612 or later in the next regular patch cycle, with higher priority on older or shared machines.
• Verify the fixed build against the MSRC advisory before deployment.
• Monitor for signs of local privilege escalation on affected systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• MSRC Security Update Guide (en-US) msrc.microsoft.com
• Vulners MSCVE affected versions vulners.com
• OpenCVE (KEV and SSVC) app.opencve.io
• Qualys Patch Tuesday review October 2026 blog.qualys.com
• GitHub tracker entry (theori-io) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:38.