Microsoft Windows: Remote code execution in Text Shaping

Summary

Windows Text Shaping, the OS component that converts characters into glyphs for rendering, contains a heap-based buffer overflow. A remote, unauthenticated attacker without user interaction may be able to execute code, as rated CVSS 9.8 (Critical). The sources do not name the network-facing service or file format that reaches the flaw, so exposure cannot be judged from the vector alone.

Affected

• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9376)
• Windows Server 2022 (builds before 10.0.20348.5761)
• Windows Server 2025, including Server Core (builds before 10.0.26100.33650)

Fixed in

• Install the October 13, 2026 Microsoft security update for the affected build.
• Fixed builds per CNA record: 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025).
• Verify the exact build and KB mapping on the MSRC Security Update Guide, as the sources conflict on some details.

Workaround

Unknown. No vendor workaround or interim mitigation was identified in the sources. Patching is the only documented fix.

Exploitation

• Exploited in the wild: Unknown. CISA SSVC lists exploitation as none, but third-party reports are inconsistent and do not clearly name this CVE.
• Public proof of concept: None found.
• EPSS: 0.00893 (low predicted exploitation probability).

Our recommendation

• Patch affected Windows 10 and Windows Server systems with the October 2026 update as a high priority.
• Start with internet-facing hosts and legacy Windows 10 1809 and Server 2019 systems.
• Confirm the CVE-to-KB mapping and fixed builds on the MSRC page before rollout.
• Check the CISA KEV catalog and monitor for public exploit code.
• Isolate or replace systems that no longer receive security updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• NVD record via Vulners vulners.com
• Strix CVE record (third-party, verify build data) www.strix.ai
• Tenable plugin 365475 (Windows 10 1809 / Server 2019) www.tenable.com
• Tenable plugin 365467 (Windows 10 21H2 / 22H2) www.tenable.com
• Senserva Patch Tuesday summary senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:56.