EUVD-2026-99389
GHSA-74fr-74x3-hgh8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryLaunch crafted process targeting Windows Hello
-
ExploitWin use-after-free race condition
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a valid low-privileged local account and the ability to execute code on the target (PR:L, AV:L) - remote exploitation is not possible. The specific trigger is a use-after-free in the Windows Hello authentication component, and the high attack complexity (AC:H) indicates a race condition or non-deterministic memory-reuse window the attacker must win, which may require multiple attempts and is not reliably repeatable. No user interaction is needed (UI:N). Limiting factors: local access prerequisite, authenticated foothold, and the timing-dependent race materially reduce real-world exploitability; the host must be running an unpatched affected Windows 10 (21H2/22H2) or Windows 11 (23H2-26H2) build with Windows Hello present. |
| Impact | Risk is moderate and should not be over-prioritized despite the 7.0 CVSS. The CVSS vector (AV:L/AC:H/PR:L/UI:N) describes a local, authenticated privilege-escalation requiring high attack complexity - the attacker must already have a foothold with low privileges and must win a use-after-free race condition (typical of CWE-416), which is reflected in AC:H. All exploitation signals point AWAY from urgency: CISA SSVC records Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit was identified at time of analysis; EPSS was not provided. These align consistently - a hard-to-automate local race with no evidence of exploitation. The one countervailing signal is SSVC Technical Impact=total, matching the CVSS C:H/I:H/A:H (full compromise of the local system once the race is won). Net: a genuine but second-tier patch priority - real impact if exploited, but local-only access, high complexity, and zero exploitation evidence make it a routine-patch-cycle item rather than an emergency, absent other local-foothold concerns. |
| Exploit ScenarioDerived | A low-privileged user already logged onto a Windows host runs a crafted program that races the Windows Hello component to trigger a use-after-free, reclaiming the freed object with attacker-controlled data to corrupt memory and execute code as SYSTEM. Because the flaw is local and high-complexity (AV:L/AC:H), it would most plausibly be chained after an initial access vector (phishing, malicious app) as a local escalation step. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
RemediationAI
Vendor-released patch: Microsoft has published fixed builds - Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H2 to 10.0.26300.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 23H2 to 10.0.22631.7652, and Windows 10 21H2 to 10.0.19044.7807, with the Windows 10 22H2 target to be confirmed against the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83853 (EUVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-83853). Apply the applicable cumulative update through Windows Update, WSUS, or your standard patch pipeline; because this is a local privilege-escalation primitive, priority should go to multi-user hosts, RDP/VDI session hosts, and kiosk or shared-workstation fleets where an unprivileged foothold is cheap to obtain. Where patching must be staged, compensating controls include enforcing least privilege and removing local admin rights from standard users (reduces the value of the escalation but does not remove the memory-safety bug), restricting who may log on interactively or over RDP to those hosts (side effect: reduced administrative convenience and possible break of remote support workflows), and disabling Windows Hello sign-in options via policy if the environment does not rely on PIN/biometric authentication (side effect: users fall back to password logon, removing passwordless and phishing-resistant sign-in until the policy is reverted). Detection should focus on unpatched hosts with an authenticated low-privileged account and on anomalous Windows Hello-related process activity, since no public exploit code is known and exploitation requires a timing race that may leave crash artifacts (the vendor-tagged Denial Of Service impact means failed attempts can fault the authentication service). Given SSVC Exploitation: none, Automatable: no, and no KEV or POC signal, this can be scheduled within a normal monthly patch cadence rather than treated as an emergency, while still being closed out promptly on high-value multi-user systems.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, inside the Windows Hello authentication stack - the credential/biometric sign-in framework (PIN, fingerprint, face, and the associated Next Generation Credentials container and credential provider paths) on Windows 10 and Windows 11. A use-after-free means an object is freed while a stale pointer to it is still reachable; successful exploitation requires the attacker to force the memory to be reclaimed with attacker-influenced content and then get the dangling reference dereferenced, which is why the CVSS vector carries AC:H - the reuse must land inside a narrow window, typically indicating a race condition or a non-deterministic allocator/heap-grooming problem that may require repeated attempts. The vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, authenticated attacker with no user interaction required, scope unchanged, and full loss of confidentiality, integrity, and availability on the compromised host - SSVC 'Technical Impact: total' is consistent with that. There is no network attack surface here: the attacker must already be able to run code as a low-privileged user on the target, which places this in the class of post-foothold local privilege-escalation primitives used to move from a restricted user context to a higher-integrity one. The tags (Use After Free, Memory Corruption, Denial Of Service, Microsoft) and the MSRC attribution (secure@microsoft.com) place this squarely in a Microsoft monthly update release rather than a third-party component.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated foothold required (AV:L/PR:L), use-after-free race gives AC:H, and winning it yields full SYSTEM compromise (C:H/I:H/A:H) within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Windows Hello on supported Windows 10 and Windows 11 endpoints is affected by CVE-2026-83853, a local privilege-escalation flaw that could let an attacker who already has a low-privileged account and code execution on a host move into a higher-integrity context. Leadership should treat this as a moderate operational risk rather than a remotely exploitable emergency: no public exploit was identified at time of analysis, the issue cannot be triggered remotely, and it requires a pre-existing local foothold. The practical business concern is containment of an initial compromise and limiting lateral movement or admin access on affected systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB