Microsoft Windows Filtering Platform: Local privilege escalation via stack buffer overflow

Summary

A stack-based buffer overflow in the Windows Filtering Platform (WFP) allows an authorized local user to elevate privileges. An attacker with a foothold on a system, such as through a compromised user account or malware, could gain SYSTEM rights. The attack requires low privileges, no user interaction and high attack complexity, and the vulnerability is not reachable from the internet. NVD analysis was still pending at the time of writing.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Install the November 2026 Windows security update for the affected build.
• Build numbers are taken from the CVE record and a third-party aggregator; the Windows 11 24H2 and Windows Server 2025 builds conflict (both use build 26100). Verify against the MSRC entry before relying on them.
• No separate patch was found.

Workaround

Unknown.

Exploitation

• Microsoft marks the vulnerability as not exploited.
• No public proof of concept was found.
• CVE.org lists exploit maturity as unproven (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Apply the November 2026 cumulative update to Windows 10, Windows 11 and Windows Server 2019, 2022 and 2025 hosts.
• Prioritise multi-user systems such as terminal servers and RDS hosts.
• Check whether your Windows 10 21H2 and 22H2 systems still receive security updates, as this determines whether a fix is available to you.
• Re-check the MSRC entry and NVD once analysis is complete, as details may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide: CVE-2026-105553 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-105553 www.cve.org
• Strix: CVE-2026-105553 (third-party aggregator) www.strix.ai
• Rapid7: Patch Tuesday November 2026 summary www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:37.