Windows QoS Packet Scheduler: Use-after-free allows local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler driver allows an attacker with existing local access to elevate privileges. The CNA record describes the impact as code execution with SYSTEM rights. The attack requires a local user session or code already running on the system and is not remotely exploitable (CVSS 7.8, High).

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see MSRC for exact builds)
• Windows Server 2012 and 2012 R2 (including Server Core)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Note: MSRC lists Windows 10 1607 only for 32-bit systems, while the CNA record also lists x64. Verify on MSRC.

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later (per CNA record; verify on MSRC)
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 10 Version 21H2 and 22H2: build 10.0.19044.7807 or 10.0.19045.7807 or later
• Windows 11 23H2: build 10.0.22631.7652 or later
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later
• Windows 11 26H1: build 10.0.28000.3231 or later
• KB numbers: Unknown for Windows 10 1607. Take the KB from the MSRC advisory.

Workaround

Unknown. No vendor workaround was found.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• EPSS: below 1 percent
• No public proof of concept or in-the-wild exploitation was found in the research. This means none was found, not that none exists.

Our recommendation

• Check whether Windows 10 Version 1607 is still serviced. Windows 10 1607 LTSB reached end of extended support on 13 October 2026, the same day as this release. If it is no longer serviced, plan an upgrade and treat the host as higher risk.
• If serviced, install the October 2026 security update with build 10.0.14393.9612 or later, using the KB listed on MSRC.
• Prioritise shared PCs, terminal and RDP servers with several users, and hosts where phishing or malware could give a low-privileged foothold.
• Review local accounts and administrator rights on shared and server systems.
• Keep EDR active and monitor for signs of local privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-87712 msrc.microsoft.com
• OpenCVE (CNA text, SSVC, EPSS) app.opencve.io
• Vulners CNA record (affected ranges) vulners.com
• Strix (version table) www.strix.ai
• Vulners VulnRichment (EPSS, CVSS) vulners.com
• Vulners CIRCL/Tenable KB listings vulners.com
• OffSeq Radar threat entry radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:34.