Microsoft Windows: Heap overflow in Update Service enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows Update Service allows an authorized local user to elevate privileges. Affected are Windows 10 Version 1607, Server 2016 and several other Windows 10, Windows 11 and Windows Server versions according to the CNA record. The attacker needs local access and valid low-privilege credentials, and the attack complexity is high. The impact on confidentiality, integrity and availability is high if the flaw is exploited.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2016 and Server Core installation (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 and Windows Server 2019 incl. Server Core (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 and 26H2 (10.0.26200.0 before 10.0.26200.9711 and 10.0.26300.0 before 10.0.26300.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5761)

Fixed in

• Windows 10 1607 and Server 2016: build 14393.9612 via cumulative update KB5126868 (minimum fixed build, not verified by MSRC)
• Windows 10 1809 and Server 2019: build 17763.9376
• Windows 10 21H2: build 19044.7807
• Windows 10 22H2: build 19045.7807
• Windows 11 23H2: build 22631.7652
• Windows 11 24H2: build 26100.9711
• Windows 11 25H2 and 26H2: builds 26200.9711 and 26300.9711
• Windows 11 26H1: build 28000.3231
• Windows Server 2022: build 20348.5761

Workaround

Unknown. No workaround for this CVE was found in the sources; the vendor-recommended remedy is the security update.

Exploitation

• No confirmed in-the-wild exploitation was found.
• No public proof of concept was found for this CVE.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score 0.0027 (low).
• Whether the CVE is listed in the CISA KEV catalog could not be confirmed.

Our recommendation

• Patch Windows 10 1607 and Server 2016 hosts promptly with KB5126868 or a later build, or retire these end-of-support systems.
• Check and patch all other listed Windows versions in your estate.
• Verify the fixed build against the MSRC advisory before rollout.
• Note the release-health known issue with KB5126868 on some on-premises Exchange servers and confirm the support status of Windows 10 1607 LTSB for your edition.
• Limit local logon rights and monitor for unexpected privilege escalation to SYSTEM on critical hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• NVD record mirror (Vulners) vulners.com
• CVE record mirror (Vulners CVELIST) vulners.com
• VulDB entry vuldb.com
• Microsoft Update Catalog: KB5126868 catalog.update.microsoft.com
• Microsoft release health: Windows 10 1607 and Server 2016 learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 10:01.