CVE-2026-83785

Cve • October 14, 2026

Share: View original

Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

CWE-416 : Use After Free

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

msrc.microsoft.com: Windows COM+ Event System Service Elevation of Privilege Vulnerability external site vendor-advisory patch

Authorized Data Publishers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Two High-Risk Windows Vulnerabilities Disclosed on October 13, 2026 On October 13, 2026, two significant vulnerabilities were published affecting Windows systems. CVE-2026-85908 is a heap-based buffer overflow in the Windows Win32K component, allowing local privilege escalation by authorized attackers, with a CVSS score of 7.8. CVE-2026-83785 involves a use-after-free flaw in the Windows COM+ Event System Service, also permitting local privilege escalation, rated at 7.0. Both vulnerabilities are currently marked with an unknown status regarding exploitation. Microsoft has released advisories for both vulnerabilities, urging users to apply patches. The vulnerabilities affect various Windows versions, but specific affected versions were not detailed in the articles. 3 sources 58

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

CWE-416 - Use After Free

Platforms (1)