Key points
- CVE-2026-85851 is a high-severity use-after-free vulnerability in Windows SmartScreen.
- Attackers with local low-level access can elevate to medium integrity without user interaction.
- Microsoft has released fixes for affected Windows 11 and Windows Server 2025 versions.
An attacker with existing local access to a compromised Windows device can now elevate their privileges from a low integrity level to a medium integrity level. This escalation occurs through a flaw in the Windows SmartScreen component and requires no further interaction from the user, according to Microsoft’s official advisory.
In plain English
The vulnerability, tracked as CVE-2026-85851, stems from a use-after-free memory error. This technical fault occurs when software attempts to access memory that has already been released. The system may reuse that memory space for other data, causing the original code to interact with incorrect information. This corruption enables the privilege escalation.
The background
Microsoft disclosed the issue on 13 October 2026 and assigned it a CVSS base score of 7.8, classifying it as Important. The flaw affects several releases of Windows 11 and Windows Server 2025. Microsoft credits security researcher yhw for reporting the vulnerability. The vendor rates exploitation as less likely and notes it is not currently being exploited in the wild.
What changes now
Microsoft has released security updates to address CVE-2026-85851. Organisations should apply these patches immediately to affected systems. The fix prevents the memory corruption that allowed the privilege escalation. This update is separate from another recently disclosed SmartScreen flaw, CVE-2026-83504, which involves a different race condition weakness.
The attacker's path
Teams usually monitor for unexpected integrity level changes on endpoints. Check whether local accounts have gained medium integrity without administrative approval. This stage of an intrusion often follows initial access via phishing or malware. Defenders should verify that SmartScreen components are updated to prevent memory-based escalation. Focus on detecting anomalous process behaviour that indicates a shift in privilege levels.
Background: Phishing
Spam is bulk, unsolicited messaging with no immediate malicious intent, while phishing is a deceptive tactic designed to trick you into revealing sensitive information. You distinguish phishing vs spam by checking for urgency, personalised requests, and suspicious links. Treat all unsolicited messages as potential threats until verified through separate channels.
Read the full guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
What to do and how to stay safe: Microsoft
- Apply the latest Microsoft security updates to all Windows 11 and Windows Server 2025 devices.
- Review local user accounts for unauthorised elevation to medium integrity levels.
- Monitor system logs for unusual SmartScreen activity or memory access errors.
- Verify that endpoint detection tools are configured to alert on privilege changes.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this flaw allow remote attackers to exploit the system?
No, the vulnerability requires an attacker to already have local access to the device.
Is this vulnerability currently being exploited in the wild?
Microsoft assesses exploitation as less likely and states it is not publicly exploited.
What is the impact of successfully exploiting this flaw?
An attacker can elevate privileges from a low integrity level to a medium integrity level.
