Microsoft Windows Kerberos Double Free Enables Local Privilege Elevation

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

• Microsoft Windows 10 Version 1607: affected from 10.0.14393.0 to less than 10.0.14393.9612.
• Microsoft Windows 10 Version 1809: affected from 10.0.17763.0 to less than 10.0.17763.9376.
• Microsoft Windows 10 Version 21H2: affected from 10.0.19044.0 to less than 10.0.19044.7807.
• Microsoft Windows 10 Version 22H2: affected from 10.0.19045.0 to less than 10.0.19045.7807.
• Microsoft Windows 11 Version 23H2: affected from 10.0.22631.0 to less than 10.0.22631.7652 on ARM64 and x64 platforms.
• Microsoft Windows Server 2016, including Server Core installation: affected from 10.0.14393.0 to less than 10.0.14393.9612.
• Microsoft Windows Server 2019, including Server Core installation: affected from 10.0.17763.0 to less than 10.0.17763.9376.
• Microsoft Windows Server 2022: affected from 10.0.20348.0 to less than 10.0.20348.5761.
• Microsoft Windows Server 2025, including Server Core installation: affected from 10.0.26100.0 to less than 10.0.26100.33650.

Branches or platforms not listed in the affected data should not be treated as confirmed safe without checking the applicable Microsoft update guidance.

Microsoft Windows Kerberos contains a double free flaw classified as CWE-415, where the same memory region may be released more than once. This can cause memory corruption and create a path to local privilege elevation, but the record does not disclose the affected object, code path, Kerberos function, or specific input that triggers the flaw. Confirmed reachability is local: the attacker must already have low privileges on the system, user interaction is not required, and exploitation complexity is high. The evidence does not identify the Kerberos message, request, or runtime condition that an attacker would need to create.

Exploitation requires local access and an account with low privileges. No other user's interaction is required, but the attack has high complexity. The supplied record does not identify a public exploit; the CISA ADP enrichment returned with the record also marks exploitation as none. That status does not guarantee that future exploitation will not occur and does not provide reproducible exploitation steps.

This flaw may allow a low-privileged local attacker to elevate privileges on an affected Windows system. The supplied attack characteristics indicate that user interaction is not required, the scope remains unchanged, and successful exploitation could affect system confidentiality, integrity, and availability. Organisational consequences may include expanded control of a compromised local account, unauthorized access to or modification of resources, and service disruption. The record does not establish the target privilege level, the attacker's post-escalation control, or propagation to other systems.

• A low-privileged local user may obtain higher privileges on an affected system if exploitation succeeds.
• Potential consequences include access to or modification of data beyond the user's original permissions and loss of system availability.
• On servers, privilege elevation could increase the impact of an already-compromised local account.
• The record does not confirm a specific intrusion, campaign, victim, or data breach.

1. Install the Microsoft security update on every system within the affected scope.
2. For Windows 10 Version 1607 and Windows Server 2016, deploy the update that brings the branch to the 10.0.14393.9612 remediation boundary.
3. For Windows 10 Version 1809 and Windows Server 2019, deploy the update that brings the branch to the 10.0.17763.9376 remediation boundary.
4. For Windows 10 Version 21H2, deploy the update that brings the branch to 10.0.19044.7807; for Windows 10 Version 22H2, use the 10.0.19045.7807 boundary.
5. For Windows 11 Version 23H2, deploy the update that brings the applicable platform to the 10.0.22631.7652 remediation boundary.
6. For Windows Server 2022 and Windows Server 2025, deploy updates that bring the branches to 10.0.20348.5761 and 10.0.26100.33650, respectively, including the corresponding Server Core installations.
7. Verify the OS build and update installation status on each asset after deployment. The supplied evidence does not provide a validated workaround, so unconfirmed mitigations should not replace patching.

1. Inventory Microsoft Windows workstations and servers running Windows Kerberos, then compare their operating-system branches with the affected scope.
2. Check the OS build and installed security-update history for each asset to determine whether it has reached the applicable remediation boundary.
3. Prioritize systems where untrusted local users can log on, because the confirmed precondition is local access with low privileges.
4. Additional monitoring for unusual privilege-elevation activity or process failures may be used as a precaution, but no specific IOC or log event is established by the available evidence.
5. The absence of suspicious events does not prove that a system is safe; confirm exposure through inventory and update-status checks.