Key points
- CVE-2026-85851 allows local privilege escalation via a use-after-free error.
- Microsoft released patches for Windows 11 and Windows Server 2025.
- The flaw requires no user interaction but needs existing low-level access.
Microsoft has released security updates for Windows 11 and Windows Server 2025 to address CVE-2026-85851. This vulnerability exists in the Windows SmartScreen component and allows an attacker with local access to elevate their privileges. The company rates the issue as Important with a CVSS score of 7.8.
In plain English
SmartScreen is a security feature that helps protect users from malicious apps and websites. This flaw involves a use-after-free memory error, which occurs when software tries to use memory that has already been freed. An attacker can exploit this mistake to move from a low integrity level to a medium integrity level. This grants them higher access rights on the device without needing the user to click anything or interact with the system.
The background
The vulnerability was disclosed on October 13, 2026, according to Cyber Security News. Microsoft credits researcher yhw with discovering the issue. The advisory notes that exploitation is less likely and that there is no evidence of public exploitation or disclosure at the time of release. It is distinct from previous SmartScreen bypass attacks, which focused on evading security warnings rather than escalating local privileges.
What changes now
Administrators must install the latest security updates for their Windows 11 and Windows Server 2025 devices. The patches resolve the use-after-free condition in SmartScreen. Microsoft also disclosed a separate information disclosure flaw, CVE-2026-83504, rated CVSS 4.7, which involves a race condition. This second issue allows viewing heap memory but has high attack complexity. Both fixes are included in the recent update cycle.
Who needs to act first
Teams should prioritize updating systems that are exposed to internal threats or have known local access vulnerabilities. Verify that your deployment tools can reach all endpoints before rolling out the patch. Test the update in a non-production environment to ensure compatibility with existing applications. Back up critical data before applying changes. Monitor logs for any unusual privilege changes after the update. Reduce exposure by restricting local account usage and enforcing least privilege principles until all systems are patched.
What to do and how to stay safe: Windows 11
- Install the latest security updates for Windows 11 and Windows Server 2025 immediately.
- Verify that all endpoints have received the patch by checking update history logs.
- Review local account permissions to ensure users have only the access they need.
- Monitor system logs for any unexpected privilege escalations or memory errors.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this flaw allow remote attackers to gain access?
No, the attacker must already have local access with low privileges on the device.
Is this vulnerability currently being exploited in the wild?
Microsoft assessed exploitation as less likely and found no evidence of public exploitation.
What is the difference between this flaw and previous SmartScreen attacks?
This flaw allows privilege escalation via memory errors, while previous attacks focused on bypassing security warnings.
