Key points
- The flaw carries a CVSS score of 7.8 and is rated Important by Microsoft.
- It affects Windows 11 releases and Windows Server 2025.
- Fixes were released alongside the October 13, 2026 disclosure.
Microsoft released patches for a security flaw in its Windows SmartScreen feature that allows attackers with existing local access to gain higher system privileges. This vulnerability, tracked as CVE-2026-85851, was disclosed on October 13, 2026. The update addresses a use-after-free error that can be exploited without any user interaction.
How it unfolded
- Microsoft disclosed CVE-2026-85851 on October 13, 2026, rating it Important.
- The advisory confirmed the flaw involves a use-after-free memory error.
- Patches were released simultaneously with the public disclosure of the issue.
Who is affected
Several versions of Windows 11 and Windows Server 2025 are affected by this vulnerability. According to Cyber Security News, the flaw allows an attacker who has already gained a foothold on a device to escalate their privileges. The Microsoft advisory specifies that exploitation moves an attacker from a low integrity level to a medium integrity level.
This escalation does not automatically grant administrator or SYSTEM rights. However, it represents a significant step up in access for an attacker who has already compromised the initial layer of security. The attack requires low privileges but no further interaction from the user.
Microsoft credits researcher yhw for reporting the issue. At the time of publication, the vendor assessed the likelihood of exploitation as "Exploitation Less Likely." The advisory noted that the flaw was neither publicly disclosed nor actively exploited in the wild prior to the patch release.
What happens next
System administrators should apply the October 13, 2026 updates to all affected Windows 11 and Windows Server 2025 devices. While the risk of active exploitation appears low, the ease of local attack makes patching essential for maintaining system integrity.
Microsoft also released a fix for CVE-2026-83504, a separate information disclosure flaw in SmartScreen. This second issue, rated CVSS 4.7, involves a race condition that could allow an attacker to view heap memory from a privileged process.
The background in plain language
Use-after-free errors occur when software tries to use memory that has already been freed. This can lead to unexpected behavior or security breaches. In this case, the flaw allows an attacker to bypass normal restrictions. Teams usually prioritize patching local privilege escalation flaws because attackers often start with limited access. Checking for unpatched endpoints is a standard defensive practice.
What to do and how to stay safe: Windows 11
- Apply the October 2026 security updates to all Windows 11 and Windows Server 2025 systems.
- Monitor logs for unusual privilege escalation attempts on local accounts.
- Verify that all devices have received the patch within your standard maintenance window.
- Review access controls to ensure low-integrity processes have minimal permissions.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this flaw allow remote attackers to compromise my system?
No, the attacker must already have local access with low privileges to exploit this vulnerability.
Is this flaw currently being exploited in the wild?
Microsoft assessed the likelihood of exploitation as "Exploitation Less Likely" at the time of disclosure.
Does this fix address the SmartScreen information disclosure flaw?
Yes, Microsoft also released a fix for CVE-2026-83504, a separate information disclosure issue.
