CVE-2026-85802: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

This vulnerability involves a use-after-free condition in the Windows Win32 Kernel Subsystem that can be exploited by an authorized local attacker to elevate privileges on affected Windows 10 versions. The flaw is tracked as CWE-416 and impacts multiple Windows 10 builds starting from version 10.0.14393.0 up to but not including various patch levels. The CVSS v3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix to address this issue.

An authorized local attacker can exploit this use-after-free vulnerability to elevate privileges, potentially gaining higher system rights than intended. This could allow the attacker to execute arbitrary code with elevated privileges, compromising system confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85802. No additional mitigation steps are indicated beyond applying the official patch.