Microsoft Windows NetBIOS: Use-after-free leads to local privilege escalation

Summary

A use-after-free flaw in the Windows NetBIOS component allows an authorized local user to elevate privileges. The CVSS base score is 7.0 (High). Exploitation requires an attacker who already has a low-privileged account on the host, and attack complexity is high, so this is a post-compromise risk rather than an internet-facing entry point.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025: not listed in the CVE record; verify on MSRC

Fixed in

• Install the November 2026 Microsoft security update for each affected product, which provides builds at or above the versions listed above.
• Windows 10 22H2 build 10.0.19045.7846 and Windows Server 2022 build 10.0.20348.5870 are listed as fixed builds in the CVE record.
• Verify the fixed builds for each product on the MSRC Security Update Guide before rollout.

Workaround

Unknown. No vendor-documented mitigation was found in the sources reviewed. The patch is the recommended remedy.

• Where NetBIOS is not required, disable NetBIOS over TCP/IP on network adapters (general hardening, not from the advisory; verify on MSRC before deployment).
• Block ports 137 to 139 at the perimeter and between network segments.

Exploitation

• Exploited in the wild: not known (third-party aggregator OffSeq; CISA KEV not checked).
• Microsoft exploitability metrics in the CVE record: E:U (unproven) and RC:C (confirmed).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Public proof of concept: none found in the sources checked.

Our recommendation

• Deploy the November 2026 cumulative update, prioritizing multi-user systems such as terminal servers, file servers and endpoints with weak credential hygiene.
• Inventory NetBIOS usage and affected builds, including ESU, LTSB and LTSC hosts.
• Disable NetBIOS over TCP/IP where it is not needed and block ports 137 to 139 between segments.
• Check MSRC to confirm whether CVE-2026-112798, which carries the same title and description, is a duplicate of this CVE.
• Monitor for exploitation reports and recheck the NVD score, which was still awaiting analysis at the time of research.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96971 msrc.microsoft.com
• CVE Record CVE-2026-96971 (CVE.org) www.cve.org
• OffSeq Radar: CVE-2026-96971 radar.offseq.com
• Strix: CVE-2026-96971 www.strix.ai
• MSRC: CVE-2026-112798 (possible duplicate) msrc.microsoft.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:32.