Windows: Heap-based buffer overflow in HID class driver

Summary

A heap-based buffer overflow in the Windows HID class driver allows an authorized local user to elevate privileges. Successful exploitation could give an attacker high impact on confidentiality, integrity and availability of the system. The attacker needs a local account with low privileges, so the flaw is not reachable over the network and is mainly a second step after another compromise.

Affected

• Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9711
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 before 6.3.9600.23470
• Windows Server 2016 (including Server Core): 10.0.14393.0 before 10.0.14393.9612
• Windows Server 2019: 10.0.17763.0 before 10.0.17763.9376

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376
• Windows 10 Version 21H2: build 10.0.19044.7807
• Windows 10 Version 22H2: build 10.0.19045.7807
• Windows 11 Version 23H2: build 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: build 10.0.28000.3231
• Windows Server 2012 R2: build 6.3.9600.23470

The exact KB numbers are listed on the MSRC update guide page.

Workaround

Unknown. No interim mitigation was found in the available sources. Install the security update.

Exploitation

• Not known to be exploited in the wild according to the available sources. Microsoft's exploit code maturity is 'unproven'.
• No public proof-of-concept exploit was found for this CVE.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS score 0.00306 (low predicted exploitation probability).
• Status in the CISA KEV catalog was not checked.

Our recommendation

• Install the October 2026 Windows security update on all affected systems, prioritizing the systems with the oldest builds.
• If any systems still run Windows 10 Version 1607 or Windows Server 2016, plan an upgrade. Check Microsoft's Lifecycle page for the support status.
• Limit local interactive logons and enforce least privilege for user accounts.
• Restrict unapproved USB and HID devices with device-control policies.
• Monitor for unusual privilege escalation events on endpoints and servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105003 msrc.microsoft.com
• NVD mirror on Vulners: CVE-2026-105003 vulners.com
• CVE list record on Vulners: CVELIST:CVE-2026-105003 vulners.com
• threatint CVE record: CVE-2026-105003 cve.threatint.com
• Strix CVE record: CVE-2026-105003 www.strix.ai
• VulDB entry 418064 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:02.