Advisory · CVE-2026-105010
Use-after-free in Windows Search lets a network attacker elevate privileges
The Microsoft Windows Search Component has a use-after-free flaw Microsoft describes as letting an unauthorized attacker elevate privileges over a network. Microsoft rates it CVSS 3.1 9.8.
- Vendor
- Microsoft
- Product
- Windows Search Component
- Identifier / CWE
- CVE-2026-105010
CWE-416 - Action timing
- Immediate
Explain it like I’m five
The search indexer keeps using memory it already released, and a remote attacker can use that confusion to climb to higher privileges.
- 01Reach the component
An unauthenticated attacker sends crafted network traffic to a Windows system running Windows Search Component.
- 02Memory flaw triggers
The component mishandles the input and corrupts or reuses memory outside its intended bounds.
- 03Code runs
The attacker gains code execution in the component's context on the target system.
What happened
Microsoft disclosed CVE-2026-105010 in its October 2026 update guide: a use-after-free weakness (CWE-416) in the Windows Search Component that allows an unauthorized attacker to elevate privileges over a network, scored 9.8 with high confidentiality, integrity, and availability impact.
Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows Search Component deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows Search Component while remediation is underway, especially for internet-facing instances.
- Review application and server logs for search indexer crashes, privilege changes outside admin workflows, and new services or scheduled tasks on affected hosts.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Privilege elevation at 9.8 in a component running on nearly every Windows machine is a fleet patch item, not a workstation nicety.