Windows SmartScreen Vulnerability Allows Local Privilege Escalation

Microsoft has released security updates to address CVE-2026-85851, a significant vulnerability within the Windows SmartScreen component that permits local privilege escalation. Disclosed on October 13, 2026, this flaw carries a CVSS base score of 7.8 and is rated as Important by Microsoft. The vulnerability stems from a use-after-free memory corruption error, a common type of bug where software attempts to access memory after it has been deallocated, potentially leading to crashes or security compromises.

Successful exploitation of CVE-2026-85851 allows an attacker who already possesses low-level privileges on a target system to elevate their access to a medium integrity level. It is important to note that this does not automatically grant administrator or SYSTEM privileges, but it represents a notable increase in access rights. The attack requires no user interaction and has a low attack complexity, meaning an attacker must already have a foothold on the device to exploit it, rather than being able to target it remotely over the internet.

The vulnerability falls under CWE-416, a category for use-after-free errors. This type of flaw occurs when a program continues to use a pointer to memory that has already been freed. Another process or thread might then reallocate that memory, leading to unpredictable behavior and potential security risks if the original program attempts to read from or write to the now-invalid memory location.

Microsoft credits security researcher yhw for discovering and reporting this vulnerability. At the time of disclosure, Microsoft assessed the likelihood of exploitation as "Exploitation Less Likely" and indicated that the vulnerability was neither publicly disclosed nor actively exploited. While this suggests it is not an immediate zero-day threat, patching remains crucial to prevent potential future exploitation.

This newly patched SmartScreen vulnerability should not be confused with previous attacks targeting the same component. Earlier incidents, such as those involving CVE-2024-2112 and a zero-day campaign by Water Hydra, focused on bypassing SmartScreen warnings to deliver malware. Those bypasses are distinct from the local privilege escalation mechanism addressed by CVE-2026-85851.

In addition to CVE-2026-85851, Microsoft also patched CVE-2026-83504, an information disclosure vulnerability in Windows SmartScreen. Rated with a CVSS score of 4.7, this flaw is a time-of-check to time-of-use (TOCTOU) race condition that could allow an attacker to view heap memory from a privileged process. Exploitation of this second flaw is complicated by the race condition and also requires local access and low privileges, with no user interaction needed.

The patches for CVE-2026-85851 are available for multiple Windows 11 versions (23H2, 24H2, 25H2, 26H1, and 26H2 on x64 and ARM64) and Windows Server 2025. Specific update packages include KB5126653, KB5127648, KB5127646, and KB5126646 for Server 2025. Administrators are advised to apply the relevant updates promptly to protect their systems from potential privilege escalation attacks.

This vulnerability highlights the ongoing need for diligent patching and security hygiene, even for components like SmartScreen that are primarily designed to protect users from malicious downloads and websites. The ability for an attacker to escalate privileges, even to a medium integrity level, can be a critical step in a broader attack chain.