EUVD-2026-99401
GHSA-568j-3354-w5pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local foothold
-
DeliveryInvoke affected Win32 kernel path
-
ExploitWin race to trigger use-after-free
-
ExecutionReclaim freed object, corrupt kernel memory
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target Windows host (AV:L, PR:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. No user interaction is needed (UI:N). The primary limiting factor is the high attack complexity (AC:H): as a use-after-free, success depends on winning a non-deterministic timing/race window and reliably reclaiming the freed kernel object, so exploitation may require repeated attempts and is not reliably automatable (SSVC Automatable=no). Affected hosts are those running build versions below the patched levels listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); fully patched systems are not exploitable. |
| Impact | This is a locally-exploitable privilege escalation (CWE-416 use-after-free) in the Win32 kernel subsystem, rated CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N. The signals are internally consistent and point to a real-but-not-urgent issue: exploitation requires local access and already-held low privileges (PR:L), and the high attack complexity (AC:H) reflects the race/timing-window reliability challenges typical of kernel UAF bugs. CISA's SSVC decision framework reinforces a measured priority: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited), but Technical Impact=total (full SYSTEM compromise if successful), which aligns with the C:H/I:H/A:H impact metrics. No CISA KEV listing and no EPSS score were provided, and there is no indication of public POC code, so there is no evidence of active or imminent exploitation. Net assessment: this is a classic local EoP that is valuable to an attacker who already has a foothold (and is a plausible second-stage/post-compromise primitive), but it is not a drop-everything internet-facing emergency. Prioritize via normal Patch Tuesday cadence, weighting endpoints where untrusted users hold local accounts. |
| Exploit ScenarioDerived | An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard-user account, or a sandboxed app) triggers a use-after-free in the Win32 kernel subsystem by winning a timing/race window, then reclaims the freed object to corrupt kernel memory and elevate to SYSTEM. The high attack complexity (AC:H) means the exploit may require multiple attempts to land reliably, and no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
RemediationAI
Vendor-released patches are available: Microsoft has published fixed Windows builds through the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83901), and remediation is to bring each affected host to or above its patched build level - Windows 10 1809 / Windows Server 2019 (including Server Core) to 10.0.17763.9376, Windows 10 21H2 and 22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 to 10.0.26100.9711, Windows Server 2025 (including Server Core) to 10.0.26100.33650, Windows Server 2022 to 10.0.20348.5761, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H2 to 10.0.26300.9711 and Windows 11 26H1 to 10.0.28000.3231, applied through Windows Update, WSUS or the Microsoft Update Catalog. Because this is a local post-compromise escalation primitive rather than a remotely reachable flaw, there is no port to block or endpoint to disable as a true workaround; compensating controls only raise the cost of the prerequisite foothold and should be treated as temporary until patching completes. Practical measures include enforcing least privilege so interactive users are not local administrators and removing unnecessary local code-execution surfaces, deploying WDAC or AppLocker to restrict which binaries can run (trade-off: application compatibility testing overhead and potential blocking of legitimate unsigned tooling), enabling Credential Guard and LSA protection to make stolen token/credential abuse harder after a kernel compromise, and using Exploit Protection/Attack Surface Reduction rules and EDR kernel-tamper detection to catch pool-corruption and token-theft behavior - none of which remove the underlying use-after-free, so prioritize the build upgrade, and note that virtualization-based security features can conflict with third-party kernel drivers in some environments and should be piloted before fleet-wide rollout.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-83901 is a memory-safety defect in the Win32 kernel subsystem, the user-mode-callable portion of the Windows kernel (win32k and its supporting components) that services GDI, window-manager and related graphics/user-interface operations. The root cause class is CWE-416, use-after-free: a kernel object is released while a stale reference to it remains reachable, so a subsequent operation dereferences freed memory. In kernel contexts this is dangerous because the freed pool allocation can be re-claimed by attacker-influenced data, letting the dangling reference read or write attacker-controlled bytes in kernel space, which in turn yields arbitrary kernel read/write and enables token or process-object manipulation for privilege escalation. The assessed vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, authenticated low-privilege trigger with no user interaction, where the high complexity stems from the race/timing window and heap grooming required to reclaim the object deterministically; the CVSS 'total' technical impact and the accompanying Denial Of Service, Memory Corruption and Use After Free tags are consistent with full loss of confidentiality, integrity and availability on the compromised host after successful exploitation. Affected binaries are tied to specific Windows build levels rather than to a standalone application, so the exact CPE/version surface is the operating system build family (Windows 10, Windows 11, Windows Server 2019/2022/2025, including Server Core installations) listed in the EUVD record.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel EoP requiring an existing low-priv account (AV:L, PR:L); UAF race window justifies AC:H; successful exploitation yields full SYSTEM control, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity memory-corruption flaw in the Windows Win32 kernel subsystem allows an attacker who already has a foothold on a workstation or server to escalate their privileges to SYSTEM level, effectively granting full control of that host. Because the flaw is local rather than remotely reachable, the immediate organizational risk is elevated impact from any existing compromise - such as phishing-delivered malware or a compromised service account - rather than a new external attack path. Leadership should care because successful exploitation on a domain-joined machine can serve as a stepping stone to credential theft and lateral movement across the enterprise, and vendor fixes are already available, making this a manageable remediation priority rather than an emergency.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB