EUVD-2026-99398
GHSA-mwcv-r7rj-rgvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local foothold
-
DeliveryInvoke vulnerable Windows Shell operation
-
ExploitTrigger use-after-free memory corruption
-
ExecutionExecute controlled code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated, low-privileged local code execution on an affected Windows host (CVSS PR:L, AV:L); it is not remotely exploitable and requires no user interaction (UI:N). The limiting factors are substantial: an attacker must first gain any valid local account or running process on the machine before triggering the use-after-free in Windows Shell, and the host must be running an unpatched build within the listed ranges (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807). No special non-default configuration is indicated by the description. |
| Impact | This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation requiring the attacker to already hold low-level authenticated access on the host; it is not remotely reachable. The multiple exploitation signals are consistent and point toward lower immediacy: CISA SSVC lists Exploitation=none and Automatable=no (despite Technical Impact=total), the CVE is not on CISA KEV, and no public POC is referenced - so the exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. The SSVC Technical Impact=total aligns with the C:H/I:H/A:H triad (full SYSTEM-level compromise once exploited). Net: real and should be patched promptly as part of normal Patch Tuesday cadence, but as a local EoP with no active exploitation and no automation it is lower urgency than a network-facing or actively-exploited bug. One minor tag conflict: the input Tags include 'Denial Of Service,' which does not match the description (privilege elevation) or the impact metrics - treat the vuln as an EoP, not a DoS. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged authenticated access to a Windows host (e.g., via phishing, a standard user account, or a compromised service) triggers a use-after-free condition in the Windows Shell to corrupt memory and run code at SYSTEM. No public exploit code is referenced at the time of analysis, and the local-only vector (AV:L) means the attacker must already be executing on the target machine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.
RemediationAI
Vendor-released patch: apply the Microsoft update that brings each build to or above its fixed level - Windows 10 1607 and Windows Server 2016 to 10.0.14393.9612, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9376, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 and Windows Server 2025 to 10.0.26100.9711 and 10.0.26100.33650 respectively, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Windows Server 2012 to 6.2.9200.26434, Windows Server 2012 R2 to 6.3.9600.23470, and Windows Server 2022 to 10.0.20348.5761; verify build numbers after deployment and follow https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83876 for superseding updates. Because exploitation requires the attacker to already have authenticated local code execution, the most effective compensating controls reduce that prerequisite rather than masking the bug: restrict local interactive and RDP logon rights to staff who genuinely need them (trade-off: reduced administrative flexibility and possible help-desk friction), remove unnecessary local Administrator group memberships and enforce least privilege and JIT/PIM administration (trade-off: more change-management overhead), and deploy WDAC or AppLocker in allow-list mode to block the untrusted binaries an attacker would use as a loader or secondary payload (trade-off: requires an application inventory and can break unsigned line-of-business tools if not piloted). Credential Guard and LSA protection limit the value of any tokens obtained after elevation but do not prevent the shell use-after-free itself, and generic shell hardening such as disabling unnecessary shell extensions or third-party shell handlers can shrink the reachable attack surface while degrading user functionality. Patch deferral is not advisable given the high confidentiality, integrity and availability impact, but on hosts that cannot be updated quickly, prioritizing the reduced-logon and application-control measures above gives the best risk reduction for the lowest operational cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free), a memory-corruption class in which an object is released while a reference to it remains live; the dangling pointer is subsequently dereferenced, and if the freed heap region is reallocated with attacker-influenced data the shell can be tricked into operating on a crafted object. The affected code lives in the Windows Shell, the user-mode UI subsystem (explorer.exe and its supporting libraries) that handles the desktop, taskbar, file associations and shell extensions, which is why the parsing and object-lifetime handling there is a recurring target. The accompanying tags (Memory Corruption, Use After Free, Denial Of Service) are consistent with a flaw that can both crash the shell process and, in the privilege-elevation case described by Microsoft, yield code execution in a context more privileged than the attacker's starting point. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U indicates the trigger is reachable with low attack complexity from an already-authenticated local session without any victim interaction, and the scope-unchanged rating means the impact is contained to the affected OS security authority. EUVD enumerates affected builds by Windows version and build number rather than supplying standalone CPE strings, mapping this to the Microsoft Windows operating system product family across desktop and server SKUs, including Server Core installations. No non-default configuration is indicated as a prerequisite, and the availability of an official Microsoft fix confirms this is a defect in shipped shell code rather than a misconfiguration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local use-after-free EoP requiring a pre-existing low-privileged account (AV:L, PR:L) with no user interaction, yielding full SYSTEM-level confidentiality, integrity, and availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A use-after-free flaw in the Windows Shell (CVE-2026-83876) allows an attacker who already holds a low-privileged account on a Windows 10, Windows 11, or Windows Server system to elevate to higher privileges, potentially gaining full control of the host and the data and services it can reach. Because exploitation requires an existing foothold rather than remote access, this is chiefly a post-compromise escalation risk that magnifies the damage of any initial intrusion and complicates containment. Microsoft has released patches, making this a routine update priority rather than a crisis; unpatched endpoints and servers remain the exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB