Microsoft Windows User Manager Service: Use-after-free causes local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows User Manager Service allows a locally authorized user to elevate privileges. An attacker with a low-privileged account on the system can gain higher rights, with a CVSS v3.1 base score of 7.0 (High). Exploitation requires local access and high attack complexity, and the flaw is not reachable from the internet.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

Fixed in the November 2026 cumulative updates for the affected Windows versions. Fixed builds are taken from the CVE record ranges and must be verified in the MSRC Security Update Guide before rollout.

Workaround

Unknown. No vendor-documented workaround was found. Restricting local logon rights and interactive or remote sessions on servers reduces exposure until the update is installed.

Exploitation

• Microsoft's CVSS vector marks exploit maturity as unproven (E:U), and CISA SSVC lists exploitation as none.
• No public proof-of-concept exploit was found.
• No CISA KEV listing was found for this CVE.
• A general Patch Tuesday review mentions an unnamed exploited vulnerability for November 2026, which could not be linked to this CVE.

Our recommendation

• Install the November 2026 cumulative update, prioritizing multi-user systems, Remote Desktop hosts and file servers.
• Verify the fixed build numbers in the MSRC advisory before deployment.
• Check whether Windows 10 systems are past support and need Extended Security Updates.
• Limit local and remote interactive logon rights on servers and monitor for privilege escalation activity.
• Apply the update sooner if exploitation is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (Microsoft CNA) www.cve.org
• MSRC Security Update Guide advisory msrc.microsoft.com
• Strix AI tracker (third party, unverified) www.strix.ai
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Senserva KB5131090 summary (third party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:53.