Microsoft Windows: Elevation of privilege via use after free in Windows Smart Card

Summary

A use-after-free flaw in the Windows Smart Card stack allows an authorized local attacker to elevate privileges. The attacker needs an existing local account and a high attack complexity must be overcome, so the flaw is not directly reachable from the internet. If exploited, the attacker could gain full control over the affected machine, which is a particular risk on shared systems and terminal servers.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846), unverified
• Windows 11 Version 23H2 (builds before 10.0.22631.7711), unverified
• Windows 11 Version 24H2, 25H2, 26H1, 26H2 (builds before 10.0.26100.9974 / 10.0.26200.9974 / 10.0.28000.3501 / 10.0.26300.9974), unverified
• Windows Server 2016, 2019, 2022 (builds before 10.0.14393.9688 / 10.0.17763.9487 / 10.0.20348.5870), unverified

Fixed in

• Fixed builds at or above the versions listed under affected, according to the CVE record for Windows 10 1607, 1809 and 21H2. The remaining entries need confirmation from the MSRC advisory.
• Patch details and KB numbers: Unknown. The MSRC page could not be verified.

Workaround

• Unknown. No vendor or third-party mitigation was found.
• General hardening: where smart-card logon is not used, consider disabling the Smart Card service.
• Limit local logon on shared machines to trusted users.

Exploitation

• No evidence of exploitation in the wild at the time of research.
• Not listed in CISA KEV.
• No public proof of concept found; this does not prove that none exists.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the Windows security update from Microsoft for CVE-2026-95968 as soon as the exact fixed build for your OS version is confirmed in the MSRC advisory.
• Prioritize terminal servers, shared workstations and systems that use smart cards or tokens for logon.
• Where smart-card logon is not required, consider disabling the Smart Card service.
• Check whether CVE-2026-83584, a similar record, is related or a duplicate.
• Monitor for exploitation reports and updated EPSS data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-95968 msrc.microsoft.com
• CVE Record CVE-2026-95968 www.cve.org
• Strix AI: CVE-2026-95968 www.strix.ai
• CISA alert: KEV additions October 2026 www.cisa.gov
• Possible duplicate: NVD CVE-2026-83584 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:56.