Local attackers can elevate privileges via Windows SmartScreen memory flaw

A vulnerability in Windows SmartScreen allows an attacker with local access to elevate their privileges. The flaw, tracked as CVE-2026-85851, stems from a use-after-free memory error. According to Microsoft, this issue enables a user with low integrity rights to move to a medium integrity level. This represents a specific increase in access rather than a direct path to administrator or SYSTEM privileges.

How it unfolded

• On October 13 2026 Microsoft disclosed the vulnerability and released fixes.
• Researcher yhw reported the issue to Microsoft.
• Microsoft assessed exploitation as less likely and noted no public exploitation.

Who is affected

The flaw affects several versions of Windows 11 and Windows Server 2025. According to Cyber Security News, the issue allows an attacker who already has a foothold on the device to gain higher privileges. The attack requires no user interaction and has low attack complexity. Microsoft states that the attacker must already have low privileges on the affected device. This is distinct from earlier SmartScreen attacks that bypassed security warnings to deliver malware.

The fix

Microsoft has released fixes for CVE-2026-85851. The company rates the vulnerability as Important. The advisory marks the issue as neither publicly disclosed nor exploited at the time of publication. Microsoft also disclosed a separate information disclosure flaw in SmartScreen, CVE-2026-83504, which involves a time-of-check-to-time-of-use race condition. That second flaw has a CVSS score of 4.7.

What analysts watch for

Teams usually monitor for unexpected privilege changes in Windows event logs. Analysts should check whether processes are accessing memory regions that have been freed. They often examine SmartScreen components for anomalous behaviour during authentication flows. Security teams typically review integrity level transitions to spot lateral movement. It is important to distinguish between bypass attempts and elevation exploits. Observing heap memory access patterns can reveal underlying memory corruption issues.

Background: Lateral movement

Attackers exploit misconfigured trust relationships and weak credential storage to move between systems. You stop this by enforcing least privilege, disabling legacy protocols like SMBv1, and monitoring for anomalous authentication patterns rather than just looking for known malicious files.

Read the full guide: Lateral Movement Mistakes: 7 Errors That Let Attackers Spread

What to do and how to stay safe: Microsoft

• Apply the latest Microsoft security updates to Windows 11 and Server 2025 systems.
• Monitor system logs for unauthorised privilege escalation attempts.
• Review process integrity levels for unexpected changes.
• Ensure local accounts follow least privilege principles.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85851?

It is a use-after-free vulnerability in Windows SmartScreen that allows local privilege escalation.

Which Windows versions are affected?

The flaw affects several Windows 11 releases and Windows Server 2025.

Is this vulnerability being actively exploited?

Microsoft assessed exploitation as less likely and noted no public exploitation.