PULSEUnderground Intel

LIVE32signals / 24h

FEED

ransomn0n reclama a Performance Ford Inc · US · Retail & E-Commerceransomn0n reclama a Company #109 · Not Foundransomn0n reclama a Company #108 · Not Foundransomn0n reclama a Company #107 · BG · Not Foundransomn0n reclama a Company #106 · Not Foundransomn0n reclama a Company #105 · Not Foundransomn0n reclama a Company #104 · Not Foundransomspacebears reclama a SGLA (Schwartz, Giannini, Lantsberger & Adamson) · US · Professional Servicesransomlamashtu reclama a Hecker Holzsystembau · DE · Manufacturingransomeverest reclama a Linebarger Goggan Blair & Sampson · US · Professional Servicesransomincransom reclama a bereskinparr.com smartbiggar.ca · CA · Professional Servicesransomsilentransomgroup reclama a K.r.a. ...s · Not Foundransomlamashtu reclama a Gräfliches Hofbrauhaus Freising · DE · Agriculture and Food Productionransomlamashtu reclama a VERGI Muenster · DE · Energy & Utilitiesransomn0n reclama a Performance Ford Inc · US · Retail & E-Commerceransomn0n reclama a Company #109 · Not Foundransomn0n reclama a Company #108 · Not Foundransomn0n reclama a Company #107 · BG · Not Foundransomn0n reclama a Company #106 · Not Foundransomn0n reclama a Company #105 · Not Foundransomn0n reclama a Company #104 · Not Foundransomspacebears reclama a SGLA (Schwartz, Giannini, Lantsberger & Adamson) · US · Professional Servicesransomlamashtu reclama a Hecker Holzsystembau · DE · Manufacturingransomeverest reclama a Linebarger Goggan Blair & Sampson · US · Professional Servicesransomincransom reclama a bereskinparr.com smartbiggar.ca · CA · Professional Servicesransomsilentransomgroup reclama a K.r.a. ...s · Not Foundransomlamashtu reclama a Gräfliches Hofbrauhaus Freising · DE · Agriculture and Food Productionransomlamashtu reclama a VERGI Muenster · DE · Energy & Utilities

CVE WatchOct 16, 2026

CVE-2026-85802

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

CVSS

7.0

High

EPSS

0.3%

p17

KEV

—

Exploit Today

5

0-100

Published: Oct 13, 2026 · Last modified: Oct 16, 2026 · CWE-416

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-10-142026-10-21

Technical description

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Official references

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85802

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-972067.5 HIG

——5NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.1d CVE-2026-114111—

——1sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.2d CVE-2026-1140426.5 MED

——5FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.2d CVE-2026-1133448.8 HIG

——10Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)2d CVE-2026-1133398.8 HIG

——10Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)1d CVE-2026-1133388.8 HIG

——10Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)2d

CVE-2026-85802 — Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t · Pulse | Pulse