EUVD-2026-99965
GHSA-fjfx-pc2m-m679
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryLaunch crafted local trigger program
-
ExploitWin use-after-free race in Kerberos
-
ExecutionCorrupt freed object memory
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated low-privileged code execution on an affected Windows 11 26H1 system (build 10.0.28000.0 before 10.0.28000.3231) and to reliably trigger and win a use-after-free race condition in the Kerberos component - the high attack complexity (AC:H) reflects timing/race prerequisites that limit reliable exploitation. Limiting factors: no remote vector (local only), prior low-privilege access is required, no user interaction of a victim is needed, and the condition is non-trivial to hit; exploitation is bounded to the affected 26H1 builds and mitigated by the available Microsoft patch. |
| Impact | This is a moderate-priority local privilege escalation rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) requires local access, already-held low privileges, and a high-complexity condition - consistent with a use-after-free (CWE-416) race that an attacker must win reliably. All real-world exploitation signals point low: there is no EPSS score provided, no CISA KEV listing, and no public POC, so the correct status is no public exploit identified at time of analysis. CISA's SSVC decision framework reinforces this - Exploitation: none and Automatable: no - while rating Technical Impact: total, meaning that IF exploited the attacker gains full SYSTEM-level control, which matches the C:H/I:H/A:H impact. The signals are therefore internally consistent (high impact, low likelihood): a genuine but not drop-everything issue, typically chained after initial access rather than used as an entry point. One caveat: the input Tags include 'Denial Of Service', which conflicts with the description and vector (this is an elevation-of-privilege flaw with full CIA impact, not a DoS) - the tag appears mislabeled and should not drive triage. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows 11 26H1 host (e.g., via phishing or a standard user account) runs a crafted local program that triggers a use-after-free in the Kerberos component by racing object allocation and free. Winning the race (reflected in AC:H) lets them corrupt kernel/service memory and execute code at SYSTEM, completing local privilege escalation. No public exploit code is known at time of analysis, so weaponization would require original development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Windows Kerberos allows an authenticated attacker who already holds low-privileged code execution on a Windows 11 26H1 host (builds 10.0.28000.0 up to but not including 10.0.28000.3231) to elevate to a higher integrity level, with high impact across confidentiality, integrity, and availability on the affected machine. The root cause is a use-after-free that must be triggered and won as a race, so the high attack complexity (AC:H) materially limits reliable exploitation; there is no remote vector and no victim user interaction is required. No public exploit identified at time of analysis, no exploitation has been observed (CISA SSVC records Exploitation: none, Automatable: no), and a vendor patch is available.
RemediationAI
Vendor-released patch: Microsoft has published an update addressing CVE-2026-83720, and affected Windows 11 26H1 systems should be updated so the build reaches 10.0.28000.3231 or later; the exact package and deployment guidance are in the Microsoft Security Update Guide entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83720, with the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-83720 available for tracking. Because the vulnerability cannot be reached remotely and requires the attacker to already run low-privileged code locally, the practical compensating controls focus on shrinking and monitoring that foothold: enforce least privilege and remove unnecessary local administrative or interactive logon rights, and apply WDAC or AppLocker allowlisting to restrict execution of untrusted binaries, accepting the operational overhead of maintaining allowlist rules. Enabling LSASS protection (RunAsPPL) or Credential Guard raises the bar against post-exploitation tampering with the Kerberos/LSA code path, but carries a real trade-off since it can break third-party authentication packages, legacy drivers, and some debugging or backup tooling, so it should be piloted before broad rollout. Disabling Kerberos entirely is not a viable mitigation in Active Directory environments, and monitoring should focus on anomalous lsass.exe crashes, unexpected writes to kerberos.dll, and unusual token or integrity-level elevation events, with the caveat that detection of a race-condition UAF is inherently noisy and should be tuned before being used as a blocking control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kerberos is the primary network authentication protocol in Windows, implemented in kerberos.dll and consumed by the Local Security Authority Subsystem Service (lsass.exe) for ticket acquisition, renewal, and validation. This issue is a CWE-416 use-after-free: a memory object associated with Kerberos processing is released while a reference to it remains live, so a subsequent access reads or writes freed heap memory. In a security-critical process such as lsass, that class of defect can be shaped into memory corruption and, in the worst case, arbitrary code execution in the context of the process handling the ticket, which is why the CVSS sub-scores are C:H/I:H/A:H with Scope unchanged (S:U). The assigned vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H encodes the key constraints: the attack path is local only, it requires the attacker to already possess low-privileged authenticated code execution (PR:L), no victim interaction is needed (UI:N), and the high complexity score reflects the timing/race prerequisites needed to reliably win the use-after-free. CISA's SSVC decision point rates technical impact as total while exploitation and automatability are both negative, consistent with a repeatable but non-trivial local escalation rather than a broadly exploitable flaw.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only use-after-free needing a won race (AV:L, AC:H) from an existing low-privileged account (PR:L), yielding SYSTEM-level control with full CIA impact and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Windows 11 26H1 endpoints are affected by a local privilege escalation vulnerability in Kerberos that allows an attacker with an existing foothold to elevate to higher integrity levels, potentially compromising the confidentiality, integrity, and availability of the machine. Although exploitation is complex and no public exploit code exists, the flaw enables full host compromise from a low-privileged starting point, making timely patching critical to prevent lateral movement and data exfiltration. Leadership should prioritize remediation of affected endpoints to reduce organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB