Windows Storage: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Storage component allows an authorized local user to elevate privileges. An attacker needs a low-privilege account or code execution on the machine first, the attack complexity is high and no user interaction is required. Successful exploitation would have a high impact on confidentiality, integrity and availability. The vulnerability cannot be exploited remotely.

Affected

• Windows 10 Version 1607 and Windows Server 2016: before 10.0.14393.9612
• Windows 10 Version 1809: before 10.0.17763.9376
• Windows 10 Version 21H2: before 10.0.19044.7807
• Windows 10 Version 22H2: before 10.0.19045.7807
• Windows 11 Version 23H2: before 10.0.22631.7652
• Windows 11 Version 24H2: before 10.0.26100.9711
• Windows 11 Version 25H2: before 10.0.26200.9711
• Windows 11 Version 26H1: before 10.0.28000.3231
• Windows 11 Version 26H2: before 10.0.26300.9711
• Windows Server 2012 (including Server Core): before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): before 6.3.9600.23470

Build numbers are taken from the CNA data and must be verified on the MSRC page.

Fixed in

• Fixed in the October 2026 security updates for each affected Windows version (for example KB5126868 for Windows 10 1607, per the research notes).
• Unknown whether later cumulative updates for Windows 10 1607 have been released since October 2026.

Workaround

• Unknown: no vendor mitigation has been confirmed in the sources.
• Restrict local logon to trusted staff, remove unneeded local accounts and enforce least privilege while patching.

Exploitation

• No exploitation in the wild found in the sources (CISA was not checked directly).
• No public proof-of-concept found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS about 0.003 at the time of the mirrored records.

Our recommendation

• Install the October 2026 security updates on all affected systems, starting with Windows 10 1607 and Server 2016.
• Plan an upgrade for any Windows 10 1607 systems, because general knowledge suggests the LTSB 2016 support ends on 13 October 2026 (verify on Microsoft's lifecycle page).
• Restrict local logon to trusted staff, remove unneeded local accounts and enforce least privilege.
• Monitor shared PCs for unusual privilege changes and treat this as high priority for unpatched 1607 or 2016 systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide entry CVE-2026-100225 msrc.microsoft.com
• CNA data with version ranges (Vulners CVELIST) vulners.com
• NVD record mirror (Vulners) vulners.com
• Affected table and CVSS (Strix) www.strix.ai
• KB list and EPSS (Positive Technologies via Vulners) vulners.com
• KB5126868 reference (Tenable Nessus plugin) www.tenable.com
• Microsoft customer-risk cohort document cdn-dynmedia-1.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:58.