Description
Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
Published: 2026-10-13
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a double free bug in the Windows Update Orchestrator Service that permits a benign user to elevate privileges locally. This flaw allows the attacker to execute code with higher privileges on the system, potentially compromising all local data and processes. The weakness is classified as CWE-415, a double free that can lead to memory corruption.

Affected Systems

Microsoft Windows 10 21H2 and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and the corresponding ARM64 images, as well as Microsoft Windows Server 2025 including the Server Core installation. The affected products span both x86 and x64 architectures as well as ARM64-based systems.

Risk and Exploitability

The CVSS score of 7.0 indicates a high severity impact for local privilege escalation. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely exploited instances are reported. An authorized user with local account privileges could exploit the double free by interacting with the Update Orchestrator Service, though no remote exploitation vector is documented. The risk is therefore primarily local, with a high potential impact should the flaw be leveraged.

Generated by OpenCVE AI on October 14, 2026 at 12:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Microsoft security update for Windows 10 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2025 that resolves the double free in the Update Orchestrator Service.
  • Disable the Windows Update Orchestrator Service if the system does not require automatic updates to reduce the attack surface.
  • Enforce local security policies that restrict the use of elevated privileges, and ensure that users are kept to the minimum necessary account level to reduce the risk of privilege escalation.

Generated by OpenCVE AI on October 14, 2026 at 12:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2025 (server Core Installation)

Fri, 16 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2
CPEs cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
Vendors & Products Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
Title Windows Update Orchestrator Service Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2025
Weaknesses CWE-415
CPEs cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 Windows 10 22h2 Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows 11 26h2 Windows 11 Version 26h2 For Arm64-based Systems Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:13:05.914Z

Reserved: 2026-09-25T04:41:33.500Z

Link: CVE-2026-97812

cve-icon Vulnrichment

Updated: 2026-10-13T21:58:06.719Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:22:19.467

Modified: 2026-10-16T17:18:05.460

Link: CVE-2026-97812

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T12:30:06Z

Weaknesses