Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks

Microsoft has released fixes for a Windows SmartScreen vulnerability that allows an attacker with local access to gain higher privileges.

Tracked as CVE-2026-85851, the flaw was disclosed on October 13, 2026, and carries a CVSS base score of 7.8. Microsoft rates it Important. The issue involves a use-after-free memory error and affects several Windows 11 releases and Windows Server 2025.

According to the supplied Microsoft advisory, successful exploitation lets an attacker move from a low integrity level to a medium integrity level. This is a specific increase in access, not a confirmed path to administrator or SYSTEM privileges. The attacker must already have low privileges on the affected device, but the attack requires no user interaction.

The flaw falls under CWE-416, use-after-free. This error occurs when software continues to access memory after that memory has been released. Another operation may reuse the same memory, leaving the original code working with data that no longer belongs to it. Such errors can cause memory corruption, crashes, or other security problems.

Microsoft identifies local privilege escalation as the impact for this vulnerability. Its CVSS vector lists low attack complexity, low privileges required, and no user interaction. Those conditions describe an attacker who already has a foothold on the device, not someone exploiting SmartScreen directly over the internet.

Windows SmartScreen Vulnerability

Microsoft credits researcher yhw with reporting the issue. At publication, the advisory marked it as neither publicly disclosed nor exploited and assessed exploitation as “Exploitation Less Likely.” Those findings do not remove the need to patch, but they do not support describing this flaw as an actively exploited zero-day.

Earlier SmartScreen attacks involved different weaknesses. Cyber Security News previously covered SmartScreen bypass attacks delivering malware through CVE-2024-21412 and Water Hydra’s SmartScreen zero-day campaign. Those reports concern bypassing security warnings and should not be confused with the newly disclosed local privilege escalation flaw.

Microsoft also disclosed CVE-2026-83504, a Windows SmartScreen information disclosure flaw rated CVSS 4.7 and classified as a time-of-check-to-time-of-use (TOCTOU) race condition.

An attacker who successfully exploits this second flaw could view heap memory from a privileged process. Exploitation requires winning a race condition, which explains its high attack complexity.

It also requires local access and low privileges and needs no user interaction. Microsoft credits its Offensive Research & Security Engineering team and reports no exploitation at publication. The supplied material does not establish an exploit chain between the two flaws.

For CVE-2026-85851, the supplied update list covers Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 across x64 and ARM64 systems. Windows Server 2025, including Server Core, is also listed.

The listed fixes are KB5126653 for Windows 11 23H2, KB5127648 for 24H2, 25H2, and 26H2, KB5127646 for 26H1, and KB5126646 for Windows Server 2025.

Administrators should match each device to its release and architecture, then verify installation against Microsoft’s update records. The two advisories list different update packages, so check their patch details separately before deploying across affected systems.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks appeared first on Cyber Security News.