Critical Windows SmartScreen Bug CVE-2024-30046 Lets Attackers Gain System Privileges

Key Takeaways

• Microsoft has patched a critical local privilege escalation vulnerability (CVE-2026-85851) in Windows SmartScreen.
• The flaw, rated “Important” with a CVSS score of 7.8, affects multiple versions of Windows 11 and Windows Server 2025.
• Exploitation requires an attacker to already have low-level local access to the system, but no user interaction is needed.
• A separate SmartScreen information disclosure flaw (CVE-2026-83504) was also addressed.
• Patches are available and should be applied promptly to mitigate risk.

Critical SmartScreen Flaw Grants Local Privilege Escalation

Microsoft has released crucial security updates to address a significant vulnerability within Windows SmartScreen, identified as CVE-2026-85851. This flaw enables an attacker with existing local access to a system to elevate their privileges, posing a serious threat to enterprise and individual users alike.

Disclosed on October 13, 2026, the vulnerability has been assigned a CVSS base score of 7.8, classifying it as “Important” by Microsoft’s severity ratings. The root cause is a use-after-free memory error, a common class of bug that can lead to memory corruption and arbitrary code execution. Systems running various releases of Windows 11 and Windows Server 2025 are impacted.

Understanding the Exploitation Path

According to the official Microsoft advisory, successful exploitation of CVE-2026-85851 allows an attacker to transition from a low integrity level to a medium integrity level. It is important to note that while this represents a privilege escalation, it does not automatically grant administrator or SYSTEM-level access. The attacker must already possess low-level privileges on the target device, but the exploit itself requires no user interaction, making it a silent threat once initial access is established.

The flaw is categorized under CWE-416, which denotes a use-after-free error. This occurs when a program attempts to access memory that has already been deallocated. Such an error can lead to unpredictable behavior, including system crashes, data corruption, or, in this case, a security vulnerability that can be leveraged for privilege escalation. The CVSS vector highlights low attack complexity and low privileges required, reinforcing that an attacker already present on the system can exploit this with relative ease.

Researcher Credit and Exploitation Status

Microsoft acknowledges researcher yhw for reporting this issue. At the time of the advisory’s publication, the vulnerability was not publicly known nor had it been actively exploited, and Microsoft assessed the likelihood of exploitation as “Less Likely.” While this assessment suggests it is not an actively exploited zero-day, the presence of a patch underscores the importance of immediate remediation.

It is crucial not to confuse this local privilege escalation vulnerability with previous SmartScreen bypass attacks, such as those involving CVE-2024-21412 or campaigns by threat actors like Water Hydra. Those incidents focused on circumventing security warnings to deliver malware, whereas CVE-2026-85851 specifically addresses an internal mechanism for privilege escalation.

Additional SmartScreen Flaw Disclosed

In addition to the privilege escalation bug, Microsoft also disclosed CVE-2026-83504, an information disclosure vulnerability in Windows SmartScreen. This flaw, rated with a CVSS score of 4.7, is a time-of-check-to-time-of-use (TOCTOU) race condition. Exploiting this vulnerability could allow an attacker to view heap memory from a privileged process, exposing potentially sensitive data. However, successful exploitation requires winning a race condition, which contributes to its high attack complexity.

Like CVE-2026-85851, this information disclosure flaw also demands local access and low privileges, with no user interaction required. Microsoft credits its Offensive Research & Security Engineering team for discovering this issue, and no exploitation has been reported. The advisories do not indicate any exploit chain between these two distinct SmartScreen vulnerabilities.

Affected Systems and Patch Details

For CVE-2026-85851, the comprehensive list of affected systems includes Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2, covering both x64 and ARM64 architectures. Windows Server 2025, including its Server Core installation option, is also vulnerable.

Specific knowledge base (KB) updates have been released to address this flaw: KB5126653 for Windows 11 23H2, KB5127648 for Windows 11 24H2, 25H2, and 26H2, KB5127646 for Windows 11 26H1, and KB5126646 for Windows Server 2025.

What You Should Do

• Apply Updates Immediately: Prioritize the installation of the relevant security updates (KB5126653, KB5127648, KB5127646, KB5126646) for all affected Windows 11 and Windows Server 2025 systems.
• Verify Installation: After applying patches, administrators should verify successful installation against Microsoft’s official update records for each device.
• Review Both Advisories: Note that separate update packages are listed for CVE-2026-85851 and CVE-2026-83504. Ensure both advisories are reviewed, and all applicable patches are deployed to fully mitigate risks.
• Implement Principle of Least Privilege: Reinforce the principle of least privilege across your environment to minimize the impact of any local access an attacker might gain.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.