Windows Push Notification Core: Use-after-free for local privilege escalation

Summary

Windows Push Notification Core contains a use-after-free vulnerability (CWE-416) that allows an authorized local attacker to elevate privileges. The attacker needs existing low-privilege access to the system, for example through a compromised user account or malware, and no user interaction is required. Successful exploitation can lead to SYSTEM rights, with high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 to < 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 to < 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5870)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.7711
• Windows 11 Version 26H1: 10.0.28000.3501
• Windows Server 2022: 10.0.20348.5870
• Windows 11 Version 24H2, 25H2, 26H2 and Windows Server 2025: Unknown. Verify the build numbers in the MSRC advisory before patching.

Workaround

Unknown. No vendor workaround has been identified. Patching is the remediation.

• Until the update is installed, restrict local logon on affected hosts and limit which users hold low-privilege accounts there.

Exploitation

• Microsoft reports no known exploitation at publication (CVSS exploit maturity: unproven).
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public proof of concept or CISA KEV entry was found at the time of research. This does not prove that none exists.

Our recommendation

• Install the Microsoft security update for the affected Windows versions in the next regular patch cycle, prioritising multi-user systems, terminal servers and file servers.
• Confirm the fixed build numbers in the MSRC advisory before rollout.
• Until patching is complete, restrict local logon and review accounts with low privileges on affected hosts.
• Monitor for unusual privilege escalation and new SYSTEM processes on affected hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96023 msrc.microsoft.com
• CVE Record CVE-2026-96023 (CVE.org) www.cve.org
• Strix: CVE-2026-96023 (unverified secondary source) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:48.