CVE-2026-108132
Windows Kerberos Elevation of Privilege Vulnerability
Published Oct 13, 2026 · updated Oct 14, 2026 · Microsoft Windows
Affected Microsoft products: Windows 11 Version 23H2 for ARM64-based Systems, Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 Version 23H2 for x64-based Systems, Windows Server 2022, Windows Server 2022 (Server Core installation), Windows 10 Version 22H2 for ARM64-based Systems, Windows 10 Version 22H2 for x64-based Systems.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · CIRCL Vulnerability Lookup
Detected
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
Oct 14, 2026 · CIRCL Vulnerability Lookup
Updated
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
Affected
- microsoft Windows 10 Version 21H2 for 32-bit Systemsversion unspecified
- microsoft Windows 10 Version 21H2 for x64-based Systemsversion unspecified
- microsoft Windows 10 Version 22H2 for 32-bit Systemsversion unspecified
- microsoft Windows 10 Version 22H2 for ARM64-based Systemsversion unspecified
- microsoft Windows 10 Version 22H2 for x64-based Systemsversion unspecified
- microsoft Windows 11 Version 23H2 for ARM64-based Systemsversion unspecified
- microsoft Windows 11 Version 23H2 for x64-based Systemsversion unspecified
- microsoft Windows Server 2019 (Server Core installation)version unspecified
- microsoft Windows Server 2022version unspecified
- microsoft Windows Server 2022 (Server Core installation)version unspecified
- microsoft Windows Server 2025version unspecified
- microsoft Windows Server 2025 (Server Core installation)version unspecified
- vendor Microsoft Windows 10 Version 1607version unspecified
- vendor Microsoft Windows 10 Version 1809version unspecified
- vendor Microsoft Windows 10 Version 21H2version unspecified
- vendor Microsoft Windows 10 Version 22H2version unspecified
- vendor Microsoft Windows 11 Version 23H2version unspecified
- vendor Microsoft Windows 11 version 23H2version unspecified
- vendor Microsoft Windows Server 2016version unspecified
- vendor Microsoft Windows Server 2016 (Server Core installation)version unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-108132
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-108132
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-108132
30-day exploitation probability 0.3%
first.org - Microsoft Security Update GuideVendor advisoryCVE-2026-108132
Windows 11 Version 23H2 for ARM64-based Systems, Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 Version 23H2 for x64-based Systems
msrc.microsoft.com