Microsoft Windows: Local elevation of privilege in NDIS driver ndis.sys
Summary
A local elevation of privilege vulnerability in ndis.sys, the Windows kernel driver for the Network Driver Interface Specification (NDIS), allows an attacker to run processes in an elevated context. The driver fails to check the length of a buffer before copying memory into it. An attacker must already have local access and be able to run a malicious application. The CVSS vector lists a network attack vector, but the advisory describes a local attack, so treat it as local.
Affected
- Windows 10 Version 1607 (Server 2016): builds below 10.0.14393.9612
- Windows 10 Version 1809: builds below 10.0.17763.9376
- Windows 10 Version 21H2: builds below 10.0.19044.7807
- Windows 10 Version 22H2: builds below 10.0.19045.7807
- Windows 11 Version 23H2: builds below 10.0.22631.7652
- Windows 11 Version 24H2: builds below 10.0.26100.9711
- Windows 11 Version 25H2: builds below 10.0.26200.9711
- Windows 11 Version 26H1: builds below 10.0.28000.3231
- Windows 11 Version 26H2: builds below 10.0.26300.9711
- Windows Server 2012 and 2012 Server Core: builds below 6.2.9200.26434
- Windows Server 2012 R2 and R2 Server Core: builds below 6.3.9600.23470
Fixed in
- Install the security update released on October 13, 2026 (Patch Tuesday) for your Windows version.
- Windows 10 Version 1607: build 10.0.14393.9612 or later.
- Other fixed builds: as listed in the CVE record above. Verify the exact KB numbers on the Microsoft Security Update Guide.
Workaround
Unknown. No vendor workaround has been identified.
Exploitation
- No evidence of in-the-wild exploitation found.
- Not found in the CISA KEV catalog.
- No public proof-of-concept code found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS about 0.87 percent, which is low.
Our recommendation
- Patch all affected Windows systems with the October 2026 security update, starting with Windows 10 Version 1607 machines.
- Treat unpatched Windows 10 Version 1607 systems as high priority. Check the Microsoft lifecycle page for support options, because the product may be out of support.
- Limit local user rights and restrict the execution of unknown applications, for example with application allowlisting.
- Monitor endpoints for new or unknown local binaries and for suspicious privilege changes.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows NDIS
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126835, KB5126836, KB5126868, KB5126651, KB5126657, KB5126655
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105007 msrc.microsoft.com
- Vulners NVD record CVE-2026-105007 vulners.com
- Vulners Vulnrichment CVE-2026-105007 vulners.com
- Strix CVE-2026-105007 www.strix.ai
- ThreatInt CVE-2026-105007 cve.threatint.com
- Vulners EUVD-2026-100396 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:22.
Original description (NVD)
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability. The security update addresses the vulnerability by changing how ndis.sys validates buffer length.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.