Windows EFS: Use after free allows local privilege escalation

Summary

A use-after-free weakness in the Windows Encrypting File System (EFS) allows an attacker with a local, low-privileged account to elevate privileges to a higher level. The attack complexity is high, and no user interaction is required. Successful exploitation could lead to full compromise of confidentiality, integrity and availability on the affected system.

Affected

• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)
• Windows Server 2025, including Server Core (10.0.26100.0 before 10.0.26100.33822)

Fixed in

• Install the current Windows security update for your version. Fixed builds per the CVE record: 10.0.17763.9487 (1809 and Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022), 10.0.26100.33822 (Server 2025)
• The build numbers should be confirmed on the Microsoft advisory, as KB numbers are unknown.

Workaround

Unknown.

• No vendor-published mitigation has been identified. Installing the security update is the fix.

Exploitation

• No evidence of exploitation in the wild found.
• One aggregator states it is not known to be exploited.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public proof of concept found.
• Not found in the CISA KEV catalog (not verified directly).

Our recommendation

• Install the Windows security update on all affected workstations and servers in the regular monthly cycle.
• Prioritise shared workstations, terminal servers and systems storing EFS-encrypted data.
• Check whether EFS is used in your environment.
• Limit local accounts and review who holds local logon rights.
• Monitor for privilege escalation indicators and recheck CISA KEV and the Microsoft advisory in a few days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-96973 www.cve.org
• Microsoft Security Update Guide CVE-2026-96973 msrc.microsoft.com
• OffSeq Radar CVE-2026-96973 radar.offseq.com
• Strix CVE-2026-96973 (third-party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:33.