Microsoft has recently addressed a significant security vulnerability in Windows SmartScreen, which could allow attackers with local access to escalate their privileges. Known as CVE-2026-85851, this flaw was made public on October 13, 2026, and is rated with a CVSS score of 7.8, reflecting its significance. The flaw impacts various versions of Windows 11 and Windows Server 2025, marking it as an important issue requiring immediate attention.
Understanding the Vulnerability
The identified flaw stems from a use-after-free memory error, categorized under CWE-416. This occurs when software attempts to use memory that has already been freed, potentially allowing malicious actors to exploit this by using the memory incorrectly. This can result in memory corruption, system crashes, or other severe security issues. The vulnerability allows an attacker to elevate their privileges from a low to a medium integrity level, although it does not directly grant admin or SYSTEM level access.
Exploitation of this flaw requires the attacker to already have low-level privileges on the compromised device. However, exploiting this vulnerability does not require any user interaction, making it a significant risk for systems where attackers have gained initial access.
Security Impact and Mitigation Efforts
The impact of this vulnerability is categorized as local privilege escalation. According to Microsoft’s CVSS vector, the attack complexity is low, and the required privileges are minimal, with no user interaction needed. Therefore, it is crucial for organizations to patch their systems promptly to mitigate potential risks associated with this flaw.
Researcher yhw is credited with discovering this vulnerability. While the flaw was not publicly disclosed or exploited at the time of the advisory, the potential for exploitation underlines the importance of updating affected systems without delay. Previous SmartScreen weaknesses involved different attack vectors, such as bypassing security warnings, which differ from this newly identified privilege escalation issue.
Additional Vulnerabilities and Patching Recommendations
Alongside CVE-2026-85851, Microsoft disclosed another SmartScreen vulnerability, CVE-2026-83504, related to information disclosure through a time-of-check-to-time-of-use race condition. This flaw has a CVSS score of 4.7 and requires overcoming a complex race condition, underscoring the need for precise timing in exploitation.
Microsoft has released updates for various affected systems, including Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2, and Windows Server 2025. Administrators should ensure that each device is matched to its specific release and architecture and verify the installation of updates against Microsoft’s records. The update packages include KB5126653, KB5127648, KB5127646, and KB5126646, tailored for each corresponding version and architecture.
To safeguard against emerging threats, organizations should update their defenses promptly and consider integrating threat intelligence feeds to stay informed about potential vulnerabilities and exploits.
