CVE-2026-85810: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

CVE-2026-85810 is a use-after-free vulnerability (CWE-416) in the Windows Telephony Server component of Microsoft Windows 10 Version 1607 and other specified versions. This vulnerability enables a local attacker with authorized access to elevate their privileges by exploiting the use-after-free condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this use-after-free vulnerability to elevate privileges, potentially gaining higher-level access than intended. This can compromise system confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85810. Applying these updates will remediate the vulnerability.