Microsoft Windows: Use-after-free in Winsock enables local privilege escalation

Summary

A use-after-free flaw in the Windows Winsock component allows an authorized local user to elevate privileges on the affected system. An attacker needs an existing user account or code execution on the machine, and exploitation requires high complexity. Successful exploitation gives the attacker high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2 (builds below 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846 and 10.0.19045.7846 respectively)
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2 (per CVE record)
• Windows Server 2016, 2019 and 2022 (including Server Core)
• Full build list: see the Microsoft advisory, as the record list could not be fully verified.

Fixed in

• Install the Microsoft security update for your Windows build; fixed builds are listed in the Microsoft advisory.
• Unconfirmed from a third-party source: Windows 10 22H2 at 10.0.19045.7846 and Windows 11 23H2 at 10.0.22631.7711.

Workaround

• No vendor-documented workaround known.
• Pending patching: restrict local logon to trusted users and minimise local administrator rights.

Exploitation

• Not known to be exploited as of 10 Nov 2026.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof-of-concept found.
• Not listed in CISA KEV as far as known; check the catalogue again.

Our recommendation

• Apply the Microsoft security update to all affected Windows 10, 11 and Server systems in the next regular patch cycle.
• Verify the affected build list against the Microsoft advisory before rollout.
• Identify legacy Windows 10 1607 and 1809 systems and check whether they can be upgraded.
• Restrict local logon and administrative rights and keep endpoint detection active until patched.
• Monitor for suspicious privilege escalation activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-96994 www.cve.org
• Microsoft Security Update Guide msrc.microsoft.com
• OffSeq Radar CVE-2026-96994 radar.offseq.com
• Strix CVE-2026-96994 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:30.