---
id: "CVE-2026-83894"
page: "https://infrastack.ai/live/CVE-2026-83894"
kind: "vulnerability"
aliases: ["CVE-2026-83894"]
title: "Windows RPC Runtime: use-after-free lets a local user gain higher privileges (Windows 11)"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 24H2", "fixed": [], "affected": "10.0.26100.0 - 10.0.26100.9711", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": [], "affected": "10.0.26200.0 - 10.0.26200.9711", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": [], "affected": "10.0.28000.0 - 10.0.28000.3231", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": [], "affected": "10.0.26300.0 - 10.0.26300.9711", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local", "privilege-escalation", "rpc", "windows", "windows-11"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:21:23+00:00"
first_seen_at: "2026-11-10T19:25:17+00:00"
updated_at: "2026-11-10T21:10:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83894", "first_seen_at": "2026-11-10T19:25:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T21:10:36+00:00"}]
exploit_sources: []
---

# Windows RPC Runtime: use-after-free lets a local user gain higher privileges (Windows 11)

Link for people: https://infrastack.ai/live/CVE-2026-83894 (this .md is for agents)

A use-after-free bug in the RPC Runtime component lets an attacker who already has authorized local access trigger memory corruption. The sources say this lets the attacker elevate privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 11 24H2 affected 10.0.26100.0 - 10.0.26100.9711 fixed no fixed version listed
- vendor:Windows 11 25H2 affected 10.0.26200.0 - 10.0.26200.9711 fixed no fixed version listed
- vendor:Windows 11 26H1 affected 10.0.28000.0 - 10.0.28000.3231 fixed no fixed version listed
- vendor:Windows 11 26H2 affected 10.0.26300.0 - 10.0.26300.9711 fixed no fixed version listed

## How to check

Run 'winver' or PowerShell '[Environment]::OSVersion.Version' and compare the build: affected are Windows 11 24H2 up to 10.0.26100.9711, 25H2 up to 10.0.26200.9711, 26H1 up to 10.0.28000.3231, 26H2 up to 10.0.26300.9711 (per CVE List V5 data via a secondary site). Confirm the fixed KB on the MSRC page for CVE-2026-83894.

## Timeline

- 2026-11-10T19:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83894
- 2026-11-10T21:10:36+00:00 analyst — MSRC/NVD pages unreadable via tools; affected Windows 11 builds from CVE List V5 data mirrored on cve.imfht.com (secondary). Fixed build numbers not read; Nov 2026 Patch Tuesday cumulative update presumably. No exploitation or PoC reported. Nothing verified.

## From the sources

Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_