IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows: Use-after-free leading to local privilege escalation

CVE-2026-96244High 7.8

← All vulnerabilities

Summary

A use-after-free flaw in the Windows Internal System User Profile component allows an authorized local user to elevate privileges. An attacker needs a valid user account on the affected system, so the flaw is not directly reachable from the network. The CVSS base score is 7.8 (High), and Microsoft has published a fix.

Affected

  • Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
  • Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9612)
  • Windows 10 Version 1809 and Windows Server 2019 (10.0.17763.0 before 10.0.17763.9376)
  • Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
  • Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
  • Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
  • Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
  • Windows 11 Version 25H2 and 26H2 (10.0.26200.0 before 10.0.26200.9711 and 10.0.26300.0 before 10.0.26300.9711)
  • Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
  • Windows Server 2022 (10.0.20348.0 before 10.0.20348.5761)

Fixed in

  • Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
  • Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later
  • Windows 10 Version 21H2: build 10.0.19044.7807 or later
  • Windows 10 Version 22H2: build 10.0.19045.7807 or later
  • Windows Server 2022: build 10.0.20348.5761 or later
  • Windows 11 and later builds: see the Microsoft Security Update Guide for the matching cumulative update
  • KB number for Version 1607: Unknown.

Workaround

Unknown.

Exploitation

  • No exploitation in the wild is known.
  • The CVE is not listed in CISA's KEV catalogue.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • No public proof-of-concept exploit was found.
  • EPSS score is low (0.00318).

Our recommendation

  • Install the Microsoft security update for the affected Windows version as soon as possible, and prioritize multi-user systems, terminal servers and RDS hosts.
  • Check the Microsoft Security Update Guide for the exact KB number and the FAQ section for any mitigations.
  • Confirm on Microsoft's lifecycle page whether your Windows 10 Version 1607 edition is still supported. If it is not, the fix may not be available and the system should be upgraded.
  • Review user accounts and remote access on affected systems, since exploitation requires a local foothold.
  • Monitor for unusual privilege changes or new SYSTEM-level processes on affected hosts.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Internal System User Profile
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126653, KB5127648, KB5126646, KB5127646, KB5126868, KB5126651

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:57.

Original description (NVD)

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed